This question already has an answer here:
I have a Windows Server 2008 R2 server which is hosting a public website. I recently deactivated "DNS Recursion" for security options trough the following method:
In the properties of my DNS server in the "Advanced" tab under server options I check the option: Disable recursion.
Now I have the problem, that DNS Names are not resolved locally. So I cannot open google.com or microsoft.com nor anything else.
Now I found out that I have to configure a split DNS configuration, such that I have:
- One Zone which only answers lokal DNS queries and allows recursion
- One Zone which only answers external DNS queries and does not allow recursion.
My current setup looks like this:
I have a server named WIN-FOOBAR and a domain named foo.bar.com, so there are two entries _msdcs.foo.bar.com and foo.bar.com.
Now I have two questions:
If I disable recursion in the server options (e.g. in the parent node named WIN-FOOBAR), then how can I have two zones where one allows recursion and one that does not? The Forward-Lookupzone entry is a child node of WIN-FOOBAR. But I did not see an option to disable recursion for individual zones.
How should I name the second zone, which is used internally? The current zone is
foo.bar.com, can I create a second zone and also name it
foo.bar.comas well or must it be named differently? If I name it for example
foo.local, can it still resolve queries to