I have an internal DNS server and a router. I can never figure out what I should set as my Primary and Secondary DNS on the router and dns server.

Let's say my internal DNS server is and my router is This is what I have setup. Is this right? It works, but not sure if it's the most efficient.

Router Primary - Secondary - #public dns server

Internal DNS Server Primary - Secodary -

  • Do you have an active directory domain? – mrdenny Dec 7 '10 at 21:58
  • no it's not active directory, but I have an internal DNS because I'm hosting some public facing services that I need access to and I want to be able to get to them via a DNS entry. – Micah Dec 7 '10 at 22:12
  • For the Internal DNS Server, you should set the Secondary with the public DNS server, except if your router is a DNS server (almost never) – Kedare Dec 7 '10 at 22:57
  • @Kedare, so point my router to my internal dns only and then my internal dns server point to for primary and for secondary? – Micah Dec 9 '10 at 17:11
  • Yes, it should works like this. – Kedare Dec 9 '10 at 17:48

The short answer, IMO is that your internal clients should only point at your internal server and nothing else. If you have lots of internal clients you need to setup a second server.

Your DNS server should probably be pointed at itself only in the client settings. In your DNS server software you can setup forwarders if you want requests that are not answered by your internal server to be directed at another resolver instead of starting a recursive lookup from the root.

Unless your router is doing content filtering I suspect the DNS settings there don't matter at all. Low end routers don't really do much with DNS. If your router does need DNS, and does need to see your internal view, then you should set it to point at your internal DNS server(s) only.

To explain why internal clients should only point at internal DNS.

When a DNS client does a lookup, it will consult one of its DNS servers, once a response is received, positive or negative, the client is done. Other configured DNS server will only be used if the first one does not respond at all, or responds with a failure.

Here is a scenario:

  • If you have a zone on your internal server and nowhere else
  • your client is configured to point at both and internal and some public DNS server

If your client makes a request for an internal record and the external server responds first, then the client will believe the no record exists and report a failure to the user. If the the internal server responds first then the client will be happy.

In this situation it is probably better to only point at the internal server, that way you can only get a valid response.

| improve this answer | |
  • I didn't know about forwarders. That's the trick!! – Micah Dec 9 '10 at 17:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.