I'm in a quandary.

I need to implement Split-Horizon DNS in my office based on subnet. For example:

  • Users in need to resolve "srv01.extra.company.com" to
  • Users in need to resolve "srv01.extra.company.com" to
  • Others in need to resolve "srv01.extra.company.com" to

Now, this is easy to implement using BIND. Unfortunately, my network is based on Active Directory; I can't possibly change the DNS Servers of all workstation to just point to the BIND server, can I? They need to be pointing to Domain Controllers.

I had been playing with the idea of using stub zones or conditional forwarders, but based on my understanding, those methods will make the Domain Controllers to perform the DNS resolution themselves, instead of having the workstations contact the relevant nameservers.

What can you suggest to help solve this split-horizon problem?

Additional info:

  • The AD FQDN is actually id.company.com, not company.com.
  • I made a mistake on the IP addresses above. Fixed.
  • There is one (horrible) way of doing this - distributing the HOSTS file to clients. I really hope you find another solution. – pauska Feb 18 '14 at 7:56
  • Do you have BIND running already alongside the AD DNS? – Ryan Newington Feb 18 '14 at 8:57
  • @elrich00 not yet, but I can quickly set one up. – pepoluan Feb 18 '14 at 9:09
  • Is it just for the extra.company.com namespace with company.com being your AD Domain FQDN? Spill a little details about how the namespace is currently delegated and used, it might help us help you :) – Mathias R. Jessen Feb 18 '14 at 9:25
  • @MathiasR.Jessen edited. If you need more info, feel free to ask. – pepoluan Feb 18 '14 at 12:27

You almost got your solution by yourself.

I'm assuming that srv01.extra.company.com is a server in your own company, so your nameservers are responsible for it.

You are right in that you can't really use stub zones nor conditional forwarders, as the nameserver set up for this purpose will only see the queries originating by your AD DC's.1

But it's a common misconception that Active Directory must have set the DC's as it's nameservers, or that the clients need to resolve through the DC's.2

In this particular case, you would need to setup a proper BIND that cleanly resolves everything (that includes your AD!). After you have verified proper operation, you would add a zone extra.company.com to this server (effectively masking the real subdomain). In there, you can then override the records to your liking.

Do note however that when this BIND tips over, your whole AD will come to a halt, since all queries by your clients go through this server. So set up accordingly (failover, backup, standby, et al).

1 Technically, this doesn't hold true for every case: If the client's resolver is capable of following referrals, the authoritative nameserver would see the query originating from the client. However, since almost all OS resolvers are stub resolvers, this doesn't really apply.

2 You can safely set even the authoritative NS of your AD to BIND server, but it sure isn't some fire-and-forget solution, it needs some work; for example adding specific records and allowing your DC's to update these. Microsoft has this well documented, refer to this article in Microsoft's Technet for a start. I usually avoid this alltogether, and instead have company.com served by a BIND, and delegate a subdomain ad.company.com to the AD. I don't think it's worth the hassle doing that in a existing AD though, like in your case.

  • Actually, there are two domains (long story). The AD infrastructure is "id.company.com". I've updated my question. – pepoluan Feb 18 '14 at 12:28
  • So, this means the server is not 'inside' the AD? Even better. If everything is set up correctly, you can do the magic in the nameservers of company.com, and then just simply point your clients to those. Don't forget to test with a few clients first though. – Roman Feb 18 '14 at 12:32
  • Thanks! This Monday, I'm going to recruit some test subjects to participate in the experiment ;-) – pepoluan Feb 23 '14 at 21:22

If you want to stick with Windows DNS, the feature that might help you is called Netmask Ordering with Round Robin. When you configure multiple A records for the same host, DNS will return results with priority based on client IP address and subnet. You can define what part of the address mask is used for netmask ordering, and since in your case it is /16, you also need to override default value (which is /24) with

Dnscmd /Config /LocalNetPriorityNetMask 0x0000FFFF

Unfortunately, this will only cover the first two cases from your example, the third one will be tricky since only clients from 10.25.x.x will match the host mask.

  • I realized I made a mistake up there. Fixed. – pepoluan Feb 18 '14 at 12:28

If DNS is your only way of doing this, then I think your only real option here is to use BIND views.

AD workstations can point directly to BIND, as long as BIND forwards all requests for your AD domain to the AD DNS servers to resolve. We actually do this in the very large organisation I work for and everything works fine (dynamic updates, etc, included).

What service are these servers running? If they are HTTP you could possibly use something like HTTP redirects to bounce the user to their local server rather than using DNS splitting?

  • For complex reasons, we can't use redirects. Any guidelines on using BIND in front of the AD servers? Also, there are RODCs involved in branch offices. – pepoluan Feb 18 '14 at 12:29
  • All you should need to do is just setup conditional forwarding for id.company.com to your AD DNS servers. – Ryan Newington Feb 18 '14 at 20:22
  • Thanks for the pointers! I'm going to recruit some <s>victims</s> volunteers to test the new DNS arch out :-) – pepoluan Feb 23 '14 at 21:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.