Active Directory-Integrated DNS

Active Directory-Integrated DNS: Stores DNS zones as directory objects and distributes them to selected domain controllers through AD replication. Secure dynamic updates can therefore use Kerberos and object permissions. Because Active Directory uses DNS to locate domain controllers and services, tampered records or outages directly threaten authentication and administration.

How it works and where it fits

Active Directory-Integrated DNS separates the subject, digital identity, authentication factor, and authorization decision. Authentication establishes who or what is presenting an identity; authorization then determines which action is permitted in the current context. Session state, device trust, request origin, and risk signals can further influence that decision.

Practical security relevance

Effective implementation requires a controlled identity lifecycle from creation through role and entitlement changes to suspension and removal. Strong authentication, least privilege, periodic recertification, and traceable logs are central. Controls must also identify abuse of legitimate accounts, because valid credentials alone do not prove that an action is legitimate.

Related concepts

• Active Directory DomainActive Directory DomainLogical Active Directory partition with a shared directory database, namespace, policies, and domain controllers.: Logical Active Directory partition with a shared directory database, namespace, policies, and domain controllers.
• Domain ControllerDomain ControllerServer running Active Directory Domain Services that replicates directory data and supports authentication and authorization for a domain.: Server running Active Directory Domain Services that replicates directory data and supports authentication and authorization for a domain.
• Active Directory ReplicationActive Directory ReplicationMulti-master synchronization of directory changes between domain controllers with partition, site, and conflict handling.: Multi-master synchronization of directory changes between domain controllers with partition, site, and conflict handling.
• Domain Name System Security ExtensionsDomain Name System Security ExtensionsProtects DNS responses against tampering using cryptographic signatures.: Protects DNS responses against tampering using cryptographic signatures.