<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body dir="auto">
<div>I agree with using BIND as the default DNS server even on Active Directory environments. Windows DNS on 2012 R2 is still very bad and lacks basic features like disabling external recursion. This should change on Server 2016 but I will stay with BIND.</div>
<div id="AppleMailSignature"><br>
</div>
<div id="AppleMailSignature">Another thing that I would like to add to this thread is about completely ditching Windows DNS and use BIND as the master zone for AD. The default procedure is just creating the AD sub zone on BIND as master and allowing IP updates
during the installation of AD. Since IP based updates are insecure, GSS-TSIG is used with Kerberos after the AD install. This is how we roll on our University.</div>
<div id="AppleMailSignature"><br>
</div>
<div id="AppleMailSignature">But we are a facing a similar issue. We would like to have a single DNS managing two distinct (and without trusts) AD domains. Using IP based updates would work as expected with the two different zones, but we are screwed with the
Kerberos Tickets and the keytabs. Since BIND does not allow multiple keytabs I really don't know what to do. If someone have an idea to solve this I will be very grateful.</div>
<div id="AppleMailSignature"><br>
</div>
<div id="AppleMailSignature">Thanks in advance,</div>
<div id="AppleMailSignature">V.</div>
<div id="AppleMailSignature"><br>
Sent from my iPhone</div>
<div><br>
On Jul 27, 2016, at 16:34, Darcy Kevin (FCA) <<a href="mailto:kevin.darcy@fcagroup.com">kevin.darcy@fcagroup.com</a>> wrote:<br>
<br>
</div>
<blockquote type="cite">
<div>
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Arial Black";
panose-1:2 11 10 4 2 1 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-reply;
color:black;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">My preference? Have all your clients use BIND to resolve DNS (this gives access to more advanced features like sortlisting, good query logging, blacklisting/redirection
through the RPZ mechanism, Anycast, etc.). Set up the BIND instances as slaves for the AD zones, and have the AD folks add the BIND instances to the apex NS records so that the DCs will trigger fast replication to BIND via the NOTIFY extension to the protocol.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">I’d never let a regular PC client use Microsoft DNS for resolving DNS. Perish the thought!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">Note that this approach, if implemented simply, doesn’t scale to large numbers of BIND instances (because you don’t want to add dozens or hundreds of apex NS
records to the zone). Beyond a certain threshold, you’d want to set up a multi-level slaving/NOTIFY hierarchy on the BIND side…<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">
- Kevin<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><image001.jpg></span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">----------------------------------------------------------------------<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial Black","sans-serif";color:black">Kevin Darcy</span><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:black"><br>
NAFTA Information Security Projects</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial Black","sans-serif";color:black">FCA US LLC<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:black">1075 W Entrance Dr,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:black">Auburn Hills, MI 48326<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:black">USA<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:black">Telephone: +1 (248) 838-6601
<br>
Mobile: +1 (810) 397-0103<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:black">Email:
<a href="mailto:kevin.darcy@fcagroup.com">kevin.darcy@fcagroup.com</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> bind-users [<a href="mailto:bind-users-bounces@lists.isc.org">mailto:bind-users-bounces@lists.isc.org</a>]
<b>On Behalf Of </b>Jeff Sadowski<br>
<b>Sent:</b> Wednesday, July 27, 2016 3:00 PM<br>
<b>To:</b> <a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br>
<b>Subject:</b> Re: Multiple AD domains<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">should I setup 192.168.1.1 as slaves to these two domains would that fix it?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Wed, Jul 27, 2016 at 12:56 PM, Jeff Sadowski <<a href="mailto:jeff.sadowski@gmail.com" target="_blank">jeff.sadowski@gmail.com</a>> wrote:<o:p></o:p></p>
<div>
<p class="MsoNormal">On the samba mailing list they described setting up the DC as the NS and forward to another machine for more rules.<o:p></o:p></p>
<div>
<p class="MsoNormal">This will work fine for one domain. Now lets say I have 2 domains.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">If I setup forwarders like so on 192.168.1.1<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">zone "domainA" IN { type forward; forward only; forwarders { 192.168.2.1; }; };<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">zone "domainB" IN { type forward; forward only; forwarders { 192.168.3.1; }; };<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">It will cache entries for each domain and if a computer gets a different address for dhcp it will update on the domain's DNS but the dns on 192.168.1.1 will have a cached entry untill it expires.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">192.168.2.1 and 192.168.3.1 are setup to forward all other zones than their domain names to 192.168.1.1<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">if I have DNS server set for all machines in domainA to 192.168.2.1 all machines on domainA see any DNS changes to domainA imediately machines on domainB are cached and can take time to clear out.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">And<o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">if I have DNS server set for all machines in domainB to 192.168.3.1 all machines on domainB see any DNS changes to domainB imediately machines on domainA are cached and can take time to clear out.<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">What is the best way to resolve this issue?<o:p></o:p></p>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</blockquote>
<blockquote type="cite">
<div><span>_______________________________________________</span><br>
<span>Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list</span><br>
<span></span><br>
<span>bind-users mailing list</span><br>
<span><a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a></span><br>
<span><a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a></span></div>
</blockquote>
</body>
</html>