When an organization wants to bring DNS security and management onto one platform, the first question is: what about Active Directory? Domain controllers and thousands of clients write their own records into DNS automatically. If that breaks, logons, group policy and Kerberos stop working.
How dynamic update works
When a Windows computer joins the network or its IP address changes, it writes its own A and PTR records to the DNS server. Domain controllers publish SRV records such as _ldap._tcp and _kerberos._tcp. In a secure environment these writes must be authenticated; otherwise anyone on the network could point someone else's name at their own IP.
Windows uses GSS-TSIG for this: the client proves its identity with a Kerberos ticket and the update is signed with that identity.
Secure dynamic update in NameDefence
The update mode is chosen per zone:
- Off: records change only from the management interface.
- With a TSIG key: for Linux servers, DHCP servers and automation tools.
- With an address list: for updates from specific trusted servers.
- GSS-TSIG (Kerberos): for Windows clients joined to Active Directory.
In GSS-TSIG mode each computer can only write its own name; it cannot change another computer's record. Domain controllers can update the apex and shared SRV records through a per-zone list of privileged updaters. Dynamic update can never delete a zone's NS and SOA records.
Zone transfer and NOTIFY
Migration is usually gradual. NameDefence can work as primary or secondary:
- The zone is imported from the existing Windows DNS or BIND server over AXFR.
- During the transition NameDefence acts as secondary and pulls changes on its own according to the SOA refresh timers.
- When you are ready, the roles switch: NameDefence becomes primary, announces changes to secondaries with NOTIFY, and they pull with AXFR/IXFR.
- Transfers can be signed with TSIG and are only allowed to the addresses you permit.
BIND zone files can also be imported directly.
Move DHCP along with it
When DNS and DHCP live on the same platform, addresses, leases and devices show up in one place in the IPAM view. ISC DHCPD, Windows DHCP and MikroTik configurations can be imported.
In short
Active Directory DNS is not an immovable part. With Kerberos-secured dynamic updates and a staged zone transfer, the migration can happen without users noticing anything.