Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let's say I have a web-server on my internal network which is behind a NAT router. I have my external DNS for the “” domain configured with an A record for “foo” that points to my router's public address.

I want my internal network clients to resolve to the internal address.

However, this is the only record that should point to an internal address.

Do I need to create a primary zone for and mirror all the records from my external zone with the exception of “foo” (this is what I am doing now), or is there a better way?

share|improve this question
up vote 2 down vote accepted

Actually, it would be the other way around. What you'll want to do is add an authoritative zone to your server as with the appropriate records. The server will see that it is authoritative for that hostname and use the local records. Everything else such as and would go out through the normal resolver.

share|improve this answer
This worked perfectly!!! – Corey Jul 15 '10 at 21:46

I think Justin is assuming that is a domain, but based on your question, it sounds more like is the FQDN of just your web server?

If I understand this correctly, what you want to do is have your external DNS server have all the records for, and your internal DNS server only the record for, and somehow forward all requests for any other record in to your external DNS server for resolution?

If that's true, then no, there's no way to do that in the MS DNS Server (2000-2008 versions). To have any records for, the server has to be authoritative for, and if it's authoritative then it will always respond to a request for a record it doesn't have with a "no such record" response, rather than doing some kind of recursive query.

There are other DNS servers that have this feature (maraDNS) but I believe it violates the RFCs, so it won't be there in any mostly RFC compliant DNS server.

In short, your current method (mirroring all the records except this one internally and externally) is the best/only way to make this split-brain configuration work with the MS DNS Server.

share|improve this answer
yes, is a host, not a sub-domain but would Justin's method technically work? – Corey Jun 14 '10 at 23:24
Yes. You can configure as an authoritative zone with a single address record for the base "domain" (which in this case would be with the IP that you want to direct it to. The local DNS server doesn't care what you consider the host to be, only what you tell it it's authoritative for. – Justin Scott Jun 18 '10 at 15:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.