2

just getting started here. I tried searching most relevant results and haven't quite found what I'm looking for.

First off, I am using an Active Directory that I created for a private game project and was going to use it more than I have been by integrating it into the tool systems my developers use.

As such, I decided to place my DNS zones within Active Directory so they could manage and replicate. Obviously, I do not wish to expose my domain controllers to the internet since it is a bad practice. I do however want to be able to use this service if it is possible.

The problem is, when I run checks on some of our public DNS zones, they resolve from two of my other servers which are secondary copies of the AD Integrated DNS. However, my SOA and Nameserver checks fail because the domain controllers are inaccessible to the public, and they are of course listed as Nameservers and the SOA for those zones since they're ADI.

My question is essentially this, is there a way I can do what I'm trying to do which is host these zones on my domain controllers and have the secondary copies available and still satisfy the checks out to the public in a safe manner? I'm trying to figure out if my only option will be relocating these DNS zones to an external source from my virtual host that is publicly accessible at all times.

  • 1
    There may be an answer to this, I am unaware of. But, the way I have always done this, and the way I think is "best practice" is to have "split-dns." You host your internal zone, internally. Do not expose that to the internet. Host your external zone (even when it is the same name) externally. Yes, you have to update records in two places if both internal and external need access, but there are pros and cons to this as with other solutions. There aren't any "dynamic" records in Active Directory that need to be published externally. So, there usually ins't that much management needed. – Appleoddity Oct 15 '17 at 6:29
  • 1
    I would even say that exposing your internal zone externally, even if through a read-only replica, exposes significant information about your network and configuration to the public. – Appleoddity Oct 15 '17 at 6:30
  • Probably right, I need to read a bit more about split DNS and see what I come up with. Else I guess on a couple of those servers that are already public I'll add the DNS role and re-create the zone as a primary zone instead. I was just hoping for some solution that would work and let me have it replicate. :) All of my experience has been internal to places I've worked and I've never had to consider this particular scenario before. Thanks. – Kyp Oct 15 '17 at 15:23
1

After removing all the extraneous background information I think your issue is essentially:

Is it required that the public can resolve and/or access the master name server (MNAME) used in the SOA record for my domains?

I think, but I can’t support it readily from the RFC’s, that the answer to that question is No.

AFAIK the only requirement is that the MNAME server should respond authoritatively for that domain, but there is no requirement that it must do so for the internet at large.

If it doesn’t you simply cannot use an online check to determine if all your name servers return consistent/identical data.

  • Partial but I think the above comments from AppleOddity also help to answer. Sorry for the extraneous information, I thought some of it might be helpful in trying to explain what I had configured without giving away the exact details. The NS checks are failing because there's no address available to the internet for my domain, of course because it's not a valid TLD or anything of the like. The SOA is tripping on the address, inability to deliver over IPV4, the MNAME issue you mention, and the SOA RNAME for one of my webmaster addresses that it has listed which is using my AD domain. – Kyp Oct 15 '17 at 15:27
  • 1
    It's referred to as hidden master – Jacob Evans Oct 16 '17 at 0:01
  • 1
    @JacobEvans Thanks for that, good reading, but I think I'm going to move it to public DNS rather than do this. In my case, it's overkill for what I need to do. – Kyp Oct 18 '17 at 2:26
  • 1
    I would never used active directory for anything other than AD joined systems. Good call. – Jacob Evans Oct 18 '17 at 3:11
  • Eh, I probably shouldn't have, but the stubborn sysadmin in me wanting a single point to manage our development tools ;) Thanks for the help. – Kyp Oct 21 '17 at 20:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.