I have an internal DNS as part of my AD setup. I have an hosted DNS for public resources (which are typically at some data centre somewhere)

Occasionally while on our internal network I need to get to a public resource --- for example www.ourcompany.com since there isn't a www record in our internal DNS I cant get the name resolved.

How do I configure my DNS to forward names it doesn't recognise to the public DNS.

Update: As per the comment yes I have a "split-horizon" dns (which seemed like a good idea at the time) This AD setup is less than 24 hours old, and can be redone if need be -- (although I would rather not)

  • 4
    Do you have a split-horizon DNS? Is your AD namespace ourcompany.com as well as your public facing zone? – MDMarra Sep 20 '12 at 14:35

It sounds like you have split-horizons DNS, where your AD namespace and public-facing namespace are the same. If this is the case, you'll need to make an A record for www in your internal AD zone and set the correct external IP. Without this, internal clients won't be able to resolve it. This is because you have two sets of servers with disjoint information that are both authoritative for your DNS zone.

This is the exact reason that Microsoft recommends using an unused third-level domain name for your AD namespace. For example, if you own mycompany.com and you host public websites on it, you should use something like corp.mycompany.com or internal.mycompany.com for your Active Directory namespace. If you can do a domain rename (i.e. you have a simple client/server infrastructure with no Exchange in the domain), you should look into it. If you can't do a domain rename to fix this, you're in for some headaches.

Edit: Per your update, you should absolutely redo this since the install is only 24 hours old. Absolutely no doubt about it. Having a split-horizon DNS situation is never a good idea when it can be avoided. You can still have mycompany.com be the NetBIOS name of the domain, so users see MyComapny\User instead of something like Corp\User, but the FQDN of your AD namespace and the FQDN of your public facing DNS namespace should not be the same.

  • I have a split-horizons setup as well. We had DNS configured where external site was working fine. But we changed hosting companies and the new address from external host doesn't load the site directly they must be doing host based resolution. So we add an A record with the IP address and a CNAME but we can't get to the site from inside our network. – Tigran Jan 16 '17 at 21:23

Go into your DNS Management Snapin. Right click on the DNS server you are managing. Select the "Forwarders" Tab and enter the DNS servers you want to forward requests to.

enter image description here

  • This won't work if there is split-horizons DNS, which it sounds like. – MDMarra Sep 20 '12 at 14:36
  • Yeah . I was thinking that, but went with the simple answer. – Mike Sep 20 '12 at 14:38
  • 2
    A Windows Server 2008 DNS server which is not configured to use forwarders will use the root hints. This is the default configuration when you install the DNS role. No steps beyond installing the role need to be taken in order for Windows Server 2008 DNS to resolve queries for external DNS records. Configuring forwarders is a choice, not a requirement. – joeqwerty Sep 20 '12 at 14:44

Your internal zone matches your external zone, right? So company.com is your internal AD zone and your external public zone? If that's the case then it can't be done with Windows Server DNS, that I'm aware of.

The Windows DNS server is authoritative for the zone as far as it's concerned so it's not going to forward requests for the zone to another DNS server, even if the request is for a DNS record that doesn't exist.


It should in principle be fairly simple to create a PowerShell, VBScript or other tool that periodically queries an external DNS server, reads the external DNS IP addresses for given hosts, and updates them accordingly on the internal Windows server.

I have looked several times but have yet to find one, and am disinclined to write it myself.

  • for what hosts, though? Isn't that the point of the question? He needs to have unanswerable queries sent onward to another DNS server... so he cannot know what to "periodically query" until the query comes in. – Watki02 Mar 7 '16 at 20:14

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.