{"id":1714,"date":"2018-11-12T18:40:58","date_gmt":"2018-11-12T18:40:58","guid":{"rendered":"https:\/\/live-infoblox-blog.pantheonsite.io\/?p=1714"},"modified":"2022-10-20T15:13:27","modified_gmt":"2022-10-20T22:13:27","slug":"using-dns-traffic-control-for-microsoft-active-directory-domain","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/community\/using-dns-traffic-control-for-microsoft-active-directory-domain\/","title":{"rendered":"Using DNS Traffic Control for Microsoft Active Directory Domain Controller Selection"},"content":{"rendered":"

By Bob Rose, Ross Gibson & Paul Adair<\/em><\/p>\n

\"DNSHybrid Cloud Answers Needed<\/strong><\/span><\/p>\n

More and more companies are leveraging public cloud infrastructure in conjunction with their on-premise infrastructure, commonly referred to as a hybrid cloud deployment. Deploying applications in a hybrid cloud model can sometimes benefit from Domain Name System (DNS)<\/a> answers that are specific to a client based on its location. The Infoblox DNS Traffic Control (DTC) functionality can be leveraged to provide site-specific answers that may be required.<\/p>\n

This blog presents an interesting use case where a customer utilizes DNS resolution to provide traffic segregation of Microsoft Active Directory (AD) authentication for non-site-aware clients. DTC can be used as a solution by providing site specific Service Record (SRV) responses based on device location, whether on-premises or in the public cloud as described below.<\/p>\n

It All Begins with DNS<\/strong><\/p>\n

At the heart of this solution lies DNS. DNS serves as the \u201cphone book\u201d of the internet by associating \u201ceasy to recall\u201d hostnames with IP addresses required for communication by network equipment. DNS also stores and associates various information with domain names like email servers authorized to process email for a given domain. More importantly, DNS enables names to be assigned to organizations and referenced without regard to the physical routing hierarchy of numerical IP addresses. DNS distributes the assignment of domain names mapped to IP addresses with an authoritative server which tracks its own changes to avoid syncing updates with a central registrar.<\/p>\n

SRV<\/strong><\/p>\n

SRV also plays a key part in this solution. SRV is a data category within DNS that specifies information on available services (e.g., voice, video and messaging applications in IP networks). AD clients use SRV records to identify which domain controllers are available to provide authentication (e.g., record of _gc._tcp). SRV record support was added to DTC in NIOS 8.3. To use an SRV record in DTC, the DTC server object must be created and saved first, and then the SRV record can be added within the DTC object using the DTC web GUI.<\/p>\n

In DTC, the GUI displays the following format:<\/p>\n