0

Some background information first. We run a split horizon dns setup. So publicly entry.ourdomain.com goes to 123.123.123.123 (Public Address) and internally, entry.ourdomain.com goes to 10.1.1.1 (Internal Address). The zone for ourdomain.com is integrated into AD for replication. For this problem, we have two sites, siteA and RemoteSiteB. The two are connected via a site-to-site vpn so users can access both internal and external addresses.

What we want is to have users in RemoteSiteB go to the public address for particular entries on our domain, but only in that site.

Is there any way to achieve this without putting the zone back to an non integrated AD one? Doing so looses all the replication features.

Servers are all 2008R2 in case that makes any difference.

Edits for clarity. This is the DNS responses I'm looking to achive

SiteA DNS:
entry.ourdomain.com -> 10.1.1.1
entry2.ourdomain.com -> 10.1.1.2

RemoteSiteB DNS:
entry.ourdomain.com -> 123.123.123.123
entry2.ourdomain.com -> 10.1.1.2

3
  • There's no way to do what you're looking for and maintain an Active Directory integrated zone for ourdomain.com. This is yet one more example of why using the same name for your AD domain and Internet DNS is a bad idea (and discouraged by Microsoft). Mar 1, 2011 at 14:57
  • Our domain is not our AD domain, we just hold our public domain name inside our AD DNS servers for the split-horizon setup.
    – Ryaner
    Mar 1, 2011 at 15:22
  • Oops! My apologies for the bad assumption. That changes everything and makes it very possible to do just what you did... >smile< Mar 1, 2011 at 21:17

2 Answers 2

2

I would recommend putting the zone back to non integrated and using forwarders to achieve what you want. In this scenario you can still keep 1 record of the zone that every site can use.

In the example.

SiteA
ourdomain.com - NS for the zone - AD replicated
entry.ourdomain.com - NS for the zone - no replication

SiteB
ourdomain - NS for the zone - AD replicated
entry.ourdomain.com - forwards to the internet DNS server
subdomain.entry.ourdomain.com - forwards to site A
ourdomain.com - forwards to site A
anyotherrecord.ourdomain.com - forwards to site A

Setting up forwards in DNS is very easy http://technet.microsoft.com/en-us/library/cc754941.aspx

Alternatively, you could use a secondary DNS server in site B that everyone used, but that sounds a bit silly for your purpose, or host files on local machines, but that might be a bit silly as well.

Also, it may be you do not want to have a single copy of the DNS records, in that case you could use a secondary DNS server in Site A or Site B that was also a nameserver for the domain, and you can configure 2 forwarder address for redundancy.

If you have trouble with the forwarders please comment so I can provide more info.

Hope this helps you.

4
  • entry.ourdomain.com is an A record. So I assume it will use the local A record ahead of any forwarders that are configured?
    – Ryaner
    Mar 1, 2011 at 15:23
  • ok, so what you want to do there is create a zone in site A that is not AD integrated for example.ourdomain.com, make it Non AD integrated. delete the A record first. Then you will have the example.ourdomain.com hosted on your DNS server in site A but not replicated to site B. Then in the new non integrated zone create an A record with the same value for the one you deleted. In site B after replication completes it will detect the A record has been deleted. Then create a forwarder for entry.ourdomain.com to point to the internet for resolution. This is called conditional forwarding.
    – pablo
    Mar 1, 2011 at 15:44
  • btw make sure to have backups just in case, DNS is VERY important. Also do it in the off hours if temporarily breaking the DNS for example.ourdomain.com will be disruptive. I have a similar config setup in my environment and it works great.
    – pablo
    Mar 1, 2011 at 15:46
  • Some testing shows this could work. 2008 has renamed forwarders to conditional forwarders which is where I got confused. (technet.microsoft.com/en-us/library/cc794735%28WS.10%29.aspx)
    – Ryaner
    Mar 1, 2011 at 16:05
0

Wanted to give a clear answer of the solution we've established based on the answer from pablo.

ourdomain.com - AD integrated Domain

In the DNS of RemoteSiteB, we added a subzone for entry.ourdomain.com. Inside of this zone, we added the blank A record for the public address we are directing traffic to.

This way all the replication from the primary server is being handled and the individual entries are being overridden where required.

1
  • 1
    glad it worked :)
    – pablo
    Mar 1, 2011 at 19:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .