2

I have the following scenario:

  • A brand new ADDS domain from a single PDC+DNS.
  • The FQDN of the domain matches our public website name (webname.com).
  • The gateway dictates the PDC/DNS as the first DNS resolver. The secondary DNS is a public entity like 8.8.8.8 from both gateway and the PDC.

With this we get errors navigating to our website tld.com. This makes sense because the PDC has a forward lookup zone for webname.com and custom A records, etc.

The problem: DNS records like our MX record will not resolve on the internal network now unless created in the PDC/DNS entries. If we do not declare the PDC as the first DNS resolver we have trouble joining domain and resolving hostnames internally.

I could manually clone all the records in place and maintain two copies, but is there a better way? I still need the local PDC/DNS to handle DNS internally for FQDN device names (device.webname.com) but I want all other DNS requests to head out to the web otherwise so that public DNS record changes are recognized internally without manual duplication. Is there an elegant way to do this?

I tried adding secondary name servers on the PDC to point at the public DNS NS but that didn't seem to make any difference. Testing using nslookup from inside the network shows me that I'm not touching the external NS still when looking for an MX record for example.

Thank you.

Improve this question
2
  • Have you reconsidered renaming one of the resources?
    – vidarlo
    Dec 28, 2022 at 16:45
  • 1
    Agree with @vidarlo, since this is "brand new" create a domain with the correct naming structure xx.domain.com. Also you should never use external DNS internally as a secondary or tertiary DNS, that is a DNS worst practice.
    – Greg Askew
    Dec 28, 2022 at 17:12

1 Answer 1

Reset to default
4

Because you have...

A brand new ADDS domain from a single PDC+DNS.

...there indeed is a better way. It is not too late to change the AD domain name to meet the Best Practices for Internal Domain and Network Names. Do not use your external example.com for your AD domain, but use a subdomain like ad.example.com, instead.

The short answer, as best practice:

  • Microsoft strongly recommends that you register a public domain and use subdomains for the internal DNS.
  • So, register a public DNS name, so you own it. Then create subdomains for internal use (like corp.example.org, dmz.example.org, extranet.example.org) and make sure you've got your DNS configuration setup correctly.

The article also lists the disadvantages from using a single namespace (for internal and external hosts).

We also have a canonical question for Windows Active Directory naming best practices.

Improve this answer
1
  • Thank you. I will amend the error of my ways.
    – TechnoNewbie
    Dec 29, 2022 at 15:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .