vote up 3 vote down star

After experimenting with domains and domain controllers in a virtual environment I realized that having an AD domain named identically to a... well, DNS domain is bad idea (I mean, we have foo.com as our website, so foo.com as a AD domain name is no good). This has only reassured me in my conclusions.

What are your recommendations on naming AD domains?

flag
60% accept rate

3 Answers

vote up 5 vote down check

This has been a fun topic of discussion on Server Fault. There appear to be varying "religious views" on the topic.

I agree with Microsoft's recommendation (see http://technet.microsoft.com/en-us/library/cc738121%28WS.10%29.aspx): Use a sub-domain of the company's already-registered Internet domain name.

So, if you own "foo.com", use "ad.foo.com" or some such.

The most vile thing, as I see it, is using the registered Internet domain name, verbatim, for the Active Directory domain name. This casues you to be forced to manually copy records from the Internet DNS (like "www") into the Active Directory DNS zone to allow "external" names to resolve. I've seen utterly silly things like IIS installed on every DC in an organization running a web site that does a redirect such that someone entering "foo.com" into their browser would be redirected to "www.foo.com" by these IIS installations. Utter silliness!

Using the Internet domain name gains you no advantages, but creates "make work" every time you change the IP addresses that external host names refer to. (Try using geographically load-balanced DNS for the external hosts and integrating that with such a "split DNS" situation, too! Gee-- that would be fun...)

Using such a subdomain has no effect on things like Exchange email delivery or User Principal Name (UPN) suffixes, BTW. (I often see those both cited as excuses for using the Internet domain name as the AD domain name.)

I also see the excuse "lots of big companies do it". Large companies can make boneheaded decisions as easily (if not moreso) than small companies. I don't buy that just because a large company makes a bad decision that somehow causes it to be a good decision.

link|flag
But then NetBIOS name of the domain is not... well, pretty :) corp is not as descriptive as foo. – Anton Gogolev Oct 21 at 13:26
3  
You can assign whatever NetBIOS name you want, though. Many of my Customers have names like "ad.example.com", but the NetBIOS name is "EXAMPLE". DCPROMO will prompt you for what you'd like the NetBIOS name to be during creation of the domain. – Evan Anderson Oct 21 at 13:32
@Evan: That's brilliant! Thank you! – Anton Gogolev Oct 21 at 13:34
2  
if you do this watch out for problems with domains that have wildcards. When you have *.foo.com, host.internal.foo.com will match it in some situations – EK Oct 21 at 15:12
vote up 1 vote down

I always use the same domain name internally as I do externally. If you implement split-DNS it is a piece of cake.

Here's an article (albeit for ISA but it still applies) that explains split DNS:

http://www.isaserver.org/tutorials/You%5FNeed%5Fto%5FCreate%5Fa%5FSplit%5FDNS.html

Basically, as long as you statically create records internally that point to www or ftp or similar "externally hosted" hosts on your domain then you'll be just fine.

For example, let's say you have "mail.foo.com" as your Exchange server. You can have internal clients on your LAN resolve to mail.foo.com with the internal IP. You can have external clients resolve to it (for SMTP or OWA, etc.) using the external record and then your firewall will redirect the traffic accordingly (after proper setup).

My main reason for doing it this way? I've found it so much simpler to explain to end user's their email addresses, login IDs, sip ID's for Office Communicator, etc. by saying "it's the same as your email address".

link|flag
1  
Utterly vile. Why would you create a maintenance nightmare? – Evan Anderson Oct 21 at 13:19
1  
what nightmare? It's never an issue at all. It didn't require any effort more than a .local setup would. – TheCleaner Oct 21 at 13:21
1  
You never have to hand-duplicate records from an external DNS zone into a ".local" zone. Perhaps you never change the IP addresses that "external" hostnames refer to. To my mind, requiring something to be done when those change, to no other advantage, is just creating make-work for no good reason. – Evan Anderson Oct 21 at 13:23
1  
What these methods listed here say to me is, if I was forced (at gunpoint) to use the same internal and external domain, here is how to get round it, rather than here are some ways to do this, because its the best way to do it. I agree with evan the using your external domain for AD will cause problems, most likely later down the line when you can't change anything – Sam Cogan Oct 21 at 13:39
2  
I think "vile" is too strong a word here. We have both schemes in operation here and split brain is not a nightmare ... just another maintenance item. And politically, I am in the same boat as TheCleaner ... it was WAY easier to explain this to exec's. – echobeach2 Oct 21 at 13:40
show 3 more comments
vote up 0 vote down

Another option we are using is mycompanyCORP.com so you are not in the mycompany.com space yet not incurring the confusion of a 3-layer name.

link|flag

Your Answer

Get an OpenID
or
never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.