0
  • I have an AD domain running on my network with a single DC
  • All my clients, domain joined or otherwise, use this DC for DNS
  • The DC has a forwarder set of 1.1.1.1 for external queries

I have a single domain joined machine that I want to use this DC for internal name resolution, but I want the DC to ignore any DNS request that is not for my internal domain name.

It looks to me like DNS policy in 2016 might be an option to me: Server 2016 DNS policy

I was wondering if anyone might be able to advise how to configure the filters appropriately, to only handle internal DNS requests for one specific host.

0

I’m going to take a guess and say it is based on this example, in the documentation you linked to:

Add-DnsServerClientSubnet -Name "MaliciousSubnet06" -IPv4Subnet 172.0.33.0/24 -PassThru

Add-DnsServerQueryResolutionPolicy -Name "BlockListPolicyMalicious06" -Action IGNORE -ClientSubnet "EQ,MaliciousSubnet06" –FQDN “EQ,*.contosomalicious.com” -PassThru

So, you would simply use: Add-DnsServerClientSubnet -Name "MySpecialPC" -IPv4Subnet <ip address of Special PC>/32 -PassThru

Add-DnsServerQueryResolutionPolicy -Name "OnlyAllowInternalQueries" -Action IGNORE -ClientSubnet "EQ,MySpecialPC" –FQDN “NE,*.<domain.local>” -PassThru

Obviously, replace <ip address of special PC> and <domain.local> with your specific information.

|improve this answer|||||
  • That looks to make sense! I will give it a go and see if it does what I would expect! Thanks. – James Edmonds Jun 12 '18 at 11:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.