I am experimenting with using a windows server 2012r2 installation purely for DNS for my network (no AD etc). I have set up the zone for my domain e.g. example.com and successfully added some A records e.g. webdev.example.com, test.example.com.

However, I already have public DNS setup for my website e.g. www.example.com. I've configured the windows server to forward DNS requests to (I've tested that it resolves properly from another computer) but I cannot seem to get the windows server to forward these requests. Is there something that I'm doing wrong?


Yes, you installed an authoritative DNS server on the same domain for which it is not authoritative. This is a common mistake. Simply add the correct A and CNAME records to your internal DNS so that it will properly resolve for your public website, or more properly, rename your internal domain using the TLD of something like .internal, .local, or .localdomain.

  • Thanks for confirming the problem. If I were to add the records to the internal DNS for the external domains, wouldn't that mean I'd have to maintain records on both the internal and external DNS servers? This isn't a huge problem but it would be nice to only have to maintain unique records for the external addresses. I could use a different TLD for the internal domain but I'd like the experience to be as transparent as possible for the users inside the network (e.g. they can access www.example.com but then can access intranet.example.com which is resolved using the internal DNS).
    – Sonoman
    Jan 28 '16 at 7:11
  • You can't, that's why @LinuxNinja called it a "mistake". Both of your instances are authoritative - they will never forward queries for "example.com" elsewhere. See point 2 here: blog.varonis.com/active-directory-domain-naming-best-practices
    – Andy
    Jan 28 '16 at 10:24
  • Thanks for confirming that. I'll go down the route of having the internal DNS managing int.example.com in that case.
    – Sonoman
    Jan 28 '16 at 11:11
  • It is now considered bad practice to use unregistered suffixes such as .internal, .local, or .localdomain (docs.microsoft.com/en-us/previous-versions/windows/it-pro/…) Oct 24 '19 at 20:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.