0

Reading on the webs for proper network configuration for Active Directory Internal and DNS1,2 external and connecting them all together have not found a clear answer as to how to implement this.

I have a domain lets use example.com i've created my Domain controller and configured the domain as internal.example.com

I have two other machines NS1 & NS2 that will be handling public facing DNS resolution for example.com and have a third machine for exchange.

What is the proper configuration method for ActiveDirectory primary domain controller and two public facing DNS servers.

Should the domain controller have my publicly facing example.com or only the DNS1 & DNS2 machines?

What happens when connecting DNS1 & DNS2 to my internal.example.com domain within my local network for public facing DNS resolution?

within AD, should the DNS zone be setup as example.com with a sub-domain of internal.example.com or two separate zones for example.com and internal.example.com, how do the two DNS servers correlate with this?

Improve this question

1 Answer 1

Reset to default
1

No you should not use the public DNS servers internally.

Set clients to use internal DNS servers and those servers can forward requests that they are unable to resolve to the public DNS servers.

You do not want information about internal computers being available for external computers to obtain by making requests to your public DNS servers.

Windows Server 2016 also includes some new features like restricting client DNS requests from specific addresses. You might want to look into that. Also you want to ensure you properly firewall off the internal infrastructure and the public infrastructure. If you aren’t sure how to do that then engage a qualified professional. Configuring your network incorrectly can lead to security problems. DNS controls a lot and configuring DNS servers improperly can cause connectivity and security problems you don’t want to have.

Improve this answer
4
  • so the box with active directory and domain controller DNS should only have zones for internal.example.com and the two NS1 & NS2 should forward requests when needed to the domain controller to communicate with my exchange server?
    – UserSN
    Mar 11, 2018 at 1:32
  • Yes the FSMO role master should have the zone for internal.example.com. The FSMO role master should forward requests it is not authoritative for to the public DNS servers which should not be in your LAN. You might want to put them in a “DMZ” (but locked down with firewall rules so not a true DMZ) or host them outside of your network. The public DNS servers should not forward requests for anything to the internal DNS servers and should not have records for any inside hosts.
    – user5870571
    Mar 11, 2018 at 1:35
  • One last question, should my external DNS servers then not be connected to my domain via computer management?
    – UserSN
    Mar 11, 2018 at 1:49
  • Your external DNS servers are for the public. They should not be joined to the domain or have records for any inside hosts. Hosting your own public DNS servers can be complicated and is not recommended for most situations. If you need to host your own external DNS servers then make sure you properly configure them with special attention to them being secured.
    – user5870571
    Mar 11, 2018 at 1:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .