0

I took over support for a Windows 2008 domain that was set up by another system administrator. The DNS name of the domain is admin.example.com and a web site is also using the same DNS name. The sysadmin that set up the domain never put it into the corporate DNS server. Our windows domain clients work fine if they use the AD DNS.

We have been getting by for years with no problem. Now I want to set up a trust with the main corporate AD, but I'm worried that it won't work because the corporate AD will be confused since a web server has admin.example.com.

Unfortunately, I cannot replace the admin.example.com DNS record for AD. The website owner is not giving it up.

Anyone have any suggestions on how to get this to work without doing something too hackish. Obviously, the corporate AD could just add DNS records for admin.example.com to point to my domain, but looking for a more elegant solution. Port forwarding didn't work for the website (forward port 80/443 to website, all other traffic to AD for admin.example.com).

Another AD sysadmin suggested that setting DNS records in the corporate DNS as explained in this article : https://support.microsoft.com/en-us/kb/255913

Article seems dated, but it would leave admin.example.com alone for the website and theoretically allow AD servers to work properly with each other and the new corporate AD trust and AD domain clients would continue to work.

The article suggest that following records be added to the corporate bind DNS:

DomainDnsZones.admin.example.com. IN      NS      dc1.admiin.example.com.
DomainDnsZones.admin.example.com. IN      NS      dc2.admin.example.com.
ForestDnsZones.admin.example.com. IN      NS      dc1.admin.example.com.
ForestDnsZones.admin.example.com. IN      NS      dc2.admin.example.com.
_msdcs.admin.example.com.         IN      NS      dc1.admin.example.com.
_msdcs.admin.example.com.         IN      NS      dc2.admin.example.com.
_sites.admin.example.com.         IN      NS      dc1.admin.example.com.
_sites.admin.example.com.         IN      NS      dc2.admin.example.com.
_tcp.admin.example.com.           IN      NS      dc1.admin.example.com.
_tcp.admin.example.com.           IN      NS      dc2.admin.example.com.
_udp.admin.example.com.           IN      NS      dc1.admin.example.com.
_udp.admin.example.com.           IN      NS      dc2.admin.example.com.
Improve this question
7
  • 1
    If your corporate DNS is BIND-based DNS, it can be set up with different views for this domain so clients from certain subnets are brought to your AD - not sure if this is any helpful to you. Or have them set up conditional forwarding for this domain as you mentioned - but then of course the same public domain will no longer be resolved from within. I don't see any easy way to get around this. Depending on how important it is to have the ability of resolving that particular public domain, otherwise conditional forwarding is the easy/better way to go because the only otherway is domain rename.
    – strongline
    Oct 23, 2015 at 13:19
  • Thanks for your quick response. Sound like good ideas, I will have to check with the DNS administrators on that. What's your feeling about the article I put which suggests adding certain DNS records to get AD working. Would this still be relevant for windows 2008?
    – James
    Oct 23, 2015 at 13:30
  • 1
    I won't say it's not applicable to 2008, but I don't think it's applicable to your situation. That KB is for "integrating" AD/BIND, while what you need is just a simple forwarding from corp DNS for "admin.example.com". Any subzone underneath, including "_msdcs.*", "_sites.*" etc will be forwarded to your DCs for name resolution too. I don't see the need to individually add NS records for each subzone.
    – strongline
    Oct 23, 2015 at 13:48
  • Right I would prefer just using admin.example.com but the dns entries based on the KB seem to not require setting a dns A record for admin.example.com. I want to avoid overwriting the web owner's A record if possible.
    – James
    Oct 23, 2015 at 16:37
  • no way you can keep an A record as "admin.example.com" pointing to public website. In your DNS, you have to have it pointing to your DCs. In corp DNS, they just forward to you.
    – strongline
    Oct 23, 2015 at 16:42

1 Answer 1

Reset to default
1

[please also see comments above] If your corporate DNS is BIND-based DNS, it can be set up with different views for this domain so clients from certain subnets are brought to your AD - not sure if this is any helpful to you. Or have them set up conditional forwarding for this domain as you mentioned - but then of course the same public domain will no longer be resolved from within. I don't see any easy way to get around this. Depending on how important it is to have the ability of resolving that particular public domain, otherwise conditional forwarding is the easy/better way to go because the only other way is domain rename.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .