NoteDynamic update enables DNS client computers to register and dynamically update their resource records with a DNS server whenever changes occur. This reduces the need for manual administration of zone records, especially for clients that frequently move or change locations and use DHCP to obtain an IP address.
Windows 2000 provides client and server support for the use of dynamic updates, as described in RFC 2136. For DNS servers, the DNS service allows dynamic update to be enabled or disabled on a per-zone basis at each server configured to load either a standard primary or directory-integrated zone. By default, client computers running under any version of Windows 2000 dynamically update their host (A) resource records (RRs) in DNS when configured for TCP/IP.
By default, computers that run Windows 2000 and are statically configured for TCP/IP attempt to dynamically register host (A) and pointer (PTR) resource records (RRs) for IP addresses configured and used by their installed network connections. By default, all computers register records based on their Full computer name.
For Windows 2000 computers, the primary full computer name, a fully qualified domain name (FQDN), is based on the following system settings:
The Primary DNS suffix of this computer appended to the Computer name.
Both of these settings are displayed or configured from the Network Identification tab in System properties. For more information, see To view your computer's network identification or To configure the primary DNS suffix for a client computer
Dynamic updates can be sent for any of the following reasons or events:
When one of the previous events triggers a dynamic update, the DHCP Client service (not the DNS Client service) sends updates. This is designed so that if a change to the IP address information occurs because of DHCP, corresponding updates in DNS are performed to synchronize name-to-address mappings for the computer. The DHCP Client service performs this function for all network connections used on the system, including connections not configured to use DHCP.
Note
In addition to the full computer name (or primary name) of the computer, additional connection-specific DNS names can be configured and optionally registered or updated in DNS. For more information, see Configuring multiple names or To configure TCP/IP to use DNS
For Windows 2000, dynamic updates are typically requested when either a DNS name or IP address changes on the computer. For example, suppose a client named "oldhost" is first configured in System properties with the following names:
| Computer name | oldhost |
| DNS domain name of computer | example.microsoft.com |
| Full computer name | oldhost.example.microsoft.com |
In this example, no connection-specific DNS domain names are configured for the computer. Later, the computer is renamed from "oldhost" to "newhost", resulting in the following name changes on the system:
| Computer name | newhost |
| DNS domain name of computer | example.microsoft.com |
| Full computer name | newhost.example.microsoft.com |
Once the name change is applied in System properties, Windows 2000 prompts you to restart the computer. When the computer restarts Windows, the DHCP Client service performs the following sequence to update DNS:
The client computer uses the currently configured FQDN of the computer (such as "newhost.example.microsoft.com") as the name specified in this query.
For standard primary zones, the primary server (owner) returned in the SOA query response is fixed and static. It always matches the exact DNS name as it appears in the SOA RR stored with the zone. If, however, the zone being updated is directory-integrated, any DNS server loading the zone can respond and dynamically insert its own name as the primary server (owner) of the zone in the SOA query response.
The client processes the SOA query response for its name to determine the IP address of the DNS server authorized as the primary server for accepting its name. It then proceeds to perform the following sequence of steps as needed to contact and dynamically update its primary server:
If the update succeeds, no further action is taken.
If the update succeeds, no further action is taken.
The contents of the update request include instructions to add A (and possibly PTR) RRs for "newhost.example.microsoft.com" and remove these same record types for "oldhost.example.microsoft.com", the name that was previously registered.
The server also checks to ensure that updates are permitted for the client request. For standard primary zones, dynamic updates are not secured, so any client attempt to update succeeds. For Active Directory-integrated zones, updates are secured and performed using directory-based security settings. For more information, see Secure dynamic updates
Dynamic updates are sent or refreshed periodically. By default, Windows 2000 sends a refresh once every 24 hours. If the update results in no changes to zone data, the zone remains at its current version and no changes are written. Updates result in actual zone changes or increased zone transfer only if names or addresses actually change.
Note that names are not removed from DNS zones if they become inactive or are not updated within the refresh interval (24 hours). DNS does not use a mechanism to release or tombstone names, although DNS clients do attempt to delete or update old name records when a new name or address change is applied.
When the DHCP Client service registers A and PTR resource records for a Windows 2000 computer, it uses a default caching Time-To-Live (TTL) of 15 minutes for host records. This determines how long other DNS servers and clients cache a computer's records when they are included in a query response.
For Windows 2000, DNS update security is available only for zones that are integrated into Active Directory. Once you directory-integrate a zone, access control list (ACL) editing features are available in the DNS console so you can add or remove users or groups from the ACL for a specified zone or resource record. For more information, see To modify security for a resource record or To modify security for a directory integrated zone
By default, dynamic update security for Windows 2000 DNS servers and clients can be handled as follows:
Also, clients use a default update policy that permits them to attempt to overwrite a previously registered resource record, unless they are specifically blocked by update security.
When using standard zone storage, the default for the DNS Server service is to not allow dynamic updates on its zones. For zones that are either directory-integrated or use standard file-based storage, you can change the zone to allow all dynamic updates which permits all updates to be accepted, by passing the use of secure updates.
Important
If you use multiple Windows 2000 DHCP servers on your network and also configure your zones to allow secure dynamic updates only, you need to use Active Directory Users and Computers to add your DHCP server computers to the built-in DnsUpdateProxyGroup. This will permit all of your DHCP servers the secure rights to perform proxy updates for any of your DHCP clients.
For information, see Using DNS servers with DHCP or Manage groups
Caution
Note