Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This maybe unusual question but I would like to find out if this is possible.

We have several security zones behind firewall, let's call them LAN, DMZ and Backend.

There is a DNS server (bind, servername is in DMZ zone, set as split DNS.I.e. it resolves public addresses to the request made from the Internet and private NATed addresses for same domain to the requests coming from the LAN and Backend.

It all works fine, however now I am introducing Windows 2008 AD into the Backend as server base grows and managing SAM databases is not an option anymore.Windows domain name is DOMAIN.COM.I realise that this may be confusing setup but this is done to keep things simple in the naming department.
Naturally this requires using Windows DNS which is on the same AD.DOMAIN.COM server.
DNS zones on this server work fine and I have set up a forwarder for for any internet related queries.
Now the question. If I want to resolve host located in the DMZ NATed subnet from th windows host in the Backend(i.e. use internal part of the split brain DMZ) , how do I make sure that requests for whatever_is_not_in_windows_domain.com_zone" are forwarded to the internal split brain DMZ?Is it possible at all? I realise that I can hardcode them into the windows dns server zone, but this looks like a workaround, not a solution...
Hopefully I was clear enough :)

share|improve this question
up vote 3 down vote accepted

I don't think this is possible, AD.DOMAIN.COM believes it is the authoritative source for this domain and will respond with NXDOMAIN no matter what.
I would really advice you to create a subdomain to put your AD into. As your setup grows this will become a bigger problem and manually adding hosts to both zones doesn't seem like a nice task.

It would be possible to run a Active Directory with a BIND DNS server.
What you could do is merge the zones and allow updates from the AD.DOMAIN.COM server.
However this requires the DOMAIN.COM zone to be a dynamic zone.

share|improve this answer
This is an interesting idea.Where can I read more about it? – Sergei Oct 8 '10 at 10:20
1 The only non-obvious option you will need to set in your zone is "check-names ignore;". – faker Oct 8 '10 at 10:35
+1 - Naming your Active Directory domain "" is a mistake. You're going against Microsoft-recommended best practices. Running BIND for your DNS for the Active Directory domain is an option, but you still have an ugly situation. Be aware that, in order for Group Policy to work properly, the "" name must resolve to the IP address of the domain controller computer(s), for example. – Evan Anderson Oct 8 '10 at 11:55
Thank you Evan, what is exactly done against best practises?What is solution - have a subdomain? – Sergei Oct 8 '10 at 14:03
Or totally different domain like domain.corp? – Sergei Oct 8 '10 at 14:11

I don't think this is possible. The backend Windows dns server is authoratative for and therefore won't forward requests for to another dns server. I think your only choice is to add static entries for the DMZ machines into the backend zone.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.