About Microsoft Active Directory domains: Is it legal to have a domain with a name containing two (or more) dots? I.e., is "foo.bar.baz" a legal AD domain name? Is "dmz.foo.bar.baz" a legal AD domain name?

If an AD domain name with more than one dot is legal: Are there any problems regarding ADs with names that have more than one dot? I.e., are there potentiel problems related to having both an "example.com" and "dmz.example.com" domain (the two are to be completely separate trust-wise).

Clarification: The two domains have no inter-domain relation (a firewall separates them completely); each domain would have it's own set of DCs.


Yes they are.

No there isn't.


You can have as many dots as you want ie


What you're suggesting, in theory, would work, but may not be the best way to do what you are trying (ie I assume to seperate your DMZ completely from your main network). The dmz zone would also require it's own Domain Controller set up.

If they are in the same forest, if someone took the DMZ administrator, they could then control forest administartor, which would give them access to the rest of the forest anyway.

  • 1
    +1 - An AD domain can have as many "dots" as you'd like, however you should beware that Windows limits the FQDN of hosts to 254 characters. As Tubs points out, domains are not a security boundary. You don't say what you're trying to do, but mentioning 'dmz' in the posting makes some of us worry that you're trying to "isolate" some resources via "putting them in their own domain". Security isolation, in terms of AD, can only be accomplished by using separate AD forests. – Evan Anderson Jan 26 '10 at 17:55
  • It's also perfectly legal to create an AD forest with a name that is, itself, a subdomain of another AD forest. You will be able to interop between the two AD forests just fine, assuming that there's good name resolution at play everywhere. – Evan Anderson Jan 26 '10 at 17:56
  • Evan: It's the DNS protocol that limits FQDNs to 253 characters. It's nothing Windows-specific. – grawity Jan 26 '10 at 20:00

I think if dmz.example.com wasn't a strict subdomain of example.com, you're looking for problems. Even if it worked perfectly as a disjoint domain (which I doubt given the AD reliance on DNS namespace), it would only confuse other internal admins an contractor technical staff. I'd definitely fire you for it, because it would be very hard to undo.

  • 1
    Glad you're not my boss. – pavium Jan 26 '10 at 8:07
  • 1
    A server admin that hosed my company's AD would no longer be a server admin working for me. Help desk maye. Big mistakes get you fired. Welcome to the real world. – rmalayter Jan 26 '10 at 13:44
  • I agree at the helpdesk level I expect this type of mistake (which is why they wouldn't have access to perform this type of work). If an admin suggested this type of scheme they beter have a really really good reason for it or I'm going to wonder about their skillset, and no way would I allow it. – Jim B Jan 26 '10 at 14:20
  • @rmalayter If you have that kind of single-mistake firing, then it's your fault for hiring him. If you aren't going to practice some loyalty, don't expect employees to either. Welcome to the real world. – phoebus Jan 26 '10 at 15:03
  • 1
    What the heck are you guys talking about? The OP didn't ask anything about policy-related issues-- he just asked about the legality of using a given name for an AD namespace... yeesh! – Evan Anderson Jan 26 '10 at 17:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.