1

I am working on an Active Directory domain with a single DC running Windows Server 2012 R2. The DC is set up as a DNS server (amongst other roles), and forwards to our ISP's name servers.

The gateway for the network is a hardware firewall at 10.43.5.1; the DC is at 10.43.5.2, and the gateway instructs its DHCP clients to use 10.43.5.2 for DNS lookups.

The DC (with DNS server role) has a small number of internal A records for mapping hosts on our intranet. The FQDNs for these have form, "myhost.local.mycompany.com", where our intranet domain is "local.mycompany.com".

My problem is that clients on the domain are only intermittently successful in looking up intranet hosts (such as, "myhost.local.mycompany.com").

I suspect that this might have something to do with our public-facing website which sits at "mycompany.com" on a different server entirely. If a DNS lookup for "myhost.local.mycompany.com" somehow failed to be returned from our DC, the DC would forward the request to our ISP's DNS nameservers (and so on), which would successfully resolve for "mycompany.com", but then return no host found at "local.mycompany.com" on the Internet at large.

... That's just my suspicion though, and it may be something else entirely.

In any case, has any ever worked with a similar set up? Am I missing something obvious?

How can I ensure that requests for, "local.mycompany.com" and subdomains thereof are only ever serviced by our DC, and never get forwarded to the Internet, which still allowing "mycompany.com" (and everything else) through?

6
  • So the dns server has a forward lookup zone called local.mycompany.com yes?
    – Drifter104
    Feb 11, 2016 at 16:22
  • Yes it does - it was created by the DNS server role to match the domain. My internal hosts (the resources I'm trying to access) have A records under that.
    – snoopy91
    Feb 11, 2016 at 16:27
  • Little strange - The DNS server shouldn't forward requests for zones under forward lookup zones. If it doesn't have a record that match the request for one of those zones that is a valid response. Check to make sure it shows as ad integrated and type primary
    – Drifter104
    Feb 11, 2016 at 16:52
  • Have you tried enabling query logging? Guessing the cause to a problem is as much fun as it sounds.
    – Andy
    Feb 12, 2016 at 10:12
  • It's both AD-integrated and primary. @Andy I'm trying to enable debug logging, but the requisite Windows hotfix isn't installing... very frustrating. Are there any third-party AD DNS logging programs you know of that I could try?
    – snoopy91
    Feb 12, 2016 at 11:32

0

You must log in to answer this question.