There are multiple issues...
First there is probably the _underscope problem. Add this to your zone:
Code:
zone "example.com" {
type master;
file "/etc/bind/db.example.com";
check-names ignore;
allow-update { 192.168.0.0/24; };
};
The standard (I think it's in the DNS RFC...) says, that no _underscope can be in a DNS name. "check-names ignore;" tells DNS to ignore the standard. This is the Microsoft standard :-)
Before and after adding this line, try checking if your DNS resolves your hosts.
Code:
dig @ns.example.com something
"something" is something from your zone file, like
www.example.com if you have a A record for www.
The second problem is, that you are using "NS" records, where "SRV" records should be. The guide tells us to use in our zone file:
Code:
_ldap._tcp.DOMAIN.COM. SRV 0 0 389 DCHOSTNAME.DOMAIN.COM.
You are using:
Code:
_msdcs NS win-2k3srv01
The SRV record is to tell where services are located. With your record, you are telling that for the zone _msdcs the nameserver is win-2k3srv01.
An example zone file, that I took from our BIND DNS.
Code:
$ORIGIN DOMAIN.COM
$TTL 3600 ; 1 hour
DOMAIN.COM IN SOA ns.DOMAIN.COM. admin.DOMAIN.COM. (
2008080428 ; serial
86400 ; refresh (1 day)
21600 ; retry (6 hours)
3600000 ; expire (5 weeks 6 days 16 hours)
3600 ; minimum (1 hour)
)
NS ns.DOMAIN.COM.
ns A 192.168.0.1
DCHOSTNAME A 192.168.0.10
_ldap._tcp.DOMAIN.COM. SRV 0 0 389 DCHOSTNAME.DOMAIN.COM.
_kerberos._tcp.DOMAIN.COM. SRV 0 0 88 DCHOSTNAME.DOMAIN.COM.
_ldap._tcp.dc._msdcs.DOMAIN.COM. SRV 0 0 389 DCHOSTNAME.DOMAIN.COM.
_kerberos._tcp.dc._msdcs.DOMAIN.COM. SRV 0 0 88 DCHOSTNAME.DOMAIN.COM.
So if you break the zone file down, you get:
1. things about zone, admin mail, and who is the NS (nameserver).
2. one A record for the NS
3. one A record for the DCHOSTNAME <- this is your win-2k3srv01
4. _ldap and _kerberos entries pointing to services on your domain controller
Hope it will be helpfull, and I hope that I didn't write too much :-)
HOWTO: MS Active Directory with BIND on Linux
