Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a small situation that may require us to temporarily host DNS requests on a temporary server for a customer's domain. We think we can use our SBS 2008 to do this. I've proven it can work, in theory, but I'm wondering if I am not anticipating something.

The situation, in case anyone has a better answer, is thus:

We are attempting to move a domain name from GoDaddy to Network Solutions. Predictably, we want to minimize downtime. The domain name in question has a few DNS related records -- a couple of As, a few CNAMEs, MX, and one SRV.

When I spoke to NetSol, they stated that there was no way I could alter anything DNS related on their side until the domain transfer had completed. So, I would be likely to encounter a domain name waking up in its new home with no DNS records available to keep mail flowing, web site accessible, etc.

They suggested we host DNS temporarily at a way-station of sorts.

I created a new ZONE in my SBS2008 along with all the A, CNAME, etc. records for the domain. I tested via NSLOOKUP and confirmed that accurate information is given both when I query against the server internally and when I let DNS queries through the firewall and query from the outside.

I believe all I really need to do now is change the nameserver entries at GoDaddy.

Am I not anticipating anything?



share|improve this question
up vote 4 down vote accepted

A couple of things, although it sounds like you've got the bases covered:

  1. Make sure your firewall rule only allows UDP\TCP traffic to port 53 on the server.

  2. Make sure that you have the "secure cache from pollution" setting enabled on the server.

  3. Make the zone in question a standard Primary zone and not an AD integrated zone.

  4. Disable recursion on the server.

  5. Disable dynamic updates on the zone in question.

If this server is also a production server for your customer, I might suggest setting up a temporary server for the purpose of hosting the public DNS zone. I wouldn't want external queries for the public zone coming in to my production AD\DNS server. You can get a 180 day eval of W2K8 from MS and run it on any spare computer that meets the system requirements.

I haven't hosted a DNS zone for a public namespace on an internal server, I have my public DNS hosted with NetSol, but if I had to, this is how I would do it. Of course, take my suggestions with a grain of salt and see what otheres here have to say.

share|improve this answer
+1, but I second the notion of running it on another box with an Eval version of Server 2008. Just keep it totally separate from AD. – Chris S Feb 27 '10 at 16:17
I agree the OP plan looks OK and these comments, although I would want to confirm that disabling recursion doesn't have any side effects. I would also set the TTL to be fairly low, 1 hour probably, so if you need to make a change you can pretty quickly. My 2 cents is that if the site MUST be up then I would host the DNS at DynDNS or EasyDNS. If the SBS site internet goes down or the bandwidth is fully used then the website will go down and it won't matter if the SBS server is up. – Ed Fries Feb 27 '10 at 16:24
I definitely wouldn't use my production AD\DNS server for this. I would use a temporary server running DNS and would disable recursion as this DNS server should only answer queries for zones it is authoratative for and not queries for any other zones. – joeqwerty Feb 27 '10 at 16:34
I definitely recommend not using an established production server for this. – user17642 Feb 27 '10 at 17:21
Hey guys, Thanks for all the responses. Lucky (for us), we're running an ESXi host and VMs. I am going to build a separate Windows Server 2008 VM completely separate from our domain. I should also be able to segregate the server from the rest of the hosts within the same LAN. I'll also look up dynDNS or EasyDNS just to get a feel for the service. – tcv Feb 27 '10 at 18:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.