mawaax

hi guys,

i cant get the client pcs to view the my companies website.

I have set up DHCP and the server as the dns server. I
have enabled DNS forwarding so that the servers IP looks
at the dns servers given to me by our internet providers.

The problem lies here... when i set my dns servers on dhcp
(in this case the servers ip address...) it doesnt allow
the clients to view the company home page. they can browse
anyother page perfectly but not the company web site.

the server is called SERVER.companywebsite.com using
itslef as a dns server....

is this wrong??
if i set any other dns as the dns server for internet
browsing its fine for a while... after a few hours the
same happens again..... but i need to have the server as
the dns server otherwise the clients take way to long to
log on.

this might sound confusing...... but i need help.... i am
happy to clarify

john lemay

Why did you do this? I'd start by deleting the forwarders.


Are you using the same domain name internally (on the AD server) as you
are externally (for the real world)?

If so, where is the web page? I'm guessing it's probably on the ISP's
network someplace. Basically, somewhere besides your local network.

If I've guessed correctly, you should find this information helpful.

If you use the same domain name internally and externally you need to
setup and maintain what is called a "split brain DNS". In other words you
need to maintain a copy of records for any external servers for your
domain - like a web server - on your internal DNS server.

Let's say you have a domain called "xyz.com". Your ISP hosts the public
DNS for the domain and has entries for "www", "mail", and maybe others.
For the outside world everything looks great.

Now you come along with your Windows 2000 machine and make is a DC in
domain "xyz.com". DNS gets configured when you run dcpromo and everything
seems fine. However, your clients (or the server for that matter) - using
the DC as their DNS server - won't be able to resolve "www.xyz.com",
"mail.xyz.com", or anything else that is available to the outside world.

This is because the DC thinks that it is the root server for xyz.com. It
believes that if it doesn't know about a host on xyz.com, it must not
exist. Therefore www and mail are unavailable to any user's pointing to
the DC for DNS services since there are no entries (because you didn't
create them) for these hosts in the dns forward lookup zone for xyz.com.

Many people - myself included way back when - first think that you need to
configure DNS forwarders in order to resolve these hosts (www and mail in
our example). This is NOT what forwarders are for. Forwarders tell the DNS
server to send requests for domains not hosted on that server to the
forwarder's addresses as the next step in the resolution process. The
server will NOT forward requests for any hosts whose domain it is
configured for - in this case xyz.com.

Forwarders make no sense in most scenarios. They are only of use - IMHO -
in large corporate environments where you have several layers of DNS
servers or where you want to use a central DNS server or servers for
caching purposes in order to reduce the amount of traffic going to the
Internet for name resolution purposes (either because of bandwidth or just
for general performance). Forwarding to a DNS server that is on the
Internet already is just plain dumb (go ahead, someone prove me wrong here
and give me a good reason for forwarding to a DNS server that is on the
Internet - and it better not be because you don't know how to open port 53
on your firewall either).

Now, let's get back to fixing your problem - the split brain DNS
configuration I mentioned way back when. The simple answer is to figure
out what the web server's and any other server's public ip address is
(hint - use nslookup or dig) and make entries for these hosts in your
internal DNS (right in the forward lookup zone for your domain - xyz.com
in our example here. This means you will have to maintain these if they change.
However, once you do this your clients will be able to get to the
webserver - again, if I've guessed the issue properly.

--
John LeMay
kc2kth
Senior Technical Manager
NJMC | http://www.njmc.com | Phone 732-557-4848
Specializing in Microsoft and Unix based solutions

mawaax

you are spot on with the problem.. i shall test this later
thankx a million


make is a DC in


of use - IMHO -

is on the

prove me wrong here

that is on the

how to open port 53

brain DNS

answer is to figure

ip address is

hosts in your

domain - xyz.com

these if they change.

get to the

john lemay

Granted it was harsh, but I really wanted to stir up this topic a bit. I
thought I qualified the statement by indicating that it was my opinion,
but that should have been obvious anyhow.


I disagree. We, the experienced ones, are here to provide "best practices"
advice for those trying to implement for the first time what we can
probably do blindfolded anymore. What better way to do that than in a
forum like this where we present different opinions and argue our points?
I look forward to doing this often with yourself and others here!


No, I am not. I need to qualify that a bit though. While my company
offers webhosting, we are only a reseller of the services and not the
actual hosting company. I'm also not here necessarily to advertise either!

I actually understand the ISP's point though (check out my other response
in another thread). Why should the ISP want to handle the extra traffic?
Proper DNS, IMHO (qualified that one! <g>), is a cost of doing business
just like any other portion of implementing AD. I know it's a stupid
example, but you wouldn't expect your ISP to handle your print servers, right?


Agreed.

--
John LeMay
kc2kth
Senior Technical Manager
NJMC | http://www.njmc.com | Phone 732-557-4848
Specializing in Microsoft and Unix based solutions

ace fekay [mvp]

In newsan.2003.07.08.14.18.21.271615@njmc.com,
John LeMay <jlemay@njmc.com> posted his concerns then I replied down below:


Agreed it was harsh. It was your opinion, and I'll give you that much.


Actually we ARE here to help. That's the purpose of the public MS groups. It
is helpful in some cases to argue out different points of views to give the
reader more perspective in a design, but it could also lead to excessive
confusion. Lengthy discussions can be helpful or harmful to the original
poster, where it may offer insight and extra information on the topic, yet
with some it may lead to much confusion where the original poster does not
know what suggestions to follow and their problem remains.

The consensus is on trying to provide assistance with the least possible
confusion and offer "best practices" to the user, with some examples to
facilitate that. In this case of our discussion, Forwarding, the consensus
here is to use individual forwarding. In a larger environment, the design
will need to be adapted for best performance, WAN efficiency and clean
resolution of all resources throughout the forest. Forwarding in that case
would be highly dependent on the number of domains, WAN links and other
factors, such as delegation and the need to ensure resolution throughout the
forest for AD functionality.


Well, that's good to hear you're not trying to advertise. I don't even
supply my private company name in my signature. There is one other here that
does advertise that uses his company as examples, that I feel he's trying to
promote it constantly and it's somewhat annoying.

Hey, I should advertise that one of my German Shepherds (sire and dam AKC
and Prem OFA), just had 9 puppies and I need to sell all of them by the end
of August, but I don't, even though I have an avenue here.
btw- Interested? :-)

I have to agree here. I'm a small time ISP, hosting about 25 domains (email,
ftp, etc) but I'm not a carrier, just offering services. If I were offering
access, I would frown on it too.


Very good. I look forward to more "discussions" with you. You'll find there
are a few of us here that will take the challenge, but as I stated, we are
here to help.

--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory
--
=================================

kevin d. goodknecht sr. [mvp]

In news:OcENvQWRDHA.2088@TK2MSFTNGP11.phx.gbl,
Ace Fekay [MVP] <PleaseSubstituteMyFirstName&LastNameHere@hotmail. com>
posted their concerrns,
Then Kevin D4Dad added his reply at the bottom.
!

LOL gee Ace, I wonder who does that?

Oh! I have my link to my website, if I didn't know better you could be
talking about me. (I know you're not) But just for the info, my website is a
hobby, it is only for friends and family for most of those that don't visit
here very often. I never promote it or push it on anybody. I started the web
site a a place to publish my personal web sites. I donate space to one High
School for their JROTC program. The rest are links I use regularly so I want
them on my home page, They are not being promoted by me, just so everybody
knows.


--
Best regards,
Kevin D4 Dad Goodknecht Sr. [MVP]
--
Hope This Helps
++++++++++++++++++++++++++++++++++++++++++
When responding to posts, please "Reply to Group" or
"Reply All" via your newsreader so that others may learn
and benefit from your issue
==========================================
http://www.lonestaramerica.com/
==========================================
Use Outlook Express?... Get OE_Quotefix:
It will strip signature out and more
http://home.in.tum.de/~jain/software/oe-quotefix/
==========================================
Keep a back up of your OE settings and folders with
OEBackup:
http://www.oehelp.com/OEBackup/Default.aspx
==========================================

john lemay

The statement we are referring to is when I called the practice of
forwarding dns requests off one's own network to an internet host instead
of using an onsite DNS server that is readily available dumb. I purposely
overstated my opinion there for the sake of argument.

After discussing this over the past few hours here I'm willing to back
pedal on that statement a bit (but since it was overstated to start
with...). I still don't think the practice delivers any real performance
improvement in any correctly designed environment however.

Typically when a moderate to large organization negotiates with an ISP for
bandwidth they plan on providing their own DNS services within their
organization. The ISP knows this and does not plan on having a few hundred
or more new client stations accessing their DNS servers for every query
(either directly or the same quantity of queries proxied through another
DNS server that is configured with forwarders). ISP's do expect smaller
clients - those with fewer than 30 or so stations - to use their DNS
services.

We haven't really discussed anywhere the differences in expectations on
the part of the client or the ISP based on the size of the client, but it
is an important design factor (as I'm sure you know, I just felt it needed
to be stated here).

Suppose we are discussing a small, single DC environment with roughly
20 clients. The clients are Windows 2000 Pro and are joined to the domain.
How would you configure DNS? If you gave each client only the one DNS
server your clients lose all access - internal and Internet - if the DC is
unavailable.

In my scenario - assigning the DC address as primary DNS server and one of the
ISP's servers as secondary DNS server - allows these clients to still have
Internet access if the DC is unavailable. For many small clients this
means that they still have access to email even if they can't access their
file server.

To the best of my knowledge, any AD requests sent to a DNS server that
cannot handle the request are simply discarded by the DNS server. In addition,
hopefully the DC is relatively stable and available to service these
requests the majority of the time limiting the number of "bad" requests
the remote DNS server must deal with.

It certainly would be. It would also be equally as boring if everything
about the implementation was simply black and white. I suppose that's why
we discuss "best practices" instead of "best practice" or simply
"practice".

--
John LeMay
kc2kth
Senior Technical Manager
NJMC | http://www.njmc.com | Phone 732-557-4848
Specializing in Microsoft and Unix based solutions

ace fekay [mvp]

In news:#WFcZiWRDHA.560@TK2MSFTNGP10.phx.gbl,
Kevin D. Goodknecht Sr. [MVP] <admin@nospam.LSAOL.COM> posted his concerns
then I replied down below:

LOL, no it's not you Kevin!!! Never even considered that!

It's our other friend, without mentioning names, who always uses his domain
as examples in stuff, where we would use "domain.com", etc.

Ace

kevin d. goodknecht sr. [mvp]

In news:ODp%23y6XRDHA.1624@tk2msftngp13.phx.gbl,
Ace Fekay [MVP] <PleaseSubstituteMyFirstName&LastNameHere@hotmail. com>
posted their concerrns,
Then Kevin D4Dad added his reply at the bottom.

Ace, I know exactly who you were thinking of, to think about it there are at
least two that point to their own resources. Like they are the ultimate
authority to ask. But I don't let it bother me, I just consider the source
of the criticism.

--
Best regards,
Kevin D4 Dad Goodknecht Sr. [MVP]
--
Hope This Helps
++++++++++++++++++++++++++++++++++++++++++
When responding to posts, please "Reply to Group" or
"Reply All" via your newsreader so that others may learn
and benefit from your issue
==========================================
http://www.lonestaramerica.com/
==========================================
Use Outlook Express?... Get OE_Quotefix:
It will strip signature out and more
http://home.in.tum.de/~jain/software/oe-quotefix/
==========================================
Keep a back up of your OE settings and folders with
OEBackup:
http://www.oehelp.com/OEBackup/Default.aspx
==========================================

ace fekay [mvp]

In newsan.2003.07.08.17.21.49.897878@njmc.com,
John LeMay <jlemay@njmc.com> posted his concerns then I replied down below:


John, as for the way the Windows DNS Client Resolver Service works, if there
are mutliple DNS addresses listed in the IP properties, the resolver will
query the first one in the list. If the first one comes back with a NULL or
doesn't respond, then it goes to the second one in the list, but it removes
the first one out of the "eligible resolvers list" and never to go back to
it unless you either restart the machine or restart the DNS Client service.
This is of course a behavior that we have to deal with and it's not
efficient to go to each machine if this were the case. There is a reg entry
to alter this behavior that forces it to reset the list after each query.
But that of course is not ideal in any environment to give to all the
machines, especially with 3000 seats.

Here's more info on that:
286834 - The DNS Client Service Does Not Revert to Using the First Server in
the List:
http://support.microsoft.com/?id=286834

As for registration, yes, the netlogon service registers every 60 minutes on
a DC and are refreshed every 24 hours. That was changed in W2k3 to only
every 24 hours. Clients are usually once thru DHCP (is using it) or when you
manually ipconfig /registerdns or at startup with a static client. They all
use the Primary DNS Suffix to know what zone to reg into.

Here's a link on that behavior. This talks about altering the behavior, but
mentions (scroll down to netlogon) about the default registration timing in
W2k.
Q246804 - How to Enable-Disable Windows 2000 Dynamic DNS Registrations
(Default Registration Times are listed here):
http://support.microsoft.com/?id=246804

So you see, "best practice", as we were speaking of in an earlier
discussion, is to ONLY use your internal DNS and Forward (my preference) or
use the Roots (your preference).

Cheers!

--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory
--
=================================