Providing SRV and TXT records for Kerberos and LDAP with dnsmasq Posted on 2014-03-26 by Luc de Louw What if you have an application such as OVirt/RHEV-M that relies on DNS services records and you dont have the possibility to add them to the DNS servers because the DNS admins do not like to do its job?

I've inherited 'ownership' of a network which has a Windows 2003 Server running as a Domain Controller and file server (no IIS or DNS running). We also use an Ubuntu server running dnsmasq as an internal Name Server.

This setup doesn't seem to have been a problem until now - we are installing a new Windows 2008 server (new hardware and everything), and want to migrate services and data from the old server gradually. To start this process, we are trying to add the new server as a secondary controller on our domain. The server is connecting to the domain easily enough, but when we try and specify the forest for the new controller we end up with this error: The following error occurred when DNS was queried for the service location (SRV) resource record used to locate an Active Directory Domain Controller (AD DC) for domain 'DOMAIN.address.com': The error was: 'DNS name does not exist.' (error code 0x0000232B RCODE_NAME_ERROR) The query was for the SRV record for _ldap._tcp.dc._msdcs.DOMAIN.address.com Common causes of this error include the following: • The DNS SRV records required to locate a AD DC for the domain are not registered in DNS. These records are registered with a DNS server automatically when a AD DC is added to a domain. They are updated by the AD DC at set intervals. This computer is configured to use DNS servers with the following IP addresses: xxx.xxx.xxx.xxx One or more of the following zones do not include delegation to its child zone: • DOMAIN.address.com • address.com • com •.

(the root zone) I'm now thinking that the solution is to make the 2008 Server use the 2003 Server DNS instead of our Ubuntu? Is this the right solution? Are there other options? What might I and my team have missed? I wouldn't put too much effort into having it 'play nicely', I'd rather go for AD-integrated DNS instead of dnsmasq. • Install on the Windows 2003 DC • Create a primary forward-lookup zone called DOMAIN.address.com • Transfer the records from your Ubuntu server to the new DNS Server on the DC • • Restart the netlogon service on the 2003 DC (this way, all SRV records in the _msdcs subzone will re-register) • Ensure that the SRV records are in place (eg. Ping _ldap._tcp.dc._msdcs.DOMAIN.addresse.com ) • Use the 2003 DC as DNS server in the future • Use the Ubuntu Server for something else.;-) Now, the new 2008 DC will be able to locate the DC during dcpromo, and everything should work as expected:-).

You would indeed need want an AD-integrated MS DNS server - doing it differently would require. But you could choose to keep your existing name server infrastructure in place and just add MS DNS servers on top of that. You easily can get different name servers to 'play nicely' together by making sure that the name spaces they are authoritative for do not overlap.

If your 'internal name server' has authority for the address.com zone, it is quite fine to have an AD DNS server with an DOMAIN.address.com zone. To make sure your dnsmasq server is able to answer requests for DOMAIN.address.com you simply might add forwarder definitions for the DOMAIN.address.com zone to your dnsmasq configuration like this in dnsmasq.conf: server=/DOMAIN.address.com/192.168.0.1 or alternatively using the -S /DOMAIN.address.com/192.168.0.1 command line option to dnsmasq where 192.168.0.1 should be replaced by the IP address of one of your AD DNS servers. If the name spaces do overlap, you are out of luck - as this is outside of the specification of the DNS so any kind of interoperability between primary zone-holding name servers (i.e.