Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently beginning to plan a small Active Directory deployment and I've run into the following issue.

The AD domain is (the same as our public facing website) and the problem is that when I try to access any address like that is defined in the Windows Server DNS everything works perfectly, but when I want to access the public facing website ( the Windows Server DNS is returning the DC address.

How can I modify the DNS configuration in Windows Server so that the when someone requests a * that has no A or CNAME record on the server it gets forwarded to an Internet DNS server?


EDIT: Forgot to mention that I deleted the A record for in the Windows Server DNS.

share|improve this question
up vote 2 down vote accepted

There is no easy way to do that with a clashing domain. Generally you should pick between or example.local to avoid this sort of problem

share|improve this answer
You mentioned there is no easy way, is there a hard way? – Carlos G. Apr 4 '11 at 1:02
You can add A records pointing to the correct IPs and manually update them. – JamesRyan Apr 4 '11 at 9:48

If you aren't too far in, your best option is to tear down your internal domain and switch it to either example.local or This way you won't have any internal DNS servers thinking that they authoritative for the domain.

If re-doing your domain is not an option you could create A records with the external IPs for all the External subdomains:


share|improve this answer

We got around the problem by putting IIS on the domain controller. Then we set it to redirect all requests on the default website to Since will resolve correctly (from both inside and outside our network), everyone works great. This is accomplished in IIS by looking on the Home Directory tab in for the site. In the The content for this resource should come from: area select the radio button labeled A redirection to a URL.

If you're already using IIS on the domain controller for other reasons (for example, your dc is also your print server and you use the internet printing tool in IIS), the set up is a little more complicated. You have to distinguish the default web site from other web sites for whether or not to do the redirect.

share|improve this answer

You've set up split-horizon DNS service. You may not realize that you've done so, but done so you have. When one has set up split-horizon DNS service, one needs to populate the internal server's DNS database with appropriate data. As the Frequently Given Answer says, there are two approaches to doing that.

The one corner case when Active Directory is involved is the apex of the pruned part of the DNS namespace, because Microsoft Windows Domain Controllers dynamically register their own IP addresses as the domain name. Again, the Frequently Given Answer shows how one can approach that.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.