Using active directory for user management but not DNS

Question

In a rapidly growing company, we have a number of mostly linux servers (ubuntu and debian ), and we are moving to AD for user management, access control, etc.. I've set a test server up to authenticate against AD using realmd/sssd. As part of this process, following a guide/wizard, the AD server became an authoritative DNS server for our main public domain example.com (I hope I'm saying that correctly, it's new to me). But it created a DNS server for our main domain example.com with an SOA; I think it does this because it needs to send out an SRV record). However, we already have a dns server (using dnsmasq) that we use internally, and it has its own SOA, of course. Our domain internally is our main public domain.

Is this strictly necessary, and if not, how can I configure AD to forward all DNS requests for example.com to our internal nameserver, while still creating and broadcasting the SRV record, which I'm pretty sure is what makes realmd and/or sssd work.

Answer 1

This is a problem that can arise and it needs careful planning.

It is best practice to use a real existing DNS zone as your internal AD zone. This prevents conflicts with real-world external resources. As Esa suggests you can use a sub-domain to achieve this and this can help to prevent conflicts with, for instance, the public facing DNS you are running for your own public resources. You do not want your internal DNS to have different records to your public DNS for things like 'www.example.com'. This Microsoft article is a good overview of the 'split-brain' DNS scenario and how to handle it.

It is fully supported to not use the Microsoft DNS server when installing DNS. This Stack Overflow article explains in detail how to use an external (non-Windows) DNS to host all your AD zone information.

So, you should choose your main internal domain name carefully - probably avoiding 'example.com' if that is your main public-facing domain. Then you should choose whether the AD zone is going to be the same as this or different - perhaps a sub-domain, but this optional.

There is no absolute answer to what is best, but here is a suggestion:

example.com - public-facing zone example.net - internal zone (purchased from appropriate registrar) ad.example.net - internal AD zone

It is also possible that your question is answered by sharing the exact same zone for 'normal' internal use and AD use, and using your existing non-Microsoft DNS server.