Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Note - I know there are a ton of questions around AD Naming. I do not believe though that this is a duplicate question. If it is please link me to a relevant one :).

We are implementing AD. Our big issue is the domain name. We already have decided against .local after reading the many articles out there and speaking with people (We are 70/30 Mac right now).

We're trying to figureout if we should go with or for our Domain Name.

We know already if we went with we'd have potential issues if people didn't prepend www. to our site's URL, and we are willing to live with that.

Our concern is if there are any other consequences we don't know about. E.g. If we have an Exchange server of ours hosted in a Data center that isn't part of the LAN, would it have issues with DNS?

To give an overview of what we have -

Our site is hosted in an external datacenter, we currently use Google Apps but plan a migration to Exchange (Yes, we know it's against the trend..) which may also be hosted in a datacenter or onsite.

We also make extensive use of our UTM Firewalls VPNs and are looking at a Cisco VPN or Citrix solution as we scale up.

There are also plans to institute Windows Distributed File Sharing and possibly use Centrify or Extreme-Z IP if we find Native Mac Integration lacking.

We also plan to use AD as our authentication backbone using it for RADIUS and LDAP services for authentication and role management across our internal web apps and wireless.

We did read but I was hoping for some more up to date information from anyone well versed in maintaining AD especially in hybrid/distributed environments.

share|improve this question
up vote 4 down vote accepted

There is absolutely no reason to use the same AD domain DNS name as your external web-facing DNS zone. None. At all.

Microsoft recommends using a subdomain of an existing domain, so something like or is fine. If you don't want your users to see that their login name is corp\user you can set the domain's NetBIOS name to MYDOMAIN during the DCPROMO process of the first DC in your domain. The end result would be that your domain's FQDN would be but your users would see mydomain\user. This way you can have "prettier" logins, without the complete shitmess of split-horizon DNS.

Seriously, there's no valid reason to ever have split-horizons DNS with your AD infrastructure.

share|improve this answer
What would you think about a end TLD e.g. or instead? – CogitoErgoSum Aug 9 '12 at 15:00
@CogitoErgoSum As long as it's a valid domain name that you own, that's fine, though far less common. Why are you so hesitant to use a sub-domain? It's pretty standard. – MDMarra Aug 9 '12 at 16:17
We're trying to explore all options. From a management point of view they prefer things as 'pretty' as possible however the NetBIOS name could be a solution as well. – CogitoErgoSum Aug 9 '12 at 17:54
Split-Horizons DNS is a very important architectural choice when building out a secure infrastructure. See… – user2320464 Jul 1 at 0:56
@user2320464 nowhere did I recommend publishing internal records publicly. There's no reason for any AD DNS to be available on the public internet, so there's no reason for public DNS for that zone. And thus, no security issues. – MDMarra Jul 1 at 4:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.