I am a bit confuse here, I'm trying to establish a connection to Active Directory server from linux, someone told me to use this command:

host -t srv zeus.company.com

Assuming the Active Directory server is having this host name > [zeus.company.com] and the output shows:

zeus.company.com has no SRV record

According to the documentation, if the output doesn't return an SRV record, then it could be a problem with my DNS. Does this means zeus.company.com is not register in my linux's /etc/resolv.conf or it has to be register in Active Directory server?


SRV records typically follow this structure:


For example, Microsoft AD relies on both LDAP and Kerberos to operate. So, in order to advertise these services, the following SRV records are created in the DNS domain representing the AD domain (let's say example.com is our domain):


So really, what you should be running is this command:

host -t srv _ldap._tcp.zeus.company.com

For a more detailed explanation of how SRV records work, see this: http://en.wikipedia.org/wiki/SRV_record

For a full listing and explanation of ActiveDirectory DNS SRV records, see this page: http://technet.microsoft.com/en-us/library/cc961719.aspx

And here is an example of a successful query for a Microsoft Key Management Server using the host command:

rouben@BeagleBoard-Black:~$ host -t srv _vlmcs._tcp.it.cornell.edu  
_vlmcs._tcp.it.cornell.edu has SRV record 20 0 1688 kms02.cit.cornell.edu.  
_vlmcs._tcp.it.cornell.edu has SRV record 10 0 1688 kms01.cit.cornell.edu.  

In an AD domain the typical service records, SRV records, published in DNS are the ones pointing to LDAP and Kerberos servers.

Those allow you to use DNS for the discovery so you don't have to configure explicit host names to use the LDAP and Kerberos services, giving you more flexibility to add and remove servers in your AD topology.

You find the LDAP and Kerberos servers in the AD domain <domain> by looking for the _ldap._tcp.<domain> and _kerberos._tcp.<domain> SRV records. e.g.

host -t srv _ldap._tcp.domain.com
host -t srv _kerberos._tcp.domain.com

If zeus.domain.com is the only AD directory server you'd expect a result like:

_ldap._tcp.domain.com SRV record location:
    priority     = 0
    weight       = 100
    port         = 389
    srv hostname = zeus.domain.com 

AFAIK normally no SRV records are added for the hostnames of the actual domain controllers, so it is expected that the host command in your question wouldn't find any.

If you can resolve the hostname of zeus.domain.com to the actual IP-address of that AD server, then your DNS works well enough to connect to the AD domain. i.e. plain host zeus.domain.com must work.


The mistake is in the use of the actual hostname of the AD server. That isn't necessary you just need to list the "AD service names" along with your domain name.

  • _kerberos._tcp
  • _ldap._tcp


$ host -t srv _ldap._tcp.mydom.com
_ldap._tcp.mydom.com has SRV record 0 100 389 ad1.mydom.com.
_ldap._tcp.mydom.com has SRV record 0 100 389 ad2.mydom.com.
_ldap._tcp.mydom.com has SRV record 0 100 389 ad3.mydom.com.

Where my domain is mydom.com and my AD servers are named ad1 - ad3.

SRV records

These records typically have this form (from wikipedia):

_service._proto.name. TTL class SRV priority weight port target.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.