Sortlist - round robin - netmask ordering confusion

Question

I went through a crisis not long after splitting my Win2003 AD network into two VLANs, crisis documented at http://discussions.apple.com/thread.jspa?threadID=2361165
In a nutshell, Windows DNS uses netmask ordering to resolve the "best" IP address to client queries based on their IP address. If a given host (on LAN) has more than one IP address on different VLAN/subnets, a query to a DNS server should give both IP answers, though only the one on the same subnet as the client is often accessible to that client. Thus, netmask ordering adds some intelligence to that process, overriding round-robin, and it works pretty well.
Enter OS X Server using BIND, and set up a secondary zone to a Windows primary, and that all goes out the window. It seems OS X Server uses Round Robin by default. Though BIND is supposed to have similar functionality to Windows server's netmask ordering in a function called "sortlist," I can't figure out how to use that in OS X Server.
Anyone ever mess with that?

Answer 1

Camelot wrote:
I'm not entirely sure I understand what you're asking. There is no concept in DNS of subnets - a host record maps to a network address (and vice versa), and subnets don't come into play.
Unless what you're referring to is the ability of the name server to offer different replies based on the client's IP address…?
If so, that is possible in BIND, via views, but there is no GUI support for multiple views in Server Admin (all zones exist in a single view served to all clients).
If you want to offer different results to clients based on their address you'll need to implement a secondary view containing the zone data that should be visible to those clients. You'll also lose the ability to manage your DNS via the GUI. It's not that hard to do, but it does mean you'll typically be working in the shell to maintain your zone files.
My nutshell approach was not clear, but you got the gist. But there is a concept of subnets implemented in Window server. I split our school network into two VLANs for security (keep students from even seeing admin servers) but needed to keep domain in Active Directory and our Windows servers. Thus, the domain controllers are multi-homed. School admin subnet is 172.16/16, student subnet is 172.20/16. Without netmask ordering or round robin enabled, Mac clients requesting internal DNS resolution would always get the 172.16.x.x address of the domain controllers, so they could not authenticate to the domain (the AD plugin apparently can only use the first IP returned in a query, it won't try others if unsuccessful). Netmask ordering enabled the DNS server to look at the IP of the DNS client and reply to queries with the IP which is in the client subnet first, then additional IPs, if any. The next bump I hit was that netmask ordering assumes a Class C subnet, not very well-documented, but a simple command fixed that, and it's worked excellent ever since-- until I tried designating a Mac server as a secondary and set some Mac clients to point to the Mac server for DNS resolution. They then get round-robin replies, so the ADplugin, which must make several DNS queries, gets confused. Research led me to sortlist, but whether it's that or "views" as you suggest, it's probably not something I want to jump into. I am going to give up on my Magic Triangle dreams and convert student and teachers to Open Directory over the summer, just create a new domain.
P.S. technically, MS discourages having DCs multi-homed, but not having anything layer 3 to route between my new VLANs, it was my only option. In addition, the administrative file server I needed to keep away from student hacking is also the main Domain Controller (PDC emulator master), so adding routes to make the DC work across subnets would have defeated the security purpose. It's a smaller private school, limited resources. Thx.