TL;DR - I want to add a DNS service record to a zone that our parent company manages in our local DNS server since parent company won't help but don't want to maintain an entire copy of their primary zone in order to do it.
I manage a small remote office (our company was just acquired by a large company) with 20 people and lots of local servers for engineering and testing purposes. I have a Windows Server 2008 machine setup with DNS running that resolves all of our local names and then forwards all other unknown names up to megacorp's internal DNS server via server-level forwarding. So far this works great.
However, we here at minicorp were recently switched to megacorp's Exchange server. When we configure our Outlook clients to connect to the Exchange server we can connect up, but we get the infamous "the name on the security certificate is invalid or does not match" warning. This is because the domain name in the certificate that megacorp uses doesn't match the domain name for use in Outlook auto discovery mechanism. For the most of megacorp's users this isn't an issue since they're on the active directory which pushes out the proper autodiscovery URL via SCP. Since we here in minicorp won't be joining the AD for a while we're stuck with this issue.
Microsoft describes some ways to fix it here: https://support.microsoft.com/en-us/kb/2772058
Megacorp's IT folks are overwhelmed with higher priority issues (nice way of saying they're of no help to minicorp for this problem) so I need to figure out a way to solve this without requiring them to make changes.
According to that Microsoft article, the 'proper' way to handle this is via SCP but since AD isn't an option we can't go that route. So Outlook falls down to the #3 option which tries the autodiscover.megacorp.com URL which works but results in the certificate warning. Also, in order to even make that work I've had to add a autodiscover.megacorp.com zone to my local DNS server since that name doesn't resolve in megacorp's DNS server for some reason.
The next option according to that article is to use a DNS service record to provide the proper autodiscover URL that matches the name in the SSL certificate. The problem is that I don't administer the primary zone for megacorp's domain which finally leads me to my question... Can I create a service DNS record for a zone that I don't manage? Similar to how I created a 'autodiscover.megacorp.com' zone which contains just the proper IP address for that name but all other name requests under megacorp.com domain get forwarded up to megacorp's DNS server, could I do something like that but with a service record? It's as though I want to 'subclass' megacorp's DNS so I can extend it to provide my own records.
Does such a thing exist or am I going in the wrong direction? Maybe there is a different way to solve this certificate error? I realize the proper way to handle this is for megacorp IT to implement this properly but... yeah...
Thanks for bearing with me through this question; it got a lot wordier than I intended.