Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Some background information first. We run a split horizon dns setup. So publicly goes to (Public Address) and internally, goes to (Internal Address). The zone for is integrated into AD for replication. For this problem, we have two sites, siteA and RemoteSiteB. The two are connected via a site-to-site vpn so users can access both internal and external addresses.

What we want is to have users in RemoteSiteB go to the public address for particular entries on our domain, but only in that site.

Is there any way to achieve this without putting the zone back to an non integrated AD one? Doing so looses all the replication features.

Servers are all 2008R2 in case that makes any difference.

Edits for clarity. This is the DNS responses I'm looking to achive

SiteA DNS: -> ->

RemoteSiteB DNS: -> ->

share|improve this question
There's no way to do what you're looking for and maintain an Active Directory integrated zone for This is yet one more example of why using the same name for your AD domain and Internet DNS is a bad idea (and discouraged by Microsoft). – Evan Anderson Mar 1 '11 at 14:57
Our domain is not our AD domain, we just hold our public domain name inside our AD DNS servers for the split-horizon setup. – Ryaner Mar 1 '11 at 15:22
Oops! My apologies for the bad assumption. That changes everything and makes it very possible to do just what you did... >smile< – Evan Anderson Mar 1 '11 at 21:17
up vote 2 down vote accepted

I would recommend putting the zone back to non integrated and using forwarders to achieve what you want. In this scenario you can still keep 1 record of the zone that every site can use.

In the example.

SiteA - NS for the zone - AD replicated - NS for the zone - no replication

ourdomain - NS for the zone - AD replicated - forwards to the internet DNS server - forwards to site A - forwards to site A - forwards to site A

Setting up forwards in DNS is very easy

Alternatively, you could use a secondary DNS server in site B that everyone used, but that sounds a bit silly for your purpose, or host files on local machines, but that might be a bit silly as well.

Also, it may be you do not want to have a single copy of the DNS records, in that case you could use a secondary DNS server in Site A or Site B that was also a nameserver for the domain, and you can configure 2 forwarder address for redundancy.

If you have trouble with the forwarders please comment so I can provide more info.

Hope this helps you.

share|improve this answer is an A record. So I assume it will use the local A record ahead of any forwarders that are configured? – Ryaner Mar 1 '11 at 15:23
ok, so what you want to do there is create a zone in site A that is not AD integrated for, make it Non AD integrated. delete the A record first. Then you will have the hosted on your DNS server in site A but not replicated to site B. Then in the new non integrated zone create an A record with the same value for the one you deleted. In site B after replication completes it will detect the A record has been deleted. Then create a forwarder for to point to the internet for resolution. This is called conditional forwarding. – pablo Mar 1 '11 at 15:44
btw make sure to have backups just in case, DNS is VERY important. Also do it in the off hours if temporarily breaking the DNS for will be disruptive. I have a similar config setup in my environment and it works great. – pablo Mar 1 '11 at 15:46
Some testing shows this could work. 2008 has renamed forwarders to conditional forwarders which is where I got confused. ( – Ryaner Mar 1 '11 at 16:05

Wanted to give a clear answer of the solution we've established based on the answer from pablo. - AD integrated Domain

In the DNS of RemoteSiteB, we added a subzone for Inside of this zone, we added the blank A record for the public address we are directing traffic to.

This way all the replication from the primary server is being handled and the individual entries are being overridden where required.

share|improve this answer
glad it worked :) – pablo Mar 1 '11 at 19:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.