Let's say I have an internal LAN (LANA) with AD/DHCP/DNS, isolated from the internet with no default gateway. Its DNS Server DNSA is thus non-recusive. A few of the servers also have a second NIC to a seperate LAN/Subnet (LANB) which does have a default gateway router/firewall to the internet. Accordingly they also have a set of public recursive DNS resolvers (DNSB) configured.
Network Map http://christoph.ruegg.name/storage/img/dualdnsnetwork.png
For a while the servers with two NICs have been able to resolve using both nameservers in some way (or it was simply working by accident thanks to caches). But now they seem to be using only DNSA for resolving names, without retrying on DNSB after (obviously) failing to resolve any internet domains - so they can't resolve internet domains anymore.
It doesn't seem Windows Server DNS can forward to an external DNS server it doesn't have access to (i.e. without enabling recursive resolving)
Can this network layout work reliably at all, or do I have to attach DNSA to LANB as well and turn it into a recursive resolver? Or is there another way, e.g. using conditional forwarders? (I'd prefer to completely isolate some servers, although of course I'm aware that doesn't help if one of the dual-NIC servers is hacked)