I have a network with a lot of different subnets and VLANS. Some are specialized server zones, other are for clients or simple transit subnets. We use MS Active Directory, MS DHCP and MS DNS which all are cooperating as normal with hostnames automatically added from DHCP to DNS in their respective domains. Our servers are added in DNS statically as they do not use DHCP.

Our client and server zones are basically classified as either public, internal or secure. Naturally the traffic between these zones is very restricted. The clients and servers in the internal and secure zones are members of the same domain and there are co-hosted DCs and DNS located in each of these zones to handle the zone-local traffic. All DCs and DNS servers in the same domain synch with each others.

The issue we are seeing is that when a client or server using the internal zone DNS to resolve the domain (ex: ad.company.com) we also resolve the DCs in the secure zone and vice versa, the secure zone gets the internal DCs as well as the zone local.

Is there a way on MS DNS to reply to requests from the secure zone with only the addresses for that zone, and similar for the internal zone? I'm picturing a sort of ip-filter or a ruleset that can define that requests from ex gets and that gets as the resolved answer.

Splitting the domain to enable us to have separate domain names is not an option. Our systems are also very complex so we do not have a full understanding fo which systems requires authorative answers from DNS, so we really can't set up a disconnected DNS server which forwards to the domain.

Can anyone please give me some tips on how to work around this issue or resolve it in a good way?

Thank you!


The issue is not with windows-based services, but with third-party applications such as radius servers, applications and websites doing LDAP searches and authentications etc.


Since your DCs are all members of the same domain, doing a host lookup on the domain will round robin any of the records, whether they be in your secured or local zone. However, if you have created separate sites and associated the correct subnets in AD's Sites and Subnets MMC, then clients should be using the DCs in their respective zones/sites.

Are you seeing an actual authentication issue?

  • Thank you for your reply! No, we are not having windows authentication issues, but we do have some delays when servers try using LDAP, global catalogue and such. We are mostly having the issue with the third-party applications, not the windows services. – Canis Jun 24 '14 at 7:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.