Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In our network the name of the network domain is also the domain of the organisation's website (say, example.com). Externally people can enter example.com to visit our website but internally this points to one of the several domain controllers, some of which do not even run a webserver. So, the result of this is that links to http://example.com don't work internally (only www.example.com works).

How do we point http requests transparently to the webserver and what side effects does this have?

share|improve this question

2 Answers 2

up vote 10 down vote accepted

There's no easy solution for what you want.

You don't want to use the same domain-name internally as is already authoritative for something else on the Internet. Now you're learning why.

If it's not too late to change the AD domain name to something else I'd recommend doing so.

If not, you have two choices:

  • Run a "redirect" web site on all the domain controllers (since each one answers for "domain.com") to redirect requests to another hostname (like, say, www.domain.com).

  • Just tell users that "domain.com" doesn't work to get to the company web site.

If you monkey around with the A record for the AD domain name trying to "point" it an external address you will break DFS referrals for the SYSVOL, and cripple group policy on all your computers.

This is the biggest reason why I recommend that Customers use an "ad.company.com"-style second-level domain name. Unless you have very good reasons you should never create a zone on a DNS server that some other DNS server(s) on the Internet are already authoritative for, even if it's inside a private LAN. Eventually you'll want to connect your private LAN to the Internet and the conflicting names will cause you problems.

share|improve this answer
    
I would recommend something like corp.company.com rather than company.local; recommended practices are that domain names are Internet-usable. –  James Risto Jul 29 '09 at 17:01
    
I've always been partial to "ad.company.com", personally. There's probably never going to be a real ".local" TLD, what w/ so many installations already using it for internal naming. –  Evan Anderson Jul 29 '09 at 17:11
1  
You may want to watch out if you have OS X clients, though: they use .local for Bonjour service location. That gave us some interesting problems until we worked out what was happening. –  RainyRat Jan 29 '10 at 12:20

Changing the location that example.com points on DNS is obvioulsy not a good idea, as it needs to point to the domain controller. You could setup IIS on the DC with a stite for example.com that just forwards the request to www.example.com.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.