I need to provide a kind of DNS split-brain scenario with two key goals:
- "special" DNS clients (based on their subnet) must resolve certain A records in one domain to different IP addresses than the rest of clients
- all other records in the same domain must be resolved equally regardless of which client is asking.
In other words, I want to create a kind of "DNS rewrite" or overlay, where few records will be different for some clients. I was hoping to accomplish this by DNS policies in Server 2016 which describe "split brain/horizon" as one of the intended scenarios e.g. https://blogs.technet.microsoft.com/networking/2015/05/12/split-brain-dns-deployment-using-windows-dns-server-policies/ - but it seems I can't achieve goal 2.
In my testing I created a ZoneScope with alternative IP addresses to be returned to matched clients and query resolution policy based on client subnet, achieving goal 1). BUT if a client is matched to be from the "special" subnet, it is able to resolve ONLY records from the special ZoneScope, but not from the "default" scope - so failing goal 2.
Is there perhaps a configuration step I missed that would allow fallback to the default ZoneScope in case my special zonescope does not contain a matching record? I'm told this can be done easily with BIND DNS with Response Zone Policy, but I would like to stick with MS if at all possible. Also using hosts files is not possible as those"special" servers are not fully under our control.
Steps to reproduce
#define subnet of restricted servers Add-DnsServerClientSubnet -name SpecialServers -IPv4Subnet 192.168.0.0/24 #define ZoneScope for the special records Add-DnsServerZoneScope -ZoneName "test.local" -Name "SpecialZoneScope" #Prepare some testing records in the default scope Add-DnsServerResourceRecord -ZoneName "test.local" -A -Name HostA -IPv4Address 126.96.36.199 Add-DnsServerResourceRecord -ZoneName "test.local" -A -Name HostB -IPv4Address 188.8.131.52 #Prepare alternative record in SpecialZoneScope Add-DnsServerResourceRecord -ZoneName "test.local" -ZoneScope "SpecialZoneScope" -A -Name HostA -IPv4Address 184.108.40.206 #Define query resolution policy Add-DnsServerQueryResolutionPolicy -Name "SplitBrainZonePolicy" -Action ALLOW -ClientSubnet "eq,SpecialServers" -ZoneScope "SpecialZoneScope,1" -ZoneName "test.local"
nslookup from "regular" client:
> HostA.test.local Server: dns.test.local Address: **** Name: HostA.test.local Address: 220.127.116.11 > HostB.test.local Server: dns.test.local Address: **** Name: HostB.test.local Address: 18.104.22.168.2
Both records from the "default" zonescope are returned correctly.
nslookup from client in the "special" subnet:
> HostA.test.local Server: dns.test.local Address: **** Name: HostA.test.local Address: 22.214.171.124 > HostB.test.local Server: dns.test.local Address: **** *** dns.test.local can't find HostB.test.local: Non-existent domain
HostA is resolved with the alternative IP from the SpecialZoneScope as intended, HostB is not resolved at all.