Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We're a small company with a small amount of servers - 2 windows servers and 1 linux server. We're at the moment experiencing a DDoS attack against our DNS server - probably some spoofed IP-addresses sending small requests that make my server return large messages (root hints).

The two Windows 2003 servers serve up both ourDomain.local and ourDomain.com - .local is of course giving the internal IPs of stuff, while .com gives out web server and MX records etc. Also, our internal users have these two DNS servers as their DNS servers. Anything the servers don't know about it forwards to our ISPs DNS servers, then it replies to the local clients.

Is there a way to get the DNS servers to reply like this:

  • Internal clients - any request
  • External clients - requests for ourDomain.com ONLY

Or do I actually need separate physical servers to do this?

If something is unclear or missing, let me know, and I will research.

Thanks!

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

Unfortunately there's no way to do this in W2K3. You'll need to set up another DNS server. My recommendation would be to leave the current servers as your AD\DNS servers for your internal AD\DNS clients and set up new servers to host your external zones.

share|improve this answer
    
Obviously not the answer I wanted, but since it is probably correct (who am I to doubt someone with a 5 digit reputation?), then that is the way it is.. :) Thanks! –  Rune Jacobsen Aug 9 '10 at 16:24
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.