Questions[srv-record](server)

I've been following a few guides/questions on how to use A records and SRV records to map a domain to a specific ip and port like 1.1.1.1:1889:

https://stackoverflow.com/questions/11433570/how-to-use-srv-or-any-other-record-do-redirect-a-domain

https://stackoverflow.com/questions/19015138/how-to-redirect-dns-to-different-ports

In questions like the ones above, they recommend using SRV records. The only part I'm not clear on is how to determine the correct service name to use in my SRV record? For example, let's say I have these records

mysql.example.com.  86400 IN A 1.1.1.1
mongo.example.com.  86400 IN A 1.1.1.1
www.example.com.  86400 IN A 1.1.1.1
mosquitto.example.com.  86400 IN A 1.1.1.1
_mysql._tcp.example.com. 86400 IN SRV 10 20 3306 mysql.example.com.
_mongo._tcp.example.com. 86400 IN SRV 10 20 27017 mongo.example.com.
_http._tcp.example.com. 86400 IN SRV 10 20 3306 www.example.com.
_mqtt._tcp.example.com. 86400 IN SRV 10 20 3306 mosquitto.example.com.

Are the _mysql, _mongo, _http and _mqtt the correct service names to use in my SRV records? I completely guessed these service names because I wasn't able to find a website that lists all the acceptable service names that can be used.

In DNS there was SRV record defined long ago, which allowed to direct some services for a domain to different machines. For example, this is how I publish a LDAP service for a domain example.com served on server1.example.net tcp port 389:

_ldap._tcp.example.com IN SRV 100 1 389 server1.example.net 

There may be more than one record of that kind and this way I can achieve some load balancing.

Support of corresponding DNS lookups is usual for some services, including LDAP, Kerberos, SIP, XMPP and some others. However, for email we use a "reduced form" of SRV record called MX record. It doesn't allow us to define weight and alter port (it always uses tcp 25). Some services don't use this type of lookup at all, for example, HTTP clients never issue corresponding DNS requests and always connect to the TCP port 80 (or 443 for HTTPS) of the corresponding host.

Recently a new draft appeared, which suggests the use of the special new type of DNS records, called SVCB record. It also defines a special type of SVCB record, a HTTPS record. In the draft authors confirm this is essentially a new type of SRV record.

So I'd like to understand why they invented a new type of a record with a whole new semantic, instead of pushing an adoption of well known and widely used SRV record? Why not use something like

_https._tcp.example.net IN SRV 100 1 443 server2.example.com

Disadvantages are similar: this needs change of a software. Old client software will neither do SRV nor SVCB/HTTPS DNS requests, so neither will work.

However, SVCB has a huge additional disadvantage: the record type is new and therefore it needs also DNS server updates and administrator training. By the way, a semantic of a record is not that simple.

As a professional administrator who has some dozen public DNS domains in charge, I am concerned with this.

What are significant advantages?

I recently did a "classis conversion" of our small NT4 Samba domain to an AD one on my Debian 10 "Buster" system. I got everything working as far as I can tell, but I don't understand one issue I came across: Kerberos does not work unless the resolv.conf points to 127.0.0.1 instead of the external DNS server.

Per the instructions here I set up SRV records for LDAP and Kerberos in my DNS. The tests for them show the correct response I believe:

root@sambabox:~# host -t SRV _kerberos._udp.mydomain.duckdns.org
_kerberos._udp.mydomain.duckdns.org has SRV record 0 0 88 sambabox.mydomain.duckdns.org.

root@sambabox:~# host -t SRV _kerberos._udp.mydomain.duckdns.org 192.168.1.1
Using domain server:
Name: 192.168.1.1
Address: 192.168.1.1#53
Aliases:

_kerberos._udp.mydomain.duckdns.org has SRV record 0 0 88 sambabox.mydomain.duckdns.org.
root@sambabox:~#

The hostname returned is the AD DC host. It can ping itself by name:

# ping sambabox.mydomain.duckdns.org
PING sambabox.mydomain.duckdns.org (192.168.1.5) 56(84) bytes of data.
64 bytes from sambabox.mydomain.duckdns.org (192.168.1.5): icmp_seq=1 ttl=64 time=0.060 ms
64 bytes from sambabox.mydomain.duckdns.org (192.168.1.5): icmp_seq=2 ttl=64 time=0.044 ms

However when the resolve.conf points to 192.168.1.1 (the default GW and DNS server/forwarder) rather than 127.0.0.1, "kinit" fails and the GW firewall logs dropped packets to port 88:

# kinit
[email protected]'s Password:
kinit: krb5_get_init_creds: unable to reach any KDC in realm MYDOMAIN.DUCKDNS.ORG

My Kerberos config is the default from the Samba conversion wizard:

# cat /etc/krb5.conf
[libdefaults]
        default_realm = MYDOMAIN.DUCKDNS.ORG
        dns_lookup_realm = false
        dns_lookup_kdc = true

Now I realize that Samba is also providing a domain DNS function here that resolves the Kerberos SRV as well:

# host -t SRV _kerberos._udp.mydomain.duckdns.org localhost
Using domain server:
Name: localhost
Address: 127.0.0.1#53
Aliases:

_kerberos._udp.mydomain.duckdns.org has SRV record 0 100 88 sambabox.mydomain.duckdns.org.

But since the network DNS SRV record points to this same AD DC host, and Samba is listening on both the local and external interface, should it not also work when not using the Samba internal DNS?

# netstat -etulpn  | grep :88
tcp        0      0 192.168.1.5:88         0.0.0.0:*               LISTEN      0          1557276    13233/samba: conn[k
tcp        0      0 127.0.0.1:88            0.0.0.0:*               LISTEN      0          1557272    13233/samba: conn[k
udp        0      0 192.168.1.5:88         0.0.0.0:*                           0          1557277    13233/samba: conn[k
udp        0      0 127.0.0.1:88            0.0.0.0:*                           0          1557273    13233/samba: conn[k

Why doesn't external DNS SRV seem to work? What makes the port 88 traffic be sent to the GW? Is the hostname that the kerberos SRV returned somehow being mangled?

Is there going to be issues with other hosts besides the AD DC trying to use Kerberos and not going through the Samba DNS?

ps: There was no Firewall active on the AD DC during these tests. No packets were harmed in this testing (except the ones sent to the GW port 88 incorrectly).

Yesterday I demoted a 2003R2 DC (but forgot to remove the DNS role), removed it from the domain, changed it's IP address and shut it down. Everything went pretty well (minus a host of authentication issues across the domain until I added the old IP for this DC to it's replacement 2008R2 DC) but I'm still seeing four SRV records in DNS for this DC. DNS is still showing _ldap SRV records for DC1, one each under:
DomainDNSZones->_sites->Default-First-Site-Name->_tcp
DomainDNSZones->_tcp
ForestDNSZones->_sites->Default-First-Site-Name->_tcp
ForestDNSZones->_tcp

DC1 is not listed under any other zone including _msdcs.

Can I simply delete these _ldap SRV records for the demoted DC?

I'm trying to consolidate domain names for the servers I look after to just use one panel instead of 3 or 4, and one thing stopping me is that the provider I originally wanted to move them to only lets me the following kinds of records:

• A
• MX
• NS
• CNAME
• TXT

The first four I understand, but I'm not sure about the relationship (if any) between SRV records and TXT records.

Can I use TXT records in the place of SRV records? They both seem to be general text records to just point at a particular server without needing to specify a particular protocol, so it doesn't sound like a totally unreasonable assumption, but I'd rather check here before I break something.

If I can only set the above records, does that mean I'm essentially unable to so any SRC record redirecting?

Thanks!