Name: The Foundation of Iron — Week 21 — DNS
Author: Amine RAITI

RATIO

THE FOUNDATION OF IRON · COURSE MATERIAL · WEEK 21

◆◆◆

DNS
PREREQUISITE OF ACTIVE DIRECTORY
Week 21 of 26 · Block 7 — DHCP and DNS
8h theory · 27h practice

◆

◆ WEEKLY LEARNING OBJECTIVES

1. Understand DNS resolution (recursive and iterative)
2. Know the main DNS record types (A, AAAA, MX, CNAME, PTR, SRV)
3. Install and configure an authoritative and recursive DNS server
4. Create and manage DNS zones
5. Diagnose common DNS resolution problems

◆◆◆

⚠ WARNING — SHELF LIFE OF VERSIONS AND SEQUENCING NOTE

This material references BIND9 and Unbound. Other implementations exist. The instructor adapts to the available tool. Sequencing reminder: DNS is taught here precisely because Active Directory depends on it as a direct technical prerequisite — the domain controller uses DNS SRV records to be located by clients.

◆

Amine RAITI · Infrastructure Architect & SRE
Public document · CC BY-NC-SA 4.0 · AI Powered by Amine
Opération Dindon

RATIO

COURSE OUTLINE · 8H

THEORY GUIDING THREAD — DNS

◆

21.1 · DNS resolution — recursive and iterative3h

— DNS hierarchy: root (.), TLD (.uk, .com), domain (example.com), subdomain (srv.example.com)
— Recursive resolution: the resolver does the work for the client (asks root, then TLD, then authoritative server)
— DNS cache: optimisation — a previously known answer is served directly until the TTL expires

21.2 · DNS record types2h

— A: name → IPv4 · AAAA: name → IPv6 · MX: domain mail server
— CNAME: alias (redirecting one name to another) · PTR: reverse resolution (IP → name)
— SRV: service location (port + priority) — essential for Active Directory (Week 22)

21.3 · DNS zones2h

— Forward zone (name → IP) vs reverse zone (IP → name)
— SOA (Start of Authority): mandatory record defining the zone's authority
— NS (Name Server): records indicating the authoritative servers for the zone

21.4 · DNS and Active Directory1h

— Active Directory depends on DNS to locate domain controllers via SRV records
— Without a working, correctly configured DNS, a Windows client cannot join an Active Directory domain — critical importance of this week before Week 22

RATIO

EXERCISE 1 · DNS SERVER INSTALLATION AND CONFIGURATION · 14H

Equipment: Linux VM, network access, client VMs for resolution testing.

(2h) Installing the DNS server, basic configuration (listening interfaces, forwarders for external resolution).

(3h) Creating a forward zone for a fictitious training domain (e.g. foundation.lan), adding A records for the already-deployed servers (Linux server, Windows server, hypervisor).

(2h) Creating a reverse zone for the subnet in use, adding the corresponding PTR records.

(3h) Configuring client VMs to use the new DNS server, testing resolution (forward, reverse, external resolution towards the internet).

(2h) Adding CNAME and MX records to the zone, verifying they work via DNS diagnostic tools.

(2h) Preparing the zone for Active Directory: creating the base records needed for the domain controller installation in Week 22.

SOLUTION — EXERCISE 1

Working resolution check: from a client VM configured with the training DNS server, a query on an internal zone name must return the correct address, and a query on an internet name must also resolve via the forwarder.

Preparation for Active Directory: the internal zone must be configured to accept dynamic updates, which will allow the domain controller (Week 22) to automatically register its SRV records during installation.

RATIO

EXERCISE 2 · DNS DIAGNOSIS AND DHCP INTEGRATION · 13H

Equipment: DNS server from Exercise 1, Week 20 DHCP server, client VMs.

(3h) DNS/DHCP integration: configure the DHCP server to distribute the local DNS server's address as the DNS option — clients now automatically receive IP address, mask, gateway AND DNS server.

(3h) DNS diagnosis: use available DNS diagnostic tools to test resolution (forward, reverse, resolution path trace), identify missing or incorrect records.

(3h) DNS failure simulation: DNS server unreachable (observe client behaviour — timeout, fallback), wrong A record (resolution to wrong IP), zone not correctly delegated — diagnosis and fix.

(2h) DNS cache analysis: observe response TTLs, flush the cache, compare resolution time with and without cache.

(2h) Writing the final DNS zone documentation with all created records and their justification.

SOLUTION — EXERCISE 2

Central teaching point of this week: by the end of this exercise, the complete infrastructure is in place — segmented VLANs (Week 18), inter-VLAN routing (Week 19), automatic address distribution with gateway and DNS via DHCP (Week 20), local and external name resolution operational (Week 21). This is the infrastructure on which Active Directory will be installed in Week 22.

◆ SUMMARY SHEET — WEEK 21 SELF-ASSESSMENT

1. I can describe the recursive DNS resolution process.

2. I know the DNS record types and their uses (A, MX, CNAME, PTR, SRV).

3. I can create a forward zone and a reverse zone.

4. I can configure a DNS server with forwarders.

5. I can test DNS resolution with diagnostic tools.

6. I can diagnose a DNS resolution problem.

7. I can integrate the DNS server with DHCP for automatic distribution.

8. I understand why a working DNS is a prerequisite for Active Directory.