Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Want to run a public DNS

0 views
Skip to first unread message

Sharad Naik

unread,
Sep 10, 2004, 12:08:53 PM9/10/04
to
My set up is Win 2003 which AD, DHCP, WINS, NAT and Mail server (3rd party)
DNS is bound only to internal IP. (Win 2003 is behind a third party
firewall.)

Now that SPF records are almost becoming a necessity for running a mail
server
I contacted various ISP's in my country, however, a workable deal for
hosting
my public DNS records, with SPF records isn't working.

I anyhow don't have a backup mail server, and all I need is single MX
record,
(which necessitates a single Host record and txt (SPF) record.). If my
internet
link is down my mail server is down. So if I run my own public DNS, it won't
be
a much harm when the internet link goes down.

But I have only a single Server (win 2003). I am thinking of installing a
BIND DNS
server on win 2003. Thus win 2003 will be running MS DNS + BIND DNS.
BIND DNS will be bound to the internet side IP, MS DNS to internal IP.

My questions are as under:
1. will this (running 2 DNS servers on a win 2003 AD) work or will I land up
in problems?
Presently I can't run a second
2. Though I have to configure the names server on BIND DNS, I think
basically the idea
is same for BIND / MS DNS: I will be running two public zones: namely
a1.com, b1.com
(actual public names are pfeiffer-vacuum.co.in and schmalz.co.in but using
small examples
for simplicity.) Can I just configure namses server for this two zones to,
say, ns1.a1.com
and then with my domain registrar point the names server to ns1.a1.com and
my public IP?
OR in short this question can be rephrased as :- I have a registered domain
a1.com
I can run my own public DNS, setting names server in MY DNS to ns1.a1.com
and configuring same with my DNS registrar giving the public IP address of
my DNS server?

My plan is that subsequently run a backup mail server, and a secondary
public DNS server (Another office coming up in future at another location
with different ISP, and
we two will be backup mail servers, secondary DNS servers for each other.)

Sharad Naik


Steve Bruce

unread,
Sep 10, 2004, 12:45:53 PM9/10/04
to
Not the best security practice run public dns and active directory dns on
the same machine . . . but if you are going to do it, you can make it simple
just by making a new dns zone for the public domain on the Micorsoft DNS
server. - I am not familiar with any reason why you would need a bind
server running on the same computer

Then update your dns settings with your domain registrar - it will take
12 -24 hours for that change to propogate to top level servers.

I trust that you have a true static address, because if ever changes you
will be offline for 12-24 hours while you make the change with registrar
again.


"Sharad Naik" <shara...@nospam-vsnl.net> wrote in message
news:eyOuAC1...@tk2msftngp13.phx.gbl...

Sharad Naik

unread,
Sep 10, 2004, 1:32:07 PM9/10/04
to
Running the public zone on MS DNS would be a security issue, because then I
have to bind MS DNS to both internal and internet IP.
That's the reason why I thought of running another DNS (BIND) on the same
machine, Ms DNS will listen only to the private IP and BIND only to the
public.

Also propgation time is not a problem. Presently the records are hosted by
an ISP, which also points to the same
public IP address which I will set up in my public DNS (if & when I set it
up). So whether old chached record
or new record from my own DNS both will resolve to same IP address.

My basic question is that, can I just configure names server of the public
zone a1.com, which I will add in my public dns,
to ns1.a1.com (if this should work it should automatically add host record
ns1 in zone a1.com, will it?).
ns1.a1.com is not a public record avaialble as yet. Will it be sufficient
for public to resolve this, just if with my domain
registrar I add this as a names server and point it to my (static) public
IP?

Sharad

"Steve Bruce" <st...@xmaslake.com> wrote in message
news:uuuPvW1l...@TK2MSFTNGP15.phx.gbl...

Steve Bruce, mct

unread,
Sep 10, 2004, 2:34:49 PM9/10/04
to
Regarding your basic question.
I know it will work if you go to your registrar and remove the existing DNS
servers and add your DNS server.

I think you were asking about an alternative configuration that I cannot
answer.

I hope that helps


"Sharad Naik" <shara...@nospam-vsnl.net> wrote in message

news:%23FVvhw1...@TK2MSFTNGP15.phx.gbl...

Steve Bruce, mct

unread,
Sep 10, 2004, 2:38:15 PM9/10/04
to
You probably know that most Registrars allow you to login and manage the DNS
configuration for your domain, so it should be easy to remove the existing
DNS servers and add yours.

"Steve Bruce, mct" <st...@xmaslake.com> wrote in message
news:OLDYlT2l...@TK2MSFTNGP15.phx.gbl...

Sharad Naik

unread,
Sep 11, 2004, 2:19:22 AM9/11/04
to
Thanks Steve,
I configured the public zone a1.com configuring it's names server as
ns1.a1.com
Doing lookup externally with my DNS server (by it's IP address ofcourse) is
working fine.

Presently host record for ns1.a1.com exists only in my DNS server.
With my domain registrar when I change Dns server to ns1.a1.com giving my
public
IP, will people be able to resolve ns1.a1.com to it's IP w/o contacting my
DNS server?
Or say if my DNS server is down, will people be able to resolve
'ns1.a1.com' just because
I have entered this names server and it's public IP with my domain
registrar? (Of course
any other records for a1.com will not be resolved if my DNS server is down,
but only 'ns1.a1.com'
should get resolved, am I correct?)

Sharad


"Steve Bruce, mct" <st...@xmaslake.com> wrote in message
news:OLDYlT2l...@TK2MSFTNGP15.phx.gbl...

Kevin D. Goodknecht Sr. [MVP]

unread,
Sep 11, 2004, 10:20:59 AM9/11/04
to
In news:e1g4Pd8l...@TK2MSFTNGP09.phx.gbl,
Sharad Naik <shara...@nospam-vsnl.net> wrote their comments
Then Kevin replied below:

> Thanks Steve,
> I configured the public zone a1.com configuring it's
> names server as ns1.a1.com
> Doing lookup externally with my DNS server (by it's IP
> address ofcourse) is working fine.
>
> Presently host record for ns1.a1.com exists only in my
> DNS server.
> With my domain registrar when I change Dns server to
> ns1.a1.com giving my public
> IP, will people be able to resolve ns1.a1.com to it's IP
> w/o contacting my DNS server?

Yes, they will. That is the reason for have name servers listed at the
parent ".com" servers, it provides the glue for your public DNS server. The
record you have on your DNS is your glue, "glue" meaning that when you ask
your DNS server for your NS record, it also returns an "A" record, without
glue you DNS won't be able to resolve its own NS record.

> Or say if my DNS server is down, will people be able to
> resolve 'ns1.a1.com' just because
> I have entered this names server and it's public IP with
> my domain registrar?

Same answer as above

> (Of course
> any other records for a1.com will not be resolved if my
> DNS server is down, but only 'ns1.a1.com'
> should get resolved, am I correct?)

That is correct, the .com servers will return the IP of your DNS, all other
records must come from your DNS servers.


--
Best regards,
Kevin D4 Dad Goodknecht Sr. [MVP]
Hope This Helps
================================================
--
When responding to posts, please "Reply to Group"
via your newsreader so that others may learn and
benefit from your issue, to respond directly to
me remove the nospam. from my email address.
================================================
http://www.lonestaramerica.com/
================================================
Use Outlook Express?... Get OE_Quotefix:
It will strip signature out and more
http://home.in.tum.de/~jain/software/oe-quotefix/
================================================
Keep a back up of your OE settings and folders
with OEBackup:
http://www.oehelp.com/OEBackup/Default.aspx
================================================


Sharad Naik

unread,
Sep 11, 2004, 11:10:47 AM9/11/04
to
Thanks Kevin, I wanted this confirmation (wasn't sure how the NS record
lookup at registrar works.)
I am going ahead with chaning NS recrod with domain registrar.

Sharad

"Kevin D. Goodknecht Sr. [MVP]" <ad...@nospam.WFTX.US> wrote in message
news:O20ETqAm...@TK2MSFTNGP14.phx.gbl...

0 new messages