Two important DNS records for Microsoft Active Directory Serivice

 Windows AD DC server provides both Kerberos and LDAP. What's more, both of them are supposed to be found by clients by DNS SRV type records.

SRV record format:

_service._proto.name. TTL IN SRV priority weight port target.

Example:

• Domain Name: smallstrong.org
• DC servers: 
• dc1.smallstrong.org
• dc2.smallstrong.org

DNS for LDAP

_ldap._tcp.dc._msdcs.smallstrong.org. 600 IN SRV 0 100 389 dc2.smallstrong.org.
_ldap._tcp.dc._msdcs.smallstrong.org. 600 IN SRV 0 100 389 dc1.smallstrong.org.

DNS for Kerberos

_kerberos._tcp.dc._msdcs.smallstrong.org. 600 IN SRV 0 100 88 dc1.smallstrong.org.

_kerberos._tcp.dc._msdcs.smallstrong.org. 600 IN SRV 0 100 88 dc2.smallstrong.org.

If the DNS service and DC are running on the same server (the most common case), DC part automatically updates these DNS records without any interference. 

But if the DNS server is running on like a Linux server, then these two SRC records may have to be added and updated manually. Here is an example of config for dnsmasq running on Linux.

# cat /etc/dnsmasq.conf

srv-host=_ldap._tcp.dc._msdcs.smallstrong.org,dc1.smallstrong.org,389,0,100

srv-host=_ldap._tcp.dc._msdcs.smallstrong.org,dc2.smallstrong.org,389,0,100

srv-host=_kerberos._tcp.dc._msdcs.smallstrong.org,dc1.smallstrong.org,88,0,100

srv-host=_kerberos._tcp.dc._msdcs.smallstrong.org,dc2.smallstrong.org,88,0,100

Usecase:

• Find the DC server(s) for a specific domain?

$ nslookup -type=srv _kerberos._tcp.dc._msdcs.smallstrong.org

OR

$ dig _kerberos._tcp.dc._msdcs.smallstrong.org srv