Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
When should I create a new Primary DNS Zone?

When should I create a new Forward Lookup Zone (primary zone) in my Active Directory DNS?

Since the option exists, I'm sure there are cases where it must be useful. And yet, it seems like most domains work just fine with the default single-zone configuration.

I've run into a few scenarios where it seems like a separate DNS zone could be useful, but I've never actually done so. So even if it's not required, could it be sometimes recommended?

  • Multiple physical sites and a single domain. For a network that spans multiple physical offices, a DNS zone could be set up for each office. It should be easy to set up with Group Policy, but this might cause problems resolving DNS for roaming users.
  • Wireless LAN. Having a separate DNS zone for wired/wireless interfaces would enable you to choose whether you connect to the wired or wireless interface on a client (remote admin).
  • Split-horizon DNS. If there are internal servers that need to be accessed from both inside and outside the office network, then split-horizon DNS would allow the names to resolve to either internal/external IP addresses depending on where the client is connecting from.

For these scenarios (and others?) I am looking for the pros/cons of adding a new primary zone, and I'm also interested to know whether anybody has encountered this in a production network.

share|improve this question

marked as duplicate by Chris S Feb 15 '12 at 20:49

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
I found this related question but I'm looking for more general answers. –  Nic Feb 15 '12 at 20:28
3  
You realize you asked that question right? It can't have been that hard to find. –  Zoredache Feb 15 '12 at 20:39
    
Nope, honestly didn't realize I asked that question. Whoops. –  Nic Feb 15 '12 at 20:44
add comment

1 Answer

Some people use Windows for hosting their public DNS, and they have lots of different domain names. You need to add more zones, when you have more domains that you need to serve records for.

As a rule it is a bad idea for the DNS zone used by your active directory domain be made public, but some small-businesses mix their AD and public zones all on the same server. The reason is that you will leak out lots of private information, that people do not need to know.

share|improve this answer
    
It's not necessarily a bad idea. If you employ NAT to access internal resources from the internet, you might want to have a private "mirror" of your public DNS zone, with records pointing to the local interfaces to reduce network latency when accessing these resources from the internal network –  Mathias R. Jessen Feb 15 '12 at 20:45
    
@MathiasR.Jessen, I updated my answer a bit. I am primarily talking about all the internal information you give out when you make the zone used by your AD public. AD DNS includes lots of technical details about how your systems are setup, and give a would-be-hacker lots of information about what to attack. –  Zoredache Feb 15 '12 at 20:49
    
totally agreed, never use an AD DNS server as a public DNS server. The message about "mixing" zones just sounded a little vague –  Mathias R. Jessen Feb 15 '12 at 20:52
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.