Windows Forum

Ask something
Discussion Locked

Internal DNS and AD

0 helpful
6 replies

by nsteere

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

This problem has probably been encountered by a million companies but I just wanted to get clarification.

Situation:

I will be creating an AD domain of several servers an a few workstations that are all running Windows 2000 PRO or Server OS.
Our company setup:

We have an ISP that gives us internet access. We use static Private IP addressing with a firewall for NAT. When I configure a computer, I enter the IP address, Subnet Mask and the Default Gateway (firewall). I then enter the Primary and Secondary DNS server addresses of the ISP.

If I implement active directory, how will I enter the DNS server info at the client? I need to enter the addresses of the external DNS so the system can see the internet and I need to enter thelocal AD DNS server so the user can authenticate. How would I enter static addresses for both the external and internal DNS? The same as usual but with one external and one internal? If so, which one gets the "primary" listing and which one gets "secondary"? My AD domain will be of the mydomain.local variety.

I have been running NT 4 networks a long time, have learned a lot about AD organization and structure but am very new regarding getting AD DNS and ISP DNS to work together.

6 replies

by madlucas

I have a similar setup. I have our internal DNS entered as the primary the external DNS entered as the secondary. This works fine in my setup.

by timwalsh

Primary vs. Secondary DNS servers - The server listed as secondary will only be accessed if the primary is not AVAILABLE. It will not be used just because the primary cannot resolve a given DNS query.

Using the DNS mmc, right click on your DNSserver and choose properties. On the Forwarders tab, enter the IP address for your ISPs DNS server.

Assuming your internal DNS server continues to function properly, this setup has the following effect:
1. Your DNS server becomes authoritativefor all DNS queries relating to your internal domain.
2. Any DNS queries relating to resources outside your domain (i.e. the Internet) are forwarded to your ISP's DNS server for resolution.

On your server, only enter a Primary DNS IP address (your internal DNS server).

On your clients, enter your internal DNS server's IP address as primary. If you enter your ISP's DNS server as a secondary, you have a potential upside and a potential downside.
The upside - if your internal DNS server stops functioning, your clients can still get to the Internet.
The downside - if it's only the DNS server software that stops functioning and not the entire server, you could flood your ISP's DNS server with DNS queries relating to your internal domain (which of course your ISP will know nothing about) (which is why you don't want to enter your ISP as a secondary on your server).

Hope this helps.

by nsteere

Based on Answer 2:

Based on the answer, would I be able to set a second AD DNS server as the client secondary (set to fwd to ISP(ISP secondary or primary?)

Also: would there be any conflict that I am using NAT from my firewall and internal DNS servers? I am not sure about that one, just heard it could be an issue (dubious source).

This discussion is closed to new replies.