Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using my domain example.orgin my firm. I can use www.example.orgto view my website. If I try http://example.org from outsite my firm there is no problem, but if I try it from inside, my windows DNS servers deliverthe IPs of domain controllers.

How can I solve this? Can I prevent my DCs from registering as example.org in my DNS and will this be a problem for my enviroment?

share|improve this question
    
To clarify, your internal network DNS name is example.org, and not something like example.local? –  DanBig Jul 25 '13 at 13:18
5  
You can solve this by naming your domain correctly, it should be something like ad.example.org, or corp.example.org. If that's no longer possible you're stuck. The best you can do is setup a redirect to www.example.org on any DCs that also have IIS installed (a bad idea, but a lot of domain controllers are setup poorly). –  Chris S Jul 25 '13 at 13:23
1  
"Can I prevent my DCs from registering as example.org in my DNS" - nope. "and will this be a problem for my enviroment?" - YES! –  mfinni Jul 25 '13 at 13:47
add comment

2 Answers

up vote 9 down vote accepted

If you've named your Active Directory example.org then you cannot prevent this. You've gone against Microsft's best practices for naming an AD and you're seeing one of the symptoms.

You have a few choices:

  1. Migrate to a properly named AD. Something like corp.example.org.

  2. Install a web server on each DC and configure it to forward web requests for example.org to www.example.org. This is dirty and shouldn't be done, but it's an option nonetheless.

  3. Train your users to go to www.example.org internally.

I've blogged about AD naming best practices multiple times and link to official Microsoft sources. You should read them:

http://www.mdmarra.com/2013/04/best-practices-for-configuring-new.html http://www.mdmarra.com/2012/11/why-you-shouldnt-use-local-in-your.html http://www.mdmarra.com/2013/07/more-documentation-from-microsoft-about.html

If you want the short version:

Do not create new Active Directory forests with the same name as an external DNS name. For example, if your Internet DNS URL is http://contoso.com, you must choose a different name for your internal forest to avoid future compatibility issues. That name should be unique and unlikely for web traffic. For example: corp.contoso.com.

-http://technet.microsoft.com/en-us/library/jj574166.aspx

share|improve this answer
    
In addition, you can setup a simple "example" CNAME in DNS (example.example.org technically) and have it point to www.example.org. Then you can just tell users to go to http://example. Silly of course, otherwise #3 in MDMarra's list is the only simple solution to the issue. I've been there (split-dns) and it isn't fun to deal with. –  TheCleaner Jul 25 '13 at 13:36
    
As long as "example" isn't the NetBIOS name for your domain. If it is, I can imagine what merry hell this would play in such an environment. –  mfinni Jul 25 '13 at 13:46
    
I will get me some information about migration to a properly name, I am just a little bit afraid of getting problems through it. The problem is with my Nagios Monitoring which I use to make sure that www.example.org and example.org is fine from external. Here i will go and find an alternative for my setup as long i have/will not migrate. Thx –  Max Jul 25 '13 at 17:16
add comment

You may solve your problem two ways, but it involves placing an HTTP server on your DCs :

You can do the redirection with an URL redirect (HTTP 301 code), IIS 7 can do that for you, or you can install a reverse proxy (Apache for Windows) and use the following code :

ProxyPass / http://www.example.com/

ProxyPassRever / http://www.example.com/

ProxyPreserveHost On

share|improve this answer
1  
This is included in MDMarra's answer; it's item 2. –  mfinni Jul 25 '13 at 15:32
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.