I'm currently beginning to plan a small Active Directory deployment and I've run into the following issue.

The AD domain is example.com (the same as our public facing website) and the problem is that when I try to access any address like address.example.com that is defined in the Windows Server DNS everything works perfectly, but when I want to access the public facing website (example.com) the Windows Server DNS is returning the DC address.

How can I modify the DNS configuration in Windows Server so that the when someone requests a *.example.com that has no A or CNAME record on the server it gets forwarded to an Internet DNS server?


EDIT: Forgot to mention that I deleted the A record for example.com in the Windows Server DNS.


There is no easy way to do that with a clashing domain. Generally you should pick between subdomain.example.com or example.local to avoid this sort of problem

  • You mentioned there is no easy way, is there a hard way? – Carlos G. Apr 4 '11 at 1:02
  • You can add A records pointing to the correct IPs and manually update them. – JamesRyan Apr 4 '11 at 9:48

If you aren't too far in, your best option is to tear down your internal example.com domain and switch it to either example.local or internal.example.com. This way you won't have any internal DNS servers thinking that they authoritative for the something.com domain.

If re-doing your domain is not an option you could create A records with the external IPs for all the External example.com subdomains:

A abc.example.com


We got around the problem by putting IIS on the domain controller. Then we set it to redirect all requests on the default website to www.example.com. Since www.example.com will resolve correctly (from both inside and outside our network), everyone works great. This is accomplished in IIS by looking on the Home Directory tab in for the site. In the The content for this resource should come from: area select the radio button labeled A redirection to a URL.

If you're already using IIS on the domain controller for other reasons (for example, your dc is also your print server and you use the internet printing tool in IIS), the set up is a little more complicated. You have to distinguish the default web site from other web sites for whether or not to do the redirect.


You've set up split-horizon DNS service. You may not realize that you've done so, but done so you have. When one has set up split-horizon DNS service, one needs to populate the internal server's DNS database with appropriate data. As the Frequently Given Answer says, there are two approaches to doing that.

The one corner case when Active Directory is involved is the apex of the pruned part of the DNS namespace, because Microsoft Windows Domain Controllers dynamically register their own IP addresses as the domain name. Again, the Frequently Given Answer shows how one can approach that.

  • Links in the comment are dead - link posts are not particularly useful for this reason. – Taz Oct 17 '16 at 5:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.