Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I have a vSphere environment with ever increasing pools of servers. Each pool/group of servers includes something like a firewall/proxy server, and two application servers (mixed environment, Linux and Windows.) The total number of users and machines is relatively small, somewhere in the realm of 50 machines and users mark.

  • -
  • -
  • -
  • ... etc ...

I have AD/Kerberos authentication working correctly with them against some Win2008R2 AD DCs, and things are fine. However, I would like to organize each pool/group of servers into DNS subdomains, to give users and developers a better idea of where the network starts and stops, and what machine belongs to which pool (since I will use a different subnet for each.)

What I'd like to see is something like this:

  • =
  • =
  • =


  • =
  • =
  • =

This, of course, causes problems with AD/Kerberos - especially with SSO/GSSAPI authentication - since the AD DC is set up to handle "" and not "". Kerberos wants a single realm, and does not automatically delegate to subdomains, certificates work the same way (a wildcard cert for will not work for subdomains ( etc.

So my question is, what is the simplest way to overcome this?

  • RO Child Domains Controllers for each lab for (not ideal, it adds complexity and I don't want yet another Win DC using up resources on my vSphere hosts)
  • Adding of realms to Kerberos and dns SRV alias for each subdomain, each an alias to the main AD DC. (Would this even work?)
  • Use of sites/subnets in AD for each pool of servers?

I need some direction, it seems like I have been going in circles on this one. Any help or comments are appreciated.

share|improve this question
Alternative: employ a new naming convention dictating that hostnames have a pool-specific pre- or suffix to distinguish between them. and is easily identified as 2 similar servers in 2 different pools – Mathias R. Jessen Jul 25 '13 at 15:12
Yes, it seems that a well thought out naming scheme is the easiest way to overcome this issue. – Lance Barbour Jul 10 '14 at 15:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.