Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have an internal DNS as part of my AD setup. I have an hosted DNS for public resources (which are typically at some data centre somewhere)

Occasionally while on our internal network I need to get to a public resource --- for example www.ourcompany.com since there isn't a www record in our internal DNS I cant get the name resolved.

How do I configure my DNS to forward names it doesn't recognise to the public DNS.

Update: As per the comment yes I have a "split-horizon" dns (which seemed like a good idea at the time) This AD setup is less than 24 hours old, and can be redone if need be -- (although I would rather not)

share|improve this question
4  
Do you have a split-horizon DNS? Is your AD namespace ourcompany.com as well as your public facing zone? –  MDMarra Sep 20 '12 at 14:35

4 Answers 4

up vote 8 down vote accepted

It sounds like you have split-horizons DNS, where your AD namespace and public-facing namespace are the same. If this is the case, you'll need to make an A record for www in your internal AD zone and set the correct external IP. Without this, internal clients won't be able to resolve it. This is because you have two sets of servers with disjoint information that are both authoritative for your DNS zone.

This is the exact reason that Microsoft recommends using an unused third-level domain name for your AD namespace. For example, if you own mycompany.com and you host public websites on it, you should use something like corp.mycompany.com or internal.mycompany.com for your Active Directory namespace. If you can do a domain rename (i.e. you have a simple client/server infrastructure with no Exchange in the domain), you should look into it. If you can't do a domain rename to fix this, you're in for some headaches.


Edit: Per your update, you should absolutely redo this since the install is only 24 hours old. Absolutely no doubt about it. Having a split-horizon DNS situation is never a good idea when it can be avoided. You can still have mycompany.com be the NetBIOS name of the domain, so users see MyComapny\User instead of something like Corp\User, but the FQDN of your AD namespace and the FQDN of your public facing DNS namespace should not be the same.

share|improve this answer

Go into your DNS Management Snapin. Right click on the DNS server you are managing. Select the "Forwarders" Tab and enter the DNS servers you want to forward requests to.

enter image description here

share|improve this answer
    
This won't work if there is split-horizons DNS, which it sounds like. –  MDMarra Sep 20 '12 at 14:36
    
Yeah . I was thinking that, but went with the simple answer. –  Mike Sep 20 '12 at 14:38
1  
A Windows Server 2008 DNS server which is not configured to use forwarders will use the root hints. This is the default configuration when you install the DNS role. No steps beyond installing the role need to be taken in order for Windows Server 2008 DNS to resolve queries for external DNS records. Configuring forwarders is a choice, not a requirement. –  joeqwerty Sep 20 '12 at 14:44

Your internal zone matches your external zone, right? So company.com is your internal AD zone and your external public zone? If that's the case then it can't be done with Windows Server DNS, that I'm aware of.

The Windows DNS server is authoritative for the zone as far as it's concerned so it's not going to forward requests for the zone to another DNS server, even if the request is for a DNS record that doesn't exist.

share|improve this answer

It should in principle be fairly simple to create a PowerShell, VBScript or other tool that periodically queries an external DNS server, reads the external DNS IP addresses for given hosts, and updates them accordingly on the internal Windows server.

I have looked several times but have yet to find one, and am disinclined to write it myself.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.