DNS Zones and Records

Analogy categoryAnalogies

Forward and Reverse Lookup Zones

A DNS zone is an administrative container that holds the resource records for a portion of the DNS namespace. A forward lookup zone, such as corp.contoso.com, resolves names to IP addresses and is what most people picture when they think of DNS. A reverse lookup zone does the opposite: it resolves an IP address back to a name, using a special reversed-octet domain like 2.168.192.in-addr.arpa for the 192.168.2.0/24 subnet. Reverse zones are frequently overlooked but matter for troubleshooting, certain security tools that perform reverse lookups on connecting hosts, and some logging systems that resolve IPs to hostnames for readability.

🏏

Cricket analogy: A forward zone is like a squad list mapping player names to shirt numbers, while a reverse zone is the opposite lookup, mapping a shirt number spotted on the field back to the player's name.

Common Resource Record Types

Within a zone, individual pieces of data are stored as resource records. An A record maps a hostname to an IPv4 address, while an AAAA record does the same for IPv6. A CNAME record is an alias that points one name to another canonical name, useful for giving a service like www a friendly alias without duplicating IP data. An MX record specifies which mail servers accept email for a domain, complete with a priority value for failover ordering. SRV records are especially important in Active Directory environments because they advertise services like LDAP and Kerberos, in the form _service._protocol.name, allowing clients to discover which hosts provide a given service and at what port.

🏏

Cricket analogy: An A record is like a team roster listing a player's exact fielding position, while an SRV record is more like a team announcement specifying which player will bowl, at what pace, and in what over.

Primary, Secondary, and AD-Integrated Zones

A zone can be hosted as a standard primary zone, where one server holds the writable, authoritative copy and any secondaries pull read-only copies via zone transfer; a standard secondary zone, the read-only replica just described; or an Active Directory-integrated zone, where zone data is stored in AD itself and replicated automatically to every domain controller running DNS, using AD's own multi-master replication instead of traditional zone transfers. AD-integrated zones are strongly recommended in AD environments because they support secure dynamic updates, tying record creation to Kerberos-authenticated computer accounts, and they eliminate the single point of failure inherent in a lone primary server.

🏏

Cricket analogy: A primary zone is like the official scorer's master scorebook, a secondary zone is the photocopy handed to the press box for reference, and AD-integration is like a shared live scoring app every official device updates simultaneously.

powershell

# Create an AD-integrated primary zone replicated to all DCs in the forest
Add-DnsServerPrimaryZone -Name "corp.contoso.com" -ReplicationScope "Forest"

# Add an A record for a file server
Add-DnsServerResourceRecordA -ZoneName "corp.contoso.com" -Name "fs01" -IPv4Address "10.0.10.25"

# Add a CNAME alias pointing to that file server
Add-DnsServerResourceRecordCName -ZoneName "corp.contoso.com" -Name "files" -HostNameAlias "fs01.corp.contoso.com"

# Create the matching reverse lookup zone
Add-DnsServerPrimaryZone -NetworkID "10.0.10.0/24" -ReplicationScope "Forest"

# List all A records in the zone
Get-DnsServerResourceRecord -ZoneName "corp.contoso.com" -RRType A

Deleting or renaming a zone that domain controllers depend on for SRV records can immediately break authentication for every client in that site. Always verify which SRV records live in a zone (under the _msdcs, _sites, _tcp, and _udp subdomains) before making structural changes, and test in a lab or maintenance window first.

Forward lookup zones resolve names to IP addresses; reverse lookup zones resolve IP addresses back to names using in-addr.arpa domains.
A/AAAA records map names to IPv4/IPv6 addresses; CNAME creates an alias; MX records prioritize mail servers.
SRV records advertise AD services like LDAP and Kerberos in the form _service._protocol.name.
Standard primary zones hold the writable copy; standard secondary zones are read-only replicas via zone transfer.
AD-integrated zones store data in Active Directory and replicate via multi-master AD replication, not traditional zone transfers.
AD-integrated zones support secure dynamic updates tied to Kerberos-authenticated computer accounts.
Structural zone changes can break SRV-dependent authentication, so test carefully before altering production zones.