Active Directory Domain Naming

Question

Planning a new domain and I keep seeing that best practice is to name the forest/domain after a subdomain of our publicly registered domain.

So if we own and use company.com publicly, we should use something to the effect of ad.company.com for our AD DS domain.

The reasons I'm gathering for this:

1. To avoid split-horizing DNS
2. To avoid the requirement for "www" to access the publicly hosted website at www.company.com.

But the problem I see with this connecting to resources differently whether users are onsite or offsite.

So unless I'm missing something, when on the LAN to connect to public "webapp-1" the users will use webapp-1.ad.company.com and when offsite it would be "webapp-1.company.com".

Do most environments use hair-pinning on the router so the users don't ever use the internal domain to access resources? Rely on the search domains?

Managing split DNS doesn't bother me and the "www" isn't a big concern.

Can someone put the pieces together and explain what I'm missing? I imagine I'm overlooking something somewhat obvious.

Answer 1

I've always done split DNS, because I feel like it's less confusing for users inside the company. If you manage your internal and external DNS appropriately, it shouldn't be an issue.