Microsoft KB Archive/164017

= Explanation of a DNS Zone Transfer =

Article ID: 164017

Article Last Modified on 11/1/2006

-

APPLIES TO


 * Microsoft Windows NT Server 4.0 Standard Edition

-



This article was previously published under Q164017



SUMMARY
This article discusses the circumstances that can trigger a Domain Name System (DNS) Zone Transfer, the purpose of zone transfers, and how the process works.



MORE INFORMATION
Definition of a Zone Transfer: A Zone Transfer is the term used to refer to the process by which the contents of a DNS Zone file are copied from a primary DNS server to a secondary DNS server.

A Zone transfer will occur during any of the following scenarios:
 * When starting the DNS Service on the secondary DNS server.
 * When the refresh time expires.
 * When changes are saved to the Primary Zone file and there is a Notify List.

Zone Transfers are always initiated by the secondary DNS server. The primary DNS server simply answers the request for a Zone Transfer.

The following Network Monitor Capture sequence shows the process when either the DNS Service is started on the secondary DNS server or the refresh time expires:

Frame 1: The secondary DNS server - JH40PS - requests the SOA record from the primary DNS server - SERVER - for Zone DOMAIN.COM. Note DNS Question Type.

JH40PS SERVER DNS 0x4000:Std Qry for domain.com. of type SOA on class INET addr.

DNS: 0x4000:Std Qry for domain.com. of type SOA on class INET addr.

   DNS: Query Identifier = 16384 (0x4000) DNS: DNS Flags = Query, OpCode - Std Qry, RCode - No error DNS: 0............... = Query DNS: .0000........... = Standard Query DNS: .....0.......... = Server not authority for domain DNS: ......0......... = Message complete DNS: .......0........ = Iterative query desired DNS: ........0....... = No recursive queries DNS: .........000.... = Reserved DNS: ............0000 = No error DNS: Question Entry Count = 1 (0x1) DNS: Answer Entry Count = 0 (0x0) DNS: Name Server Count = 0 (0x0) DNS: Additional Records Count = 0 (0x0) DNS: Question Section: domain.com. of type SOA on class INET addr. DNS: Question Name: domain.com. DNS: Question Type = Start of zone of authority DNS: Question Class = Internet address class

Frame 2: The primary DNS server responds with the contents of the SOA record in the Answer Section.

SERVER JH40PS DNS 0x4000:Std Qry Resp. for domain.com. of type SOA on class INET addr.

DNS: 0x4000:Std Qry Resp. for domain.com. of type SOA on class INET addr.

   DNS: Query Identifier = 16384 (0x4000) DNS: DNS Flags = Response, OpCode - Std Qry, AA RA Bits Set, RCode - No        error DNS: 1............... = Response DNS: .0000........... = Standard Query DNS: .....1.......... = Server authority for domain DNS: ......0......... = Message complete DNS: .......0........ = Iterative query desired DNS: ........1....... = Recursive queries supported by server DNS: .........000.... = Reserved DNS: ............0000 = No error DNS: Question Entry Count = 1 (0x1) DNS: Answer Entry Count = 1 (0x1) DNS: Name Server Count = 0 (0x0) DNS: Additional Records Count = 0 (0x0) DNS: Question Section: domain.com. of type SOA on class INET addr. DNS: Question Name: domain.com. DNS: Question Type = Start of zone of authority DNS: Question Class = Internet address class DNS: Answer section: domain.com. of type SOA on class INET addr. DNS: Resource Name: domain.com. DNS: Resource Type = Start of zone of authority DNS: Resource Class = Internet address class DNS: Time To Live = 86400 (0x15180) DNS: Resource Data Length = 41 (0x29) DNS: Primary Name Server: server.domain.com. DNS: Responsible Authorative Mailbox: administrator.domain.com. DNS: Version number = 26 (0x1A) DNS: Refresh Interval = 300 (0x12C) DNS: Retry interval = 120 (0x78) DNS: Expiration Limit = 600 (0x258) DNS: Minimum TTL = 86400 (0x15180)

Frame 3: Having compared the version number (serial number) and found it to be different than its current version number, the secondary DNS server now requests a Zone Transfer. Note the Question Type in the DNS Question Section.

JH40PS SERVER DNS 0x0:Std Qry for domain.com. of type Req. for zn Xfer on class INET addr.

DNS: 0x0:Std Qry for domain.com. of type Req. for zn Xfer on class INET addr.

   DNS: TCP Length = 31 (0x1F) DNS: Query Identifier = 0 (0x0) DNS: DNS Flags = Query, OpCode - Std Qry, RCode - No error DNS: 0............... = Query DNS: .0000........... = Standard Query DNS: .....0.......... = Server not authority for domain DNS: ......0......... = Message complete DNS: .......0........ = Iterative query desired DNS: ........0....... = No recursive queries DNS: .........000.... = Reserved DNS: ............0000 = No error DNS: Question Entry Count = 1 (0x1) DNS: Answer Entry Count = 0 (0x0) DNS: Name Server Count = 0 (0x0) DNS: Additional Records Count = 0 (0x0) DNS: Question Section: domain.com. of type Req. for zn Xfer on class INET addr. DNS: Question Name: domain.com. DNS: Question Type = Request for zone transfer DNS: Question Class = Internet address class DNS: Frame Padding

Frame 4: The primary DNS server complies with the request for a Zone Transfer. The entire contents of the Zone file are transferred in the DNS Answer section.

SERVER JH40PS DNS 0x0:Std Qry Resp. for domain.com. of type SOA on class INET addr.

DNS: 0x0:Std Qry Resp. for domain.com. of type SOA on class INET addr.

   DNS: TCP Length = 445 (0x1BD) DNS: Query Identifier = 0 (0x0) DNS: DNS Flags = Response, OpCode - Std Qry, RA Bits Set, RCode - No        error DNS: 1............... = Response DNS: .0000........... = Standard Query DNS: .....0.......... = Server not authority for domain DNS: ......0......... = Message complete DNS: .......0........ = Iterative query desired DNS: ........1....... = Recursive queries supported by server DNS: .........000.... = Reserved DNS: ............0000 = No error DNS: Question Entry Count = 1 (0x1) DNS: Answer Entry Count = 16 (0x10) DNS: Name Server Count = 0 (0x0) DNS: Additional Records Count = 0 (0x0) DNS: Question Section: domain.com. of type Req. for zn Xfer on class INET addr. DNS: Question Name: domain.com. DNS: Question Type = Request for zone transfer DNS: Question Class = Internet address class DNS: Answer section:. of type SOA on class INET addr.(16 records        present) DNS: Resource Record: domain.com. of type SOA on class INET addr. DNS: Resource Name: domain.com. DNS: Resource Type = Start of zone of authority DNS: Resource Class = Internet address class DNS: Time To Live = 86400 (0x15180) DNS: Resource Data Length = 41 (0x29) DNS: Primary Name Server: server.domain.com. DNS: Responsible Authorative Mailbox: administrator.domain.com. DNS: Version number = 26 (0x1A) DNS: Refresh Interval = 300 (0x12C) DNS: Retry interval = 120 (0x78) DNS: Expiration Limit = 600 (0x258) DNS: Minimum TTL = 86400 (0x15180) DNS: Resource Record: domain.com. of type Host Addr on class INET addr. DNS: Resource Name: domain.com. DNS: Resource Type = Host Address DNS: Resource Class = Internet address class DNS: Time To Live = 86400 (0x15180) DNS: Resource Data Length = 4 (0x4) DNS: IP address = 130.0.10.150 DNS: Resource Record: domain.com. of type Auth. NS on class INET addr. DNS: Resource Name: domain.com. DNS: Resource Type = Authoritative Name Server DNS: Resource Class = Internet address class DNS: Time To Live = 86400 (0x15180) DNS: Resource Data Length = 10 (0xA) DNS: Authoritative Name Server: server.domain.com. DNS: Resource Record: Dell.domain.com. of type Host Addr on class INET addr. DNS: Resource Name: Dell.domain.com. DNS: Resource Type = Host Address DNS: Resource Class = Internet address class DNS: Time To Live = 86400 (0x15180) DNS: Resource Data Length = 4 (0x4) DNS: IP address = 130.0.10.30 DNS: Resource Record: JH40PS.domain.com. of type Host Addr on                class INET addr. DNS: Resource Name: JH40PS.domain.com. DNS: Resource Type = Host Address DNS: Resource Class = Internet address class DNS: Time To Live = 86400 (0x15180) DNS: Resource Data Length = 4 (0x4) DNS: IP address = 130.0.10.155

If changes are made to the Zone file and there are entries in the Notify List, the following sequence will occur before the regular Zone Transfer sequence as outlined above.

Frame A: In this frame, a change has been made to the Zone file. Because JH40PS is on the Notify List, the primary DNS server sends this frame to notify the secondary DNS server that a change has occurred and that the secondary DNS server should query the SOA resource record.

SERVER JH40PS DNS 0x0:Std Qry for domain.com. of type SOA on class INET addr.

DNS: 0x0:Std Qry for domain.com. of type SOA on class INET addr.

   DNS: Query Identifier = 0 (0x0) DNS: DNS Flags = Query, OpCode - Rsrvd, AA Bits Set, RCode - No error DNS: 0............... = Query DNS: .0100........... = Reserved DNS: .....1.......... = Server authority for domain DNS: ......0......... = Message complete DNS: .......0........ = Iterative query desired DNS: ........0....... = No recursive queries DNS: .........000.... = Reserved DNS: ............0000 = No error DNS: Question Entry Count = 1 (0x1) DNS: Answer Entry Count = 0 (0x0) DNS: Name Server Count = 0 (0x0) DNS: Additional Records Count = 0 (0x0) DNS: Question Section: domain.com. of type SOA on class INET addr. DNS: Question Name: domain.com. DNS: Question Type = Start of zone of authority DNS: Question Class = Internet address class

Frame B: The secondary DNS server acknowledges the receipt of Frame 1.

JH40PS SERVER DNS 0x0:Std Qry Resp.

DNS: 0x0:Std Qry Resp.

   DNS: Query Identifier = 0 (0x0) DNS: DNS Flags = Response, OpCode - Rsrvd, AA Bits Set, RCode - No        error DNS: 1............... = Response DNS: .0100........... = Reserved DNS: .....1.......... = Server authority for domain DNS: ......0......... = Message complete DNS: .......0........ = Iterative query desired DNS: ........0....... = No recursive queries DNS: .........000.... = Reserved DNS: ............0000 = No error DNS: Question Entry Count = 1 (0x1) DNS: Answer Entry Count = 0 (0x0) DNS: Name Server Count = 0 (0x0) DNS: Additional Records Count = 0 (0x0) DNS: Question Section: domain.com. of type SOA on class INET addr. DNS: Question Name: domain.com. DNS: Question Type = Start of zone of authority DNS: Question Class = Internet address class

Immediately following this response, the Zone Transfer process begins as in Frame 1 in the first capture sequence above.

Keywords: kbinfo kbnetwork KB164017

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.