1

I have a few clients that need to sit across two otherwise separate networks. Let's call them network A (10.0.0.1) and network B (1.2.3.4).

Network A is effectively a private network; any Internet access on network A needs to go through a proxy.

I have configured routing such that traffic for 10...* will go through network A, and everything else will go through network B.

However, some private services on network A only exist in network A's private DNS - a lookup on network B will not resolve them. So even though the traffic could be routed to the right network, it won't be able to find the right network since the server doesn't exist in the public DNS.

Is it possible to configure Windows 7 to use one DNS server for certain lookups (e.g. all domains ending in example.private.lan), but use a different server for everything else?

Improve this question

2 Answers 2

Reset to default
1

No. This is not configurable at the DNS client. You must employ split-horizon DNS service. In the case of using Microsoft's DNS server for this, when the internal content DNS server is not yours, you must have a non-public proxy DNS server with either "stub zones" or conditional forwarding. In general, one should always employ "split horizon" DNS service if one is using non-public IP address ranges.

Improve this answer
5
  • Just to add: If multi-homing is an option, you can run dissimilar DNS on different adapters, as long as there's no overlap in zone contents and authority.
    – TristanK
    Jun 14, 2011 at 13:22
  • ... which of course won't work. Aside from the fact that the behaviour of the DNS Client with respect to preferred and alternate DNS servers isn't straightforward, there's the fact that of course a negative answer from the "wrong" proxy DNS server will be accepted as-is, and won't cause fallback to another adapter's proxy DNS server. The correct thing continues to be to use a proxy DNS server properly configured to send the query to the right place according to the QNAME, because the DNS Client will not do so, multiple adapters or no. It performs no such differentiation.
    – JdeBP
    Jun 14, 2011 at 13:53
  • On your client resolver comment - check again. It's the false positives you have to worry about. I don't disagree with the "correct" approach, but the other one works too. Multi-adapter DNS resolver behaviour is documented on technet.
    – TristanK
    Jun 14, 2011 at 22:25
  • There is no overlap; TristanK - you are right; the client tries the lookup on the first adapter, if that returns negative, it tries the second and so on. Which solves my problem. Thanks!
    – askvictor
    Jun 15, 2011 at 0:23
  • TristanK, you should actually go and read the TechNet documentation that you are pointing to. It tells you exactly what I'm telling you. There's no differentiation by QNAME mechanism. The DNS Client simply does not have the mechanism that is necessary for making this work. And answers from the "wrong" proxy DNS server are accepted as-is, be they positive or negative. This is a problem for both, but the negative is more common for obvious reasons. The system does not operate on negative answers as askvictor and you say. You should read the doco. It will inform.
    – JdeBP
    Jun 18, 2011 at 15:26
0

I agree with ErikA.

"Is it possible to configure Windows 7 to use one DNS server for certain lookups (e.g. all domains ending in example.private.lan), but use a different server for everything else?"

The answer is no. The solution is to allow the two DNS servers to have each other's zone, and allow zone transfers.

Improve this answer
6
  • Not possible to transfer zones. Will have to continue the research...
    – askvictor
    Jun 14, 2011 at 5:21
  • -Why can't you?
    – KCotreau
    Jun 14, 2011 at 5:29
  • You could also try using forwarders.
    – KCotreau
    Jun 14, 2011 at 5:33
  • KCotreau: because I don't own the DNS servers
    – askvictor
    Jun 14, 2011 at 5:35
  • I guess creating my own forwarding DNS server would be a possibility, but that wouldn't tie in with DHCP for the other networks :-/
    – askvictor
    Jun 14, 2011 at 5:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .