Suppose you have a small windows domain configured as follows:

  • domain name is ad.example.com (as per these guidelines)
  • DC1 is at
  • DC2 is at
  • DC1 and DC2 are running the AD-integrated DNS and DHCP Server roles
  • AD DHCP is configured with an address pool from
  • AD DHCP is issuing client leases with the 006 DNS Servers option set to the addresses of DC's running AD-integrated DNS (i.e. and
  • AD-integrated DNS servers have google's configured as a forwarder
  • the subnet is connected to the internet via a Cisco ASA with internal address
  • the ASA is the gateway for the network
  • vpn.example.com is a public DNS entry that resolves to the external IP address of the ASA
  • Remote Windows computers connect to the network through the ASA using the Cisco IPSec VPN Client pointed at vpn.example.com
  • the Remote Windows computers are issued IP addresses from
  • split-tunneling is enabled such that only traffic is tunneled (the highest available upstream bandwidth at this site is only 2Mbps)

For Windows laptops that sometimes connect via VPN, how should their DNS be configured?

If a mobile Windows laptop just accepts a random public DNS server address, it will send DNS queries for _ldap._tcp.site._sites.ad.example.com to the random public DNS server when the tunnel is not active. Is this standard practice? Somehow that seems like a bad idea.

On the other hand, if a Windows laptop is configured with only the internal DNS servers and (as sternly recommended here) then the VPN Client cannot resolve vpn.example.com to make the VPN connection -- it's a chicken-and-egg problem.

Is there something fancier that ought to be going on with DNS on the Windows laptops connecting by VPN?

How much control does a VPN client have over Windows DNS lookups? Should DNS split tunneling be enabled?

Enabling DNS split-tunneling seems to mean we're relying on the VPN Client to intercept DNS queries like _ldap._tcp.site._sites.ad.example.com to prevent them from being sent to the public DNS server. Is the DNS split-tunneling in VPN clients strict and reliable? For that matter, it seems like some applications might just ignore the VPN adapter altogether and attempt to resolve Windows domain addresses using the public DNS server on the physical adapter. Is this something I should be concerned with?

The other option -- sending all DNS lookups through the tunnel to the AD-integrated DNS servers -- seems like a bad idea for two reasons: 1) The tunnel is likely to be much higher latency than a public DNS server when the user is many hops from the ASA. 2) It seems like names will resolve to IP addresses that correspond to servers in close proximity to the ASA rather than the remote computer. If I understand this correctly, that means problems accessing media on CDNs. (Edit: Here's an example of someone experiencing just this problem.)

  • Do you require vpn.example.com to resolve to an internal IP address internally? Is your ASA only a VPN endpoint, or is it also your gateway? Mar 12, 2014 at 4:02
  • @RobbieCrash vpn.example.com does not need to resolve to an address internally. The ASA is also my gateway.
    – alx9r
    Mar 12, 2014 at 16:51

1 Answer 1


For Windows laptops that sometimes connect via VPN, how should their DNS be configured?

The Network Adapter should be configured with DNS local to itself, either ISP or Home Router DNS. The VPN Adapter should receive the AD DNS servers via DHCP you have listed when connecting to the VPN. In addition, DHCP should be handing out the default domain name (domain.local) to support the answer to your next question:

How much control does a VPN client have over Windows DNS lookups? Should split tunneling be enabled?

Using fully qualified dns names (FQDN) from the remote laptop will ensure the request is associated with the VPN adapter and sent to the DNS servers on that adapter. If you rely on just hostnames then your laptop will want to use the Network Adapters DNS servers.

Using split-tunneling is a matter of security preference. With it enabled, it is possible for the laptop to access both their local network and the VPN simultaneously where there are endless possibilities for compromise. With split tunneling turned off, the laptop cannot access TCP/IP on the physical adapter and so will lose access to network printers and shares while maintaining a 'tunnel' just to the VPN endpoint.

  • Hopefully not domain.local, if the OP read the other answer that he linked to in his opening bullet :)
    – MDMarra
    Jun 21, 2015 at 2:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.