I have a network with a lot of different subnets and VLANS. Some are specialized server zones, other are for clients or simple transit subnets. We use MS Active Directory, MS DHCP and MS DNS which all are cooperating as normal with hostnames automatically added from DHCP to DNS in their respective domains. Our servers are added in DNS statically as they do not use DHCP.
Our client and server zones are basically classified as either public, internal or secure. Naturally the traffic between these zones is very restricted. The clients and servers in the internal and secure zones are members of the same domain and there are co-hosted DCs and DNS located in each of these zones to handle the zone-local traffic. All DCs and DNS servers in the same domain synch with each others.
The issue we are seeing is that when a client or server using the internal zone DNS to resolve the domain (ex: ad.company.com) we also resolve the DCs in the secure zone and vice versa, the secure zone gets the internal DCs as well as the zone local.
Is there a way on MS DNS to reply to requests from the secure zone with only the addresses for that zone, and similar for the internal zone? I'm picturing a sort of ip-filter or a ruleset that can define that requests from ex 192.168.10.0/24 gets 192.168.10.10 and that 192.168.20.0/24 gets 192.168.20.10 as the resolved answer.
Splitting the domain to enable us to have separate domain names is not an option. Our systems are also very complex so we do not have a full understanding fo which systems requires authorative answers from DNS, so we really can't set up a disconnected DNS server which forwards to the domain.
Can anyone please give me some tips on how to work around this issue or resolve it in a good way?
The issue is not with windows-based services, but with third-party applications such as radius servers, applications and websites doing LDAP searches and authentications etc.