1

Say we have an active directory domain corp.mycompany.com and a public DNS domain mycompany.com. Is it possible to create an AD integrated DNS zone for mycompany.com and only host records we need to resolve differently internally vs. external?

For example if we want only smtp.mycompany.com to resolve to private IP internally, so we create a mycompany.com zone in AD and create a single A record for smtp pointing to internal IP. When testing this, our domain clients will properly resolve smtp.mycompany.com to private IP, but will be unable to resolve any other A records unless we create them in the AD integrated zone. We would like any records which dont exist on the AD integrated zone to resolve using our public DNS records. I am told this is called split-horizon DNS in the unix world, is there a counterpart in the windows world?

Thanks in advanced

1 Answer 1

5

When you configure an authoritative zone for mycompany.com on your domain controllers, they will always answer authoritatively for queries within that zone - so, it won't work the way you're envisioning. (Split horizon refers to simply having a different version of a zone for certain networks, not a mechanism to override only a subset of records in a zone)

If you don't have too many records you're looking to override, though, you could approach it differently; create smtp.mycompany.com as a DNS zone in AD, then create the overriding record at the root of that zone. This way, the authoritative smtp zone will answer from the domain controller, while other records will go to the public lookup.

Often, having a split like this is more trouble than it's worth, and it might be a good idea to work toward having the "inside" be its own subdomain, like lan.mycompany.com, letting mycompany.com be dedicated to public use.

2
  • Split brain DNS is very common and required for many federation purposes. Attempting to use multiple namespaces is incredibly painful to back out of in these situations. I think what you meant to say is let mydomain.com be used for non-internal assets and publish corp externally for internet access to internal resources.
    – Jim B
    Dec 15, 2015 at 0:34
  • Thank you for the answers. I should have thought of that, creating a smtp.mycompany.com zone. We ended up asking our networking folks to make it so internal machines can reference other internal machines via their public NAT IP, which made it so we no longer needed it to resolve to private. Good to know it's possible though.
    – floyd
    Dec 16, 2015 at 0:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .