DNS Administration
Introduction
If you're running Samba as Active Directory Domain Controller, you also have to administer a DNS server.
You will already find general information on the internal DNS and the BIND DLZ module and documentation about Bind as DNS Backend in the Wiki.
General
By default, Samba creates the following two forward zones during provisioning/upgrading (of course with your own domain name):
- samdom.example.com: Zone for your domain.
- _msdcs.samdom.example.com: This is the ForestDNSZone, that contains several service records for the entire directory.
Features
The Samba internal DNS is a new implementation. Although BIND is a grown up DNS and long in production on millions of servers, the Samba BIND DLZ module is still new. That's why both backends don't yet cover all the features that you can setup with the Microsoft DNS tools. If you discover problems or missing features, please open a bug report/feature request at https://bugzilla.samba.org/.
Even though the internal DNS and the BIND DLZ modules are new, they both support all basic requirements for Active Directory and more.
Known/issues missing features
- Managing zone transfers is not implemented yet. Bug report #9951:DNS MMC: Enabling DNS zone transfers in MMC fails
- Different zone transfer settings on internal DNS (denied) and BIND DLZ (allowed). Bug report #9634: Samba Bind DLZ module allows zone transfers for everyone
Importance of DNS for Active Directory
A working Active Directory is heavily based on a working DNS. It's not just for resolving IP addresses into names and vice versa. Clients find their Domain Controller/s and other important AD services by DNS queries.
Administering DNS on Windows
To administer DNS from a Windows client, you have to install the DNS MMC Snap-In. See Installing RSAT on Windows for AD Management for more details.
Adding new records
- Navigate to the zone, where you want to to add a new record.
- Right-click to it and choose the kind of record to add.
- Fill the fields and save the new entry.
Updating existing records
- Navigate to the zone that contains the record you want to edit.
- Right-click the record and choose „Properties“.
- Edit the entry and save the changes.
Delete a record
- Navigate to the zone that contains the record you want to remove.
- Right-click to the record and choose „Delete“.
Changing zone properties
- Right-click to a zone of which you you want to do changes.
- Choose „Properties“.
Note: Currently both DNS backends doesn't support all features, that can be setup in the dialogues. If you discover problems or missing features, please open a bug report/feature request at https://bugzilla.samba.org/.
Creating a new zone
As example we'll add a reverse lookup zone.
- Right-click to „Reverse Lookup Zones“ and choose „New Zone“.
- The „New Zone Wizard“ appears.
- Zone Type: Select „Primary zone“ and „Store the zone in Active Directory“.
- Zone Replication Scope: Depents on your needs.
- Reverse Lookup Zone Name: Depents on your needs.
- Dynamic Update: Depents on your needs.
- Finish the wizard.
If you are using BIND_DLZ as backend, then your new zone is directly live without restarting Samba or BIND.
The internal DNS as backend currently needs a restart of Samba to take effect. See bug report #9404.
Deleting a zone
- Right-click to a zone and choose „Delete“.
Administering DNS on Linux/Unix
Adding new records
- Example: Adding an A record
# samba-tool dns add <Your-AD-DNS-Server-IP-or-hostname> samdom.example.com demo A 10.99.0.55 Password for [administrator@SAMDOM.EXAMPLE.COM]: Record added successfully
- Example: Adding a PTR record to a reverse zone
# samba-tool dns add <Your-AD-DNS-Server-IP-or-hostname> 0.99.10.in-addr.arpa 55 PTR demo.samdom.example.com Password for [administrator@SAMDOM.EXAMPLE.COM]: Record added successfully
- Example: Adding a SRV record to _tcp.samdom.example.com
# samba-tool dns add <Your-AD-DNS-Server-IP-or-hostname> samdom.example.com _demo._tcp SRV 'demo.samdom.example.com 8080 0 100' Password for [administrator@SAMDOM.EXAMPLE.COM]: Record added successfully
- A note on SRV records: The order of the four parameters in the last field („data“) are 'hostname port priority weight' and have to be between ' '.
Updating existing records
- Example: Changing an A record
# samba-tool dns update <Your-AD-DNS-Server-IP-or-hostname> samdom.example.com demo A 10.99.0.55 10.99.0.66 Password for [administrator@SAMDOM.EXAMPLE.COM]: Record updated succefully
Delete a record
- Example: Deleting an A record
# samba-tool dns delete <Your-AD-DNS-Server-IP-or-hostname> samdom.example.com demo A 10.99.0.55 Password for [administrator@SAMDOM.EXAMPLE.COM]: Record deleted succefully
Creating a new zone
As example we'll add a reverse lookup zone.
# samba-tool dns zonecreate <Your-AD-DNS-Server-IP-or-hostname> 0.99.10.in-addr.arpa Password for [administrator@SAMDOM.EXAMPLE.COM]: Zone 0.99.10.in-addr.arpa created successfully
If you are using BIND_DLZ as backend, then your new zone is directly live without restarting Samba or BIND.
The internal DNS as backend currently needs a restart of Samba to take effect. See bug report #9404.
Deleting a zone
- Example: Deleting a reverse zone:
# samba-tool dns zonedelete <Your-AD-DNS-Server-IP-or-hostname> 0.99.10.in-addr.arpa Password for [administrator@SAMDOM.EXAMPLE.COM]: Zone 0.99.10.in-addr.arpa delete successfully
Configuring clients to use your AD DNS server