Let's have a brief overview of considerations for implementing complex ideas environments.
And this lesson will talk about DNS considerations which include the following points.
Decide on a centralized or decentralized model.
You should also consider verifying DNS clan configuration and verify and monitor DNS name resolution
after this point so you have to optimize DNS name resolution between multiple name spaces by using DNS
features such as conditional forwarding and stop zones.
You should also consider DNS name devolution and DNS suffix search order.
Another consideration is deploying a global name zone and use an Active Directory integrated DNS zones.
We'll also talk about considerations when you extend your 80 days domain into Asia and finally we'll
talk about European considerations which include European suffixes and global catalog and Federated
authentication scenarios.
Let's start.
So in a single forest single domain a tedious environment when you install a yes and DNS with default
settings the configuration works appropriately.
In most scenarios however as your organization grows and your HDD environment becomes more complex you
might have to make several choices to facilitate efficient name resolution and user sign ins within
the 80 days and wired moment.
So let's talk about DNS considerations in a multi domain or multi forest environment.
Client computers might have to locate a variety of cross forest services including key management services
servers for Windows activation terminals Services License servers license and servers for specific applications
and domain controllers in any domain to.
Well it trusts when accessing resources in another domain.
When organizations deploy multiple trees in a net aided as forest or when they deploy multiple forests
name resolution is more complicated because you must manage multiple domain name spaces in these scenarios.
Consider the following points.
First consider deciding on a centralized or decentralized model in a centralized model.
You can figure all DNS zones for forest wide replication making them locally a way a label on every
domain controller in the forest.
Although this is easy to accomplish and to ensure growth domain name resolution you must consider the
impact this might have on domain controller replication throughout your HDD environment in a decentralized
model.
Zones are configured for domain wide replication making them available on every domain controller in
the domain to implement cross domain name resolution.
You create the allegations in the parent domain and Forwarders in the child domains a decentralized
model is more difficult to maintain.
But it allows you more control over replication and flexibility in administering child demands.
Another point to consider is verifying DNS clan configuration.
You have to configure all computers in the 80 days domain with at least two addresses or of functional
DNS servers all of your computer a small.
My must have good network connectivity with DNS servers.
The next point to consider is verifying and monitoring DNS name resolution.
You have to verify that all of your computers include them including domain controllers are rebuilt
to perform successful DNS look ups for role domain controllers in the forest.
Domain controllers must be able to connect to other domain controllers to successfully replicate changes
to a tedious client computer computers must be able to locate domain controllers by using service resource
records or reel records and count computers must be able to resolve the Domain Controller names to IP
addresses.
Now some words about optimizing DNS name resolution between multiple namespace first use DNS features
such as conditional forwarding and stop zones to optimize the process of resolving computer names across
namespace.
By using a conditional form or or stop zone you effectively create a shortcut that prevents the need
for recursive queries to the demand through or forest route.
Although a conditional 4 order or stop zone is not required for name resolution to work correctly it
might greatly reduce latency when cross domain or cross forest name resolution a cure is frequently
when you configure a trust between two forests.
You typically use a conditional forward or in each forest to to facilitate name resolution on both sides
of the trust.
Another consideration is DNS name devolution and DNS suffix search order DNS name devolution is a feature
of the windows DNS client that allows the client in a child's namespace to resolve the IP address of
a host in a parent namespace without specifying a fully qualified domain name.
The devolution process automatically attempts to resolve a single label name by abandon the primary
DNS suffix.
If a result is not found devolution recursively bans the parent DNS suffix until the name result resolves
or the devolution level is met.
The devolution level is determined automatically by comparing the forest through domain to the primary
DNS suffix but it also can be manually configured when Bruce.
Control is necessary income blacks say it is in white moments where you might have a deep domain 3 with
many levels in the namespace relying on DNS name devolution for name resolution might not be efficient.
In this case as you can configure the DNS suffix search order to manually specify the DNS suffixes to
a band and the order in which to append them when the DNS suffix search order is specified manually
or through group policy that DNS named devolution process automatically disables the next consideration
when you deploy multiple trees in a tedious forest or when you deploy multiple forests is deploying
a global names names.
Zone A Global names zone allows you to configure single name resolution for DNS names in your forest.
This allows name resolution by using a shorter name that is easier to remember than a fully qualified
domain name.
Previously Windows Internet names service or Windows was configured in a domain to support single label
name resolution.
You can use a global names zone to replace winds in your environment especially if you deploy Internet
Protocol version 6 because winds does not support IP vs 6 address.
In addition you can use global names zone when relying on DNS suffix storage lists is not efficient
because of the number of domains that must be searched.
Another consideration is use an active directory integrated DNS zones when you configure DNS zone as
Active Directory integrated DNS information is stored in a tedious and replicates through the normal
HDD replication process.
This optimizes the process of replicating changes throughout the forest.
You can also configure the scope of replication for DNS zones by default domain specific DNS records
or replicate to other domain controllers that are also DNS source in the domain.
DNS records that enable cross domain lock ups are stored in the underscore emails DCF DOD forest route
and your domain name zoom and they replicate demand controllers there are also DNS servers in the entire
forest.
You should not change this default configuration.
Now some words about extend on your 80 days domain into Asia when doing so you must take a few extra
steps.
Asia was built in DNS does not support today's demands to support cloud based demand components you
must do the following.
You must configure an Asia virtual network and aided in a site for your Asia or subnet and register
your on premises DNS with the Asia virtual network.
You must do this to allow an easier virtual machine to communicate with your on premises aided Yes and
after you successfully promote a Nasir virtual machine to an aide it is the main control around DNS
server.
Register that virtual machines IP address the DNS server for your Asia virtual network.
This allows locally tedious communication and name resolution for all the virtual machines in Eurasia
subnet.
And lastly some votes about European considerations in a multi domain or multi forest environment sign
and n becomes more complicated because users must be aware of the domain that contains their user recalled
users are able to sign in by using the Net biased name of the domain and their same account name or
the friendlier European attribute which is formatted like an email address.
By default you ban is user followed by at sign and your DNS Domain Name a European is generally easier
to remember and is met in many organizations.
It might match the user's primary email address.
If you decide to use the European attribute for signing name you must consider several things you must
consider European suffixes.
By default the European suffix matches the DNS F Q GM of the domain where the user account exists in
complex a tedious environments where multiple domains are in a domain 3 the European suffix might become
quite long and difficult to remember.
For example in an edit s environment that is organized by region and department.
A simple default European might look like user at a sha dot North America dot com toss dot com.
In this situation you might decide to utilize a common European suffix for role users in the domain.
The European suffix does not have to be a well it DNS domain but in many cases organizations choose
to use their email domain name to simplify the sign and process for users.
The active director of domains and trusts console allows you to specify alternative European suffixes
for a domain you specify the European suffix for a user account during an account creation and you can
modify it at any time afterward.
Another thing to consider about European is global catalog to allow signing in with a European availability
of a global catalogue server must be necessary.
If an alternate European suffix is used in the computer account is not in the same domain as the user
account.
A global catalogue server is required to resolve the APM that is specified during signing and the last
consideration about European is Federated authentication scenarios.
If your organization uses a DFS to perform Federated authentication with a cloud based service such
as office 365 the European suffix must be well it external DNS domain that your organization owns.
This is necessary because a federation trust can not be created with a DNS domain that only exists within
your internal HDD infrastructure.