Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We're a small company with a small amount of servers - 2 windows servers and 1 linux server. We're at the moment experiencing a DDoS attack against our DNS server - probably some spoofed IP-addresses sending small requests that make my server return large messages (root hints).

The two Windows 2003 servers serve up both ourDomain.local and - .local is of course giving the internal IPs of stuff, while .com gives out web server and MX records etc. Also, our internal users have these two DNS servers as their DNS servers. Anything the servers don't know about it forwards to our ISPs DNS servers, then it replies to the local clients.

Is there a way to get the DNS servers to reply like this:

  • Internal clients - any request
  • External clients - requests for ONLY

Or do I actually need separate physical servers to do this?

If something is unclear or missing, let me know, and I will research.


share|improve this question
up vote 2 down vote accepted

Unfortunately there's no way to do this in W2K3. You'll need to set up another DNS server. My recommendation would be to leave the current servers as your AD\DNS servers for your internal AD\DNS clients and set up new servers to host your external zones.

share|improve this answer
Obviously not the answer I wanted, but since it is probably correct (who am I to doubt someone with a 5 digit reputation?), then that is the way it is.. :) Thanks! – Rune Jacobsen Aug 9 '10 at 16:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.