Given a Microsoft Active Directory domain configured as a subdomain of the company's public DNS domain, say:

  • public domain contoso.com
  • Active Directory domain inside.contoso.com

There are five Domain Controllers (DCs) in four sites. All of them are also DNS servers configured with contoso.com and inside.contoso.com as separate AD integrated zones. Three of the DCs are running Server 2008R2, the other two, Server 2012.

Now irritatingly, a folder named "inside" keeps appearing in zone contoso.com which contains A records for some or all of the DCs. If I delete all of these records the folder disappears, only to reappear a few minutes later with a single DC's A record, and A records for the other DCs added gradually. It looks as if, when the DCs register themselves in DNS, the entries get added to zone contoso.com instead of inside.contoso.com where they belong.

Simple question: why?

Note 1: All the DCs are also correctly listed as A records in zone intern.contoso.com. I do not know if these entries have been added manually, though.

Note 2: None of the other host entries in zone inside.contoso.com are ever duplicated to the inside folder in zone contoso.com.

  • All of them are also DNS servers configured with contoso.com and inside.contoso.com - Why do you have your public/external DNS zone on your internal DNS servers? You should have internal.contoso.com but not contoso.com. Is there a particular reason you added contoso.com? – joeqwerty Aug 30 '16 at 23:56
  • I'm afraid I can't answer that question. It was set up that way before I took over responsibility for the network. Is it important to know the motivation for that setup in order to answer my question? – Tilman Schmidt Sep 1 '16 at 19:41
  • It kind of is important to know why it was set up. Your internal AD DNS zone is internal.contoso.com, so why did someone set up your public DNS zone internally? For what purpose? My instinct is to tell you to delete the contoso.com DNS zone, but without knowing why it was set up, I'm wary of giving you that advice. – joeqwerty Sep 1 '16 at 21:10
  • 1
    Fair enough. But that advice wouldn't actually answer my question why the DCs register themselves in the wrong zone, anyway. What's more, deleting the zone would probably cause operational problems since its content differs from that of the public DNS zone. – Tilman Schmidt Sep 2 '16 at 21:52
  • Found out just now this is a 4 years old question, somewhat bumped to home page. But it was ineresting enough to spin up a DC just to test it. Anyway, if you really can't get rid of the main zone, my answer stands: a zone delegation will solve this. – Massimo Apr 17 '20 at 19:11

When something (up to and including a DC) tries to register a DNS record ending with .inside.contoso.com with your DNS servers, the request matches two zones and thus gets registered in both of them, because the server doesn't know they are related.

What is missing here is a delegation for the inside.contoso.com zone in the contoso.com zone; this will tell the server that inside.contoso.com is indeed a subdomain of contoso.com, and thus a record in that zone should only be registered there.

You need to create a delegation and list all DCs as delegates.

The problem:

enter image description here

The solution:

enter image description here

enter image description here

enter image description here

enter image description here


So I ran into this same issue a few months back when I was doing a virtual lab, and if memory serves me correctly the short reason why this is occurring is because your manually created zone for contoso.com is AD-Integrated into your inside.contoso.com domain, and replicates to the DCs in inside.contoso.com zone which is why you're seeing the folder (similar to the _msdcs subdomain folder that exists in other domains). Because they are hosts that contoso.com is aware of and are part of a subdomain a folder with the name of the subdomain is created and host records for the DC are also automatically created, but the other host records in internal.contoso.com it is unaware of and also not authoritative for anyways so no records are created automatically, like the DCs are.

The problem with doing this (for which there is a solution), i come to find out, is that when you create a zone for an external facing namespace you MUST maintain records for ALL devices in that zone, not just the ones you want to create records for to facilitate resolution to your internal hosts (remember this zone is authoritative)

This is one of the compromises of using subdomains for internal Domain Design (Active Directory) versus a split-brain domain design. However, its still for the best because you will have a valid subdomain for issuing third party certificates to for inside.contoso.com and external DNS namespaces without issue.

The resolution mentioned earlier: So to resolve the issue of needing a zone to resolve external servers for internal clients (or whatever the reason may be) is to do something very similar to what you're doing now, just on a manual, one by one scale, called "Pinpoint DNS". What you do here is you create a zone for EACH server you wish to allow resolution for. This may sound tedious but if you have MANY servers that you require internal resolution for perhaps you may just want to make that zone non-ad integrated and authoritative (i have no experience on this maybe someone can chime in for what that would entail)

Pin-Point DNS Guide: Check the link below to help you create those manual, single zone entries to properly resolve external servers for internal clients while not being authoritative for the entire external domain: http://exchangenerd.com/2014/03/pin-point-dns-split-dns-alternative/

Active Directory Naming Guide (answers lots of commenters questions): For excellent information on why using subdomains for internal AD Domain design and other reasons see the link to the guide below authored by Maxmahem (many comments are asking why you have things setup this way and the guide below as well as microsofts own best practices for AD naming speak to these reasons too):


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.