Question 215 - AZ-800 discussion

To deploy a new primary DNS zone named fabrikam.com to DC1 and sign the zone, you can follow these steps:

Step 1: Create the Primary DNS Zone Use the Add-DnsServerPrimaryZone PowerShell command to create the primary zone:

Add-DnsServerPrimaryZone -Name 'fabrikam.com' -ZoneFile 'fabrikam.com.dns' -DynamicUpdate Secure

This command creates a primary zone for fabrikam.com with a DNS file named fabrikam.com.dns and allows secure dynamic updates.

Step 2: Sign the Zone To sign the zone, you can use the DNS Manager or Windows PowerShell. Here's how to sign the zone using PowerShell:

Add-DnsServerSigningKey -ZoneName 'fabrikam.com' -Type KeySigningKey -CryptoAlgorithm RsaSha256

Set-DnsServerDnsSecZoneSetting -ZoneName 'fabrikam.com' -DenialOfExistence NSEC3 -NSEC3Parameters 1,0,10,''

These commands add a signing key to the zone and set DNSSEC settings with NSEC3 parameters.

Step 3: Publish the Signed Zone After signing the zone, ensure that it is published and available for DNS queries. You can verify the zone signing status using the following command:

Get-DnsServerZone -Name 'fabrikam.com'

Note: Ensure that you have the appropriate permissions to perform these actions on DC1 and that the DNS Server role is installed and properly configured. Also, replace 'fabrikam.com.dns' with the actual path to your DNS file if it's different12.

By following these steps, you should be able to deploy and sign the new primary DNS zone fabrikam.com on DC1.