I have Windows Server running DHCP, DNS AND AD DS. After setting up AD DS and DHCP it was time to set DNS with external IP address. Which is x.x.x.x, domain.eu. DC is obviously name of domain controller.

Then I used dnsquery.org to check if DNS is working correctly but then I saw that it also returns local IP's.

Can you advise how I can hide that records from displaying then from internet. I tried to delete them, but then they are returning.

domain.eu. 3600 IN SOA dc.domain.eu. hostmaster.domain.eu. (59 900 600 86400 3600)
domain.eu. 3600 IN NS dc.domain.eu
domain.eu. 3600 IN NS ns1.domain.eu
domain.eu. 3600 IN NS ns2.domain.eu
domain.eu. 600 IN A
domain.eu. 3600 IN A 
dc.domain.eu. 3600 IN A
dc.domain.eu. 3600 IN A
ns1.domain.eu. 3600 IN A x.x.x.x
ns2.domain.eu. 3600 IN A x.x.x.x
  • 2
    Woah why? Never expose your DCs to the Internet, and never host public DNS on the same servers that you host internal DNS on. This is a terrifying configuration that you've implemented here - unwind this as soon as possible. – MDMarra Jul 18 '15 at 12:55
  • That's just a test server for educating myself.. no problem there all runs on virtual machines, Main thing is there anything I can do to stop DNS from returning local ip's ? – rdsklld Jul 18 '15 at 13:51
  • 3
    Don't do it this way. Don't even try. Your public DNS infrastructure should be isolated and separate from your internal infrastructure. If you're looking to educate yourself, do it the right way! – MDMarra Jul 18 '15 at 13:52

Can you advise how I can hide that records from displaying then from internet. I tried to delete them, but then they are returning.

I think you misunderstand what the DNS service on your server is doing. This service should only be used for devices on your local network to look up other devices on your local network, and also a local cache for public internet DNS records. It's not for publishing your public/external IP information to the internet. Even if you succeed at this, no one will know to look at your DNS server to find these records.

What you want to do instead is purchase DNS services from a well-known provider. The well-known provider will be closer to the DNS root servers, and can make sure that things like DNS-SEC are handled correctly. It will do a better job with reliability, security, and performance. Once you have your records set up with this service, go to your domain registrar and change your registration to point to your DNS service provider as the authoritative DNS provider for your domain.

After all that is done, you can still have your local DNS server hand local addresses for your servers to devices on your local network. This will let local devices still connect to your servers without needing to go out through your WAN connection or do any hairpin routing first.

Finally, for the question of why records are returning. One thing to keep in mind is that records are cached. Deleting a record doesn't make it go away right away. There is a timeout setting that tells clients to keep the record and not ask again for a while. Two days is typical. There's no point checking again after deleting a record until that timeout period expires.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.