I work for a company with a split DNS configuration on the AD domain. I know that this is less than ideal, but I'm not in a position to drive change in this area. I own authoritative DNS (internal and external) where Active Directory is not involved, and another team owns the domain controllers.
- We have a split domain called
example.comwhich lives on all the domain controllers.
- The DCs are configured to use forwarders for all domains that they are not authoritative for.
- There is a subdomain of that (
sub.example.com) that is delegated to public IP addresses in a DMZ using
NSrecords. I have a need to eliminate these IP addresses use internal IP addresses that are outside the DMZ.
- The new IP addresses are reachable from the forwarders, but not the domain controllers.
To represent this visually:
example.com. (DCs are authoritative) sub.example.com. (subdomain not managed by the DCs)
I would like to have the
sub.example.com. NS records converted to a conditional forwarder that sends traffic along to the standard forwarders, but I am being told by our domain admins that Windows DNS will not allow a forwarder within a forward lookup zone.
Is it true that this is an unsupported configuration? Other DNS products have no problem with a forwarder that is beneath an authoritative zone, so I want to make sure I'm working with the correct information before I move on to a different strategy, such as firewall holes for every DC that bypass the forwarders. (argh)
I've already reviewed Forward requests for subdomain to another DNS server in Windows 2k3 and the accepted answer that recommends a
NS delegation, which doesn't answer this question.