class<\/code> is always IN<\/li>\nTTL<\/code> is in seconds\u00a0<\/li>\nservice<\/code> is the name of the service (example: LDAP, GC, DC, Kerberos). It is preceded by an underscore (prevents collisions with any existing names).\u00a0<\/li>\nprotocol<\/code> is the protocol over which the service is offered (example: TCP, UDP). It is preceded by an underscore (prevents collisions with any existing names).\u00a0<\/li>\ndomain<\/code> is the DNS name<\/em> of the domain for which the service is offered.\u00a0<\/li>\nhost<\/code> is the machine that will provide this service.\u00a0<\/li>\nSRV<\/code> is the text SRV. Indicates that this is an SRV record.\u00a0<\/li>\npriority<\/code> is the priority of the host. Similar to SMTP MX record priorities. Host with lower number<\/em> has higher preference (similar to SMTP records).\u00a0<\/li>\nweight<\/code>\u00a0allows for load balancing between hosts of the same priority. Host with higher number<\/em> has higher preference (intuitive: higher weight wins).<\/li>\n<\/ul>\nSimilar to MX records, the host of an SRV<\/code> record must be a name with an A<\/code> or AAAA<\/code> record. It cannot<\/a> point to a CNAME<\/code> record.\u00a0<\/p>\nA\u00a0machine starting up in a domain can easily query for DCs of that domain via DNS. DCs provide the LDAP service, so a query for _ldap._tcp.dnsdomain<\/code> will return a list of DCs the machine can use.\u00a0<\/p>\nOn DCs, the netlogon<\/code> service registers many records relevant to the services offered by the DC. The A records of the DC are registered by the DNS client service (for Server 2008 and above) but the other records are taken care of by the netlogon<\/code> service. A copy of the registered records is also stored in the\u00a0%systemroot%\\system32\\config\\netlogon.dns<\/code> file in case it needs to be imported manually or compared for troubleshooting. Note that each DC only adds the records for itself. That is, WIN-DC01 for instance, will add a record like this:<\/p>\n_ldap._tcp.rakhesh.local. 600 IN SRV 0 100 389 WIN-DC01.rakhesh.local.<\/pre>\nIt will not add records for WIN-DC02 and others as it does not know of them. The records added by each DC will be combined together in the DNS database as it replicates and gets records from all the DCs, so when a client queries for the above record, for instance, it will get records added by all DCs.\u00a0<\/p>\n
C:\\>nslookup.exe -type=SRV _ldap._tcp.rakhesh.local.\r\nServer: win-dc01.rakhesh.local\r\nAddress: 10.50.0.20\r\n\r\n_ldap._tcp.rakhesh.local SRV service location:\r\n priority = 0\r\n weight = 100\r\n port = 389\r\n svr hostname = win-dc03.rakhesh.local\r\n_ldap._tcp.rakhesh.local SRV service location:\r\n priority = 0\r\n weight = 100\r\n port = 389\r\n svr hostname = win-dc02.rakhesh.local\r\n_ldap._tcp.rakhesh.local SRV service location:\r\n priority = 0\r\n weight = 100\r\n port = 389\r\n svr hostname = win-dc01.rakhesh.local\r\nwin-dc03.rakhesh.local internet address = 10.50.0.22\r\nwin-dc03.rakhesh.local AAAA IPv6 address = fdcc:7c4e:3651:1::22\r\nwin-dc02.rakhesh.local internet address = 10.50.1.21\r\nwin-dc01.rakhesh.local internet address = 10.50.0.20\r\nwin-dc01.rakhesh.local AAAA IPv6 address = fdcc:7c4e:3651:1::20<\/pre>\nAD creates a sub-domain called _msdcs.domainname<\/code> to hold items pertaining to AD for that domain. (MSDCS = Microsoft Domain Controller Services) This sub-domain is created for each domain (including child-domains) of the forest. The _msdcs<\/code> sub-domain belonging to the forest root domain is special in that it is a separate zone that is replicated to all DNS servers\u00a0in the forest. The other _msdcs<\/code> sub-domains are part of the parent zone\u00a0itself. For instance below are the _msdcs<\/code> sub-domains for a\u00a0forest root domain (rakhesh.local) and the _msdcs<\/code> sub-domain for a child domain (anoushka.rakhesh.local).\u00a0Notice how the former is a separate zone with a delegation to it, while the latter is a part of the parent zone.\u00a0<\/p>\n![\"For](\"https:\/\/i0.wp.com\/rakhesh.com\/wp-content\/uploads\/2015\/01\/msdcs-separate.png?resize=182%2C276&ssl=1\")
<\/a>For forest-root domain<\/figcaption><\/figure> ![\"For](\"https:\/\/i0.wp.com\/rakhesh.com\/wp-content\/uploads\/2015\/01\/msdcs-part.png?resize=209%2C130&ssl=1\")
<\/a>For child-domain<\/figcaption><\/figure><\/p>\nUnder the _msdcs<\/code> sub-domain a convention such as the following is used:<\/p>\n_service._protocol.DcType._msdcs.domain TTL class SRV priority weight port host<\/pre>\nHere DcType<\/code> is one of dc<\/code> (domain controller), gc<\/code> (global catalog), pdc<\/code> (primary domain controller), or domains<\/code> (GUIDs of the domains).<\/p>\nThe various SRV records registered by netlogon<\/code> can be found at this link<\/a>. Note<\/strong> that SRV records are created under both the domain\/ child-domain and the forest root domain (the table in the link marks these accordingly). Below are some of the entries added by netlogon<\/code> for\u00a0DCs – WIN-DC04 and WIN-DC05 – in a site called KOTTAYAM for my\u00a0domain anoushka.rakhesh.local. Of these WIN-DC05 is also a GC.\u00a0<\/p>\nAdvertise that the DCs offer the LDAP service over TCP protocol for the anoushka.rakhesh.local domain:<\/p>\n
_ldap._tcp.anoushka.rakhesh.local. 600 IN SRV 0 100 389 WIN-DC04.anoushka.rakhesh.local.\r\n_ldap._tcp.anoushka.rakhesh.local. 600 IN SRV 0 100 389 WIN-DC05.anoushka.rakhesh.local.<\/pre>\nAdvertise that the DCs offer the LDAP service over TCP protocol for the anoushka.rakhesh.local domain for both sites<\/span> of the forest (even though the DCs themselves are only in a single site – this way clients in any site can get these DC names when querying DNS SRV records):<\/p>\n_ldap._tcp.COCHIN._sites.anoushka.rakhesh.local. 600 IN SRV 0 100 389 WIN-DC04.anoushka.rakhesh.local.\r\n_ldap._tcp.KOTTAYAM._sites.anoushka.rakhesh.local. 600 IN SRV 0 100 389 WIN-DC04.anoushka.rakhesh.local.\r\n\r\n_ldap._tcp.COCHIN._sites.anoushka.rakhesh.local. 600 IN SRV 0 100 389 WIN-DC05.anoushka.rakhesh.local.\r\n_ldap._tcp.KOTTAYAM._sites.anoushka.rakhesh.local. 600 IN SRV 0 100 389 WIN-DC05.anoushka.rakhesh.local.<\/pre>\nWIN-DC05 has a few additional records compared to WIN-DC04 because it is a GC.\u00a0<\/p>\n
_ldap._tcp.gc._msdcs.rakhesh.local. 600 IN SRV 0 100 3268 WIN-DC05.anoushka.rakhesh.local.\r\n_gc._tcp.rakhesh.local. 600 IN SRV 0 100 3268 WIN-DC05.anoushka.rakhesh.local.\r\n_gc._tcp.KOTTAYAM._sites.rakhesh.local. 600 IN SRV 0 100 3268 WIN-DC05.anoushka.rakhesh.local.\r\n_ldap._tcp.KOTTAYAM._sites.gc._msdcs.rakhesh.local. 600 IN SRV 0 100 3268 WIN-DC05.anoushka.rakhesh.local.\r\ngc._msdcs.rakhesh.local. 600 IN A 10.50.2.21<\/pre>\nNotice all of them are specific to its site<\/em> and are created in the forest root domain\u00a0zone\/ _msdcs<\/code> sub-domain of the forest root domain. This is because GCs are used forest-wide also. In contrast,\u00a0similar records\u00a0advertising the DC service are created for both<\/em> sites and in the _msdcs<\/code> sub-domain of the child zone:<\/p>\n_ldap._tcp.dc._msdcs.anoushka.rakhesh.local. 600 IN SRV 0 100 389 WIN-DC05.anoushka.rakhesh.local.\r\n_ldap._tcp.COCHIN._sites.dc._msdcs.anoushka.rakhesh.local. 600 IN SRV 0 100 389 WIN-DC05.anoushka.rakhesh.local.\r\n_ldap._tcp.KOTTAYAM._sites.dc._msdcs.anoushka.rakhesh.local. 600 IN SRV 0 100 389 WIN-DC05.anoushka.rakhesh.local.\r\n\r\n_ldap._tcp.dc._msdcs.anoushka.rakhesh.local. 600 IN SRV 0 100 389 WIN-DC04.anoushka.rakhesh.local.\r\n_ldap._tcp.COCHIN._sites.dc._msdcs.anoushka.rakhesh.local. 600 IN SRV 0 100 389 WIN-DC04.anoushka.rakhesh.local.\r\n_ldap._tcp.KOTTAYAM._sites.dc._msdcs.anoushka.rakhesh.local. 600 IN SRV 0 100 389 WIN-DC04.anoushka.rakhesh.local.<\/pre>\nTo re-register SRV records, either restart the netlogon<\/code> service of a DC or use nltest<\/code> as below:<\/p>\nnltest \/dsregdns<\/pre>\n <\/p>\n","protected":false},"excerpt":{"rendered":"
Example of an SRV record: _ldap._tcp.anoushka.rakhesh.local. 600 IN SRV 0 100 389 WIN-DC05.anoushka.rakhesh.local. Format is: _service._protocol.domain TTL class SRV priority weight port host Where: class is always IN TTL is in seconds\u00a0 service is the name of the service (example: LDAP, GC, DC, Kerberos). It is preceded by an underscore (prevents collisions with any existing … Continue reading SRV records and AD<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[333,85],"tags":[4,47,346,457,435],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/2118"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=2118"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/2118\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=2118"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=2118"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=2118"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}