Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have 2 Windows 2012 servers. One is a Domain Controller and the other is a Web Server. DNS is hosted on both of these servers.

I have deleted the default A record and made a new one with the IP of my webserver. After about 10 minutes, a new record was generated with the IP of my DC. Does anyone know why?

share|improve this question

1 Answer 1

up vote 5 down vote accepted

Stop. Don't do this. If you've named your Active Directory the same as your external web presence, you've goofed. I've blogged about how to properly name your AD. You should read it. It's about .local mostly, but also touches on split-DNS which you've created here.

This except is shamelessly stolen from my blog:

The correct way to name an Active Directory domain is to create a subdomain that is the delegation of a parent domain that you have registered and have control over. As an example, if I ever started a consulting business and used the Internet-facing website mdmarra.com as my company's site, I should name my Active Directory domain ad.mdmarra.com or internal.mdmarra.com, or something similar. You want to avoid making up a TLD like .local and you also want to avoid the headache of using mdmarra.com for the Internet-facing zone and the internal zone.

Your domain controllers will always register A records automatically for the root of your AD domain. This is why it's best practice if you web site is example.com to name your AD corp.example.com or ad.example.com

There are a few workarounds for this:

  1. Run IIS (or another web server) on your DC and redirect requests on :80 of :443 to www.example.com which will be your web server.

  2. Train your internal users to go to www.example.com instead of just example.com

  3. Throw your AD away and start over with a properly named one.

1 and 2 are bandaids. 3 is the fix.

share|improve this answer
    
Thanks. Didn't realize that I should not name it as the same as my domain. –  cheese5505 Oct 3 '13 at 21:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.