2

I'm currently beginning to plan a small Active Directory deployment and I've run into the following issue.

The AD domain is example.com (the same as our public facing website) and the problem is that when I try to access any address like address.example.com that is defined in the Windows Server DNS everything works perfectly, but when I want to access the public facing website (example.com) the Windows Server DNS is returning the DC address.

How can I modify the DNS configuration in Windows Server so that the when someone requests a *.example.com that has no A or CNAME record on the server it gets forwarded to an Internet DNS server?

Thanks

EDIT: Forgot to mention that I deleted the A record for example.com in the Windows Server DNS.

Improve this question

5 Answers 5

Reset to default
3

There is no easy way to do that with a clashing domain. Generally you should pick between subdomain.example.com or example.local to avoid this sort of problem

Improve this answer
2
  • You mentioned there is no easy way, is there a hard way?
    – Carlos G.
    Commented Apr 4, 2011 at 1:02
  • You can add A records pointing to the correct IPs and manually update them.
    – JamesRyan
    Commented Apr 4, 2011 at 9:48
2

If you aren't too far in, your best option is to tear down your internal example.com domain and switch it to either example.local or internal.example.com. This way you won't have any internal DNS servers thinking that they authoritative for the something.com domain.

If re-doing your domain is not an option you could create A records with the external IPs for all the External example.com subdomains:

A abc.example.com 1.1.1.1

Improve this answer
1

We got around the problem by putting IIS on the domain controller. Then we set it to redirect all requests on the default website to www.example.com. Since www.example.com will resolve correctly (from both inside and outside our network), everyone works great. This is accomplished in IIS by looking on the Home Directory tab in for the site. In the The content for this resource should come from: area select the radio button labeled A redirection to a URL.

If you're already using IIS on the domain controller for other reasons (for example, your dc is also your print server and you use the internet printing tool in IIS), the set up is a little more complicated. You have to distinguish the default web site from other web sites for whether or not to do the redirect.

Improve this answer
2
  • Seems like this worked. But, putting IIS, or print services on a domain controller is a really bad security practice.
    – Appleoddity
    Commented Aug 16, 2023 at 12:19
  • @Appleoddity Yep... we've long since removed the print services from the domain controller and replaced IIS with a different light-weight web service that only knows how to do this one redirect.
    – Joel Coel
    Commented Aug 18, 2023 at 19:22
1

What you are really looking for is DNS Response Policy Zone. It is supported by BIND9 DNS server. We had it working in previous job. You provide DNS answers for all defined records inside of the DNS RPZ and for anything else you forward to public DNS. In other words you avoid being authoritative for the DNS zone. It allows you to create all sorts of policies so it can be used as DNS firewall too.

Improve this answer
0

You've set up split-horizon DNS service. You may not realize that you've done so, but done so you have. When one has set up split-horizon DNS service, one needs to populate the internal server's DNS database with appropriate data. As the Frequently Given Answer says, there are two approaches to doing that.

The one corner case when Active Directory is involved is the apex of the pruned part of the DNS namespace, because Microsoft Windows Domain Controllers dynamically register their own IP addresses as the domain name. Again, the Frequently Given Answer shows how one can approach that.

Improve this answer
1
  • Links in the comment are dead - link posts are not particularly useful for this reason.
    – Taz
    Commented Oct 17, 2016 at 5:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .