I am looking to create a root domain on Windows Server that will resolve internal IPs for only selected services hosted within our firewall, and forward all unresolved hostname requests to an external name server.

For example, if someone tries to access an ERP system at https://erp.contoso.com the internal DNS will be provide LAN users with a local IP, while external users will be provided with a public IP address from an external DNS provider.

However, regardless of whether the users is on the LAN or not, all requests to https://firewall.contoso.com for example, will be resolved by the external DNS.

How does one accomplish this? My apologies if this explanation is difficult to follow, I hope this makes sense.

  • why must people do this, just add a public cname to the private record, stop mucking up dns – Jacob Evans Mar 6 '17 at 22:26
  • configure Windows Server to forward unresolved hostnames to external DNS? - You don't. Windows has no way to do this. – Zoredache Mar 6 '17 at 23:36

pick one:

1) copy everything from public to private

Literally copy all the records you want plus the private ones, this is the most painful and common.

2) add NS records for all public subdomains on your internal server with the public ns records (delegate zone)

firewall.contoso.com IN NS ns1.msft.net.
firewall.contoso.com IN NS ns2.msft.net.

3) put private IPs on the wan zone

some see this as a security issue, otherwise it doesn't really matter.

4) cname root records to a subdomain that is split or local only.

erp.contoso.com in CNAME erp.contoso.local
erp.contoso.com in CNAME erp.lan.contoso.com

local zone

erp.lan.contoso.com IN A

5) only create subdomains for internal zones. (personal favorite)

public zone:

erp.contoso.com IN CNAME erp.lan.contoso.com
dns1.lan.contoso.com IN A
dns2.lan.contoso.com IN A
lan.contoso.com IN NS dns1.lan.contoso.com
lan.contoso.com IN NS dns2.lan.contoso.com

private zone:

dns1.lan.contoso.com IN A
dns2.lan.contoso.com IN A

erp.lan.contoso.com IN A

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.