Let's say I have a web-server on my internal network which is behind a NAT router. I have my external DNS for the “xyz.com” domain configured with an A record for “foo” that points to my router's public address.

I want my internal network clients to resolve foo.xyz.com to the internal address.

However, this is the only xyz.com record that should point to an internal address.

Do I need to create a primary zone for xyz.com and mirror all the records from my external zone with the exception of “foo” (this is what I am doing now), or is there a better way?


Actually, it would be the other way around. What you'll want to do is add an authoritative zone to your server as foo.bar.com with the appropriate records. The server will see that it is authoritative for that hostname and use the local records. Everything else such as bar.com and www.bar.com would go out through the normal resolver.

  • This worked perfectly!!! – Corey Jul 15 '10 at 21:46

I think Justin is assuming that foo.bar.com is a domain, but based on your question, it sounds more like foo.bar.com is the FQDN of just your web server?

If I understand this correctly, what you want to do is have your external DNS server have all the records for bar.com, and your internal DNS server only the record for foo.bar.com, and somehow forward all requests for any other record in bar.com to your external DNS server for resolution?

If that's true, then no, there's no way to do that in the MS DNS Server (2000-2008 versions). To have any records for bar.com, the server has to be authoritative for bar.com, and if it's authoritative then it will always respond to a request for a bar.com record it doesn't have with a "no such record" response, rather than doing some kind of recursive query.

There are other DNS servers that have this feature (maraDNS) but I believe it violates the RFCs, so it won't be there in any mostly RFC compliant DNS server.

In short, your current method (mirroring all the records except this one internally and externally) is the best/only way to make this split-brain configuration work with the MS DNS Server.

  • yes, foo.xyz.com is a host, not a sub-domain but would Justin's method technically work? – Corey Jun 14 '10 at 23:24
  • Yes. You can configure foo.bar.com as an authoritative zone with a single address record for the base "domain" (which in this case would be foo.bar.com) with the IP that you want to direct it to. The local DNS server doesn't care what you consider the host to be, only what you tell it it's authoritative for. – Justin Scott Jun 18 '10 at 15:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.