Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In our network the name of the network domain is also the domain of the organization's website (say, Externally, people can enter to visit our website, but internally, this points to one of the several domain controllers, we have for Active Directory, some of which do not even run a webserver.

As a result of this, links to don't work internally (only does work internally).

How do we point http requests transparently to the web server, and what side effects does this have?

share|improve this question
up vote 15 down vote accepted

There's no easy solution for what you want.

You don't want to use the same domain-name internally as is already authoritative for something else on the Internet. Now you're learning why.

If it's not too late to change the AD domain name to something else I'd recommend doing so.

If not, you have two choices:

  • Run a "redirect" web site on all the domain controllers (since each one answers for "") to redirect requests to another hostname (like, say,

  • Just tell users that "" doesn't work to get to the company web site.

If you monkey around with the A record for the AD domain name trying to "point" it an external address you will break DFS referrals for the SYSVOL, and cripple group policy on all your computers.

This is the biggest reason why I recommend that Customers use an ""-style second-level domain name. Unless you have very good reasons you should never create a zone on a DNS server that some other DNS server(s) on the Internet are already authoritative for, even if it's inside a private LAN. Eventually you'll want to connect your private LAN to the Internet and the conflicting names will cause you problems.

share|improve this answer
I would recommend something like rather than company.local; recommended practices are that domain names are Internet-usable. – James Risto Jul 29 '09 at 17:01
I've always been partial to "", personally. There's probably never going to be a real ".local" TLD, what w/ so many installations already using it for internal naming. – Evan Anderson Jul 29 '09 at 17:11
You may want to watch out if you have OS X clients, though: they use .local for Bonjour service location. That gave us some interesting problems until we worked out what was happening. – RainyRat Jan 29 '10 at 12:20

Changing the location that points on DNS is obvioulsy not a good idea, as it needs to point to the domain controller. You could setup IIS on the DC with a stite for that just forwards the request to

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.