Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a few clients that need to sit across two otherwise separate networks. Let's call them network A (10.0.0.1) and network B (1.2.3.4).

Network A is effectively a private network; any Internet access on network A needs to go through a proxy.

I have configured routing such that traffic for 10...* will go through network A, and everything else will go through network B.

However, some private services on network A only exist in network A's private DNS - a lookup on network B will not resolve them. So even though the traffic could be routed to the right network, it won't be able to find the right network since the server doesn't exist in the public DNS.

Is it possible to configure Windows 7 to use one DNS server for certain lookups (e.g. all domains ending in example.private.lan), but use a different server for everything else?

share|improve this question

2 Answers 2

No. This is not configurable at the DNS client. You must employ split-horizon DNS service. In the case of using Microsoft's DNS server for this, when the internal content DNS server is not yours, you must have a non-public proxy DNS server with either "stub zones" or conditional forwarding. In general, one should always employ "split horizon" DNS service if one is using non-public IP address ranges.

share|improve this answer
    
Just to add: If multi-homing is an option, you can run dissimilar DNS on different adapters, as long as there's no overlap in zone contents and authority. –  TristanK Jun 14 '11 at 13:22
    
... which of course won't work. Aside from the fact that the behaviour of the DNS Client with respect to preferred and alternate DNS servers isn't straightforward, there's the fact that of course a negative answer from the "wrong" proxy DNS server will be accepted as-is, and won't cause fallback to another adapter's proxy DNS server. The correct thing continues to be to use a proxy DNS server properly configured to send the query to the right place according to the QNAME, because the DNS Client will not do so, multiple adapters or no. It performs no such differentiation. –  JdeBP Jun 14 '11 at 13:53
    
On your client resolver comment - check again. It's the false positives you have to worry about. I don't disagree with the "correct" approach, but the other one works too. Multi-adapter DNS resolver behaviour is documented on technet. –  TristanK Jun 14 '11 at 22:25
    
There is no overlap; TristanK - you are right; the client tries the lookup on the first adapter, if that returns negative, it tries the second and so on. Which solves my problem. Thanks! –  askvictor Jun 15 '11 at 0:23
    
TristanK, you should actually go and read the TechNet documentation that you are pointing to. It tells you exactly what I'm telling you. There's no differentiation by QNAME mechanism. The DNS Client simply does not have the mechanism that is necessary for making this work. And answers from the "wrong" proxy DNS server are accepted as-is, be they positive or negative. This is a problem for both, but the negative is more common for obvious reasons. The system does not operate on negative answers as askvictor and you say. You should read the doco. It will inform. –  JdeBP Jun 18 '11 at 15:26

I agree with ErikA.

"Is it possible to configure Windows 7 to use one DNS server for certain lookups (e.g. all domains ending in example.private.lan), but use a different server for everything else?"

The answer is no. The solution is to allow the two DNS servers to have each other's zone, and allow zone transfers.

share|improve this answer
    
Not possible to transfer zones. Will have to continue the research... –  askvictor Jun 14 '11 at 5:21
    
-Why can't you? –  KCotreau Jun 14 '11 at 5:29
    
You could also try using forwarders. –  KCotreau Jun 14 '11 at 5:33
    
KCotreau: because I don't own the DNS servers –  askvictor Jun 14 '11 at 5:35
    
I guess creating my own forwarding DNS server would be a possibility, but that wouldn't tie in with DHCP for the other networks :-/ –  askvictor Jun 14 '11 at 5:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.