1

Possible Duplicate:
When should I create a new Primary DNS Zone?

When should I create a new Forward Lookup Zone (primary zone) in my Active Directory DNS?

Since the option exists, I'm sure there are cases where it must be useful. And yet, it seems like most domains work just fine with the default single-zone configuration.

I've run into a few scenarios where it seems like a separate DNS zone could be useful, but I've never actually done so. So even if it's not required, could it be sometimes recommended?

  • Multiple physical sites and a single domain. For a network that spans multiple physical offices, a DNS zone could be set up for each office. It should be easy to set up with Group Policy, but this might cause problems resolving DNS for roaming users.
  • Wireless LAN. Having a separate DNS zone for wired/wireless interfaces would enable you to choose whether you connect to the wired or wireless interface on a client (remote admin).
  • Split-horizon DNS. If there are internal servers that need to be accessed from both inside and outside the office network, then split-horizon DNS would allow the names to resolve to either internal/external IP addresses depending on where the client is connecting from.

For these scenarios (and others?) I am looking for the pros/cons of adding a new primary zone, and I'm also interested to know whether anybody has encountered this in a production network.

Improve this question
3
  • I found this related question but I'm looking for more general answers.
    – Nic
    Feb 15, 2012 at 20:28
  • 3
    You realize you asked that question right? It can't have been that hard to find.
    – Zoredache
    Feb 15, 2012 at 20:39
  • Nope, honestly didn't realize I asked that question. Whoops.
    – Nic
    Feb 15, 2012 at 20:44

1 Answer 1

Reset to default
2

Some people use Windows for hosting their public DNS, and they have lots of different domain names. You need to add more zones, when you have more domains that you need to serve records for.

As a rule it is a bad idea for the DNS zone used by your active directory domain be made public, but some small-businesses mix their AD and public zones all on the same server. The reason is that you will leak out lots of private information, that people do not need to know.

Improve this answer
3
  • It's not necessarily a bad idea. If you employ NAT to access internal resources from the internet, you might want to have a private "mirror" of your public DNS zone, with records pointing to the local interfaces to reduce network latency when accessing these resources from the internal network
    – Mathias R. Jessen
    Feb 15, 2012 at 20:45
  • @MathiasR.Jessen, I updated my answer a bit. I am primarily talking about all the internal information you give out when you make the zone used by your AD public. AD DNS includes lots of technical details about how your systems are setup, and give a would-be-hacker lots of information about what to attack.
    – Zoredache
    Feb 15, 2012 at 20:49
  • totally agreed, never use an AD DNS server as a public DNS server. The message about "mixing" zones just sounded a little vague
    – Mathias R. Jessen
    Feb 15, 2012 at 20:52

Not the answer you're looking for? Browse other questions tagged .