Home / server / Questions / 836665
In Process
toolshed
Asked: 2017-03-07 14:16:30 +0800 CST

How to configure Windows Server to forward unresolved hostnames to external DNS?

  • 772

I am looking to create a root domain on Windows Server that will resolve internal IPs for only selected services hosted within our firewall, and forward all unresolved hostname requests to an external name server.

For example, if someone tries to access an ERP system at https://erp.contoso.com the internal DNS will be provide LAN users with a local IP, while external users will be provided with a public IP address from an external DNS provider.

However, regardless of whether the users is on the LAN or not, all requests to https://firewall.contoso.com for example, will be resolved by the external DNS.

How does one accomplish this? My apologies if this explanation is difficult to follow, I hope this makes sense.

domain-name-system internal-dns windows-server-2008-r2

1 Answers

  1. pick one:

    1) copy everything from public to private

    Literally copy all the records you want plus the private ones, this is the most painful and common.

    2) add NS records for all public subdomains on your internal server with the public ns records (delegate zone)

    firewall.contoso.com IN NS ns1.msft.net.
firewall.contoso.com IN NS ns2.msft.net.

    3) put private IPs on the wan zone

    some see this as a security issue, otherwise it doesn't really matter.

    4) cname root records to a subdomain that is split or local only.

    erp.contoso.com in CNAME erp.contoso.local
erp.contoso.com in CNAME erp.lan.contoso.com

    local zone

    erp.lan.contoso.com IN A 10.0.0.10

    5) only create subdomains for internal zones. (personal favorite)

    public zone:

    erp.contoso.com IN CNAME erp.lan.contoso.com
dns1.lan.contoso.com IN A 10.0.0.5
dns2.lan.contoso.com IN A 10.0.0.6
lan.contoso.com IN NS dns1.lan.contoso.com
lan.contoso.com IN NS dns2.lan.contoso.com

    private zone:

    dns1.lan.contoso.com IN A 10.0.0.5
dns2.lan.contoso.com IN A 10.0.0.6

erp.lan.contoso.com IN A 10.0.0.10
    • 1