DNS split - the right way?
Posted on 2014-04-14
I have what I believe to be a dilemma regarding a new DNS environment I need to build.
Currently we have a Forest Root domain 'domain.com' with AD integrated DNS.
It is on VLAN1.
The only computers that are members of this domain are 2x Domain Controllers.
It does have a few A records for services using the domain.com dns zone.
We also have child.domain.com on VLAN2.
It has AD integrated DNS.
It is the domain that most computers are members of and they use the domain controllers in this domain as their DNS servers.
Both VLAN1 and VLAN2 have full bi-directional communication with each other.
The DC's in the parent domain.com have a delegation of child.domain.com displayed in their DNS server zone.
This is all working fine, however I need to add a workgroup server using the same top-level domain without causing conflict.
VLAN3 will be created.
It will not have any outgoing communication with either VLAN1/2
VLAN1/2 can communicate to VLAN3 using NAT
The DNS zone 'domain.com' and several subdomains 'subdomain1.domain.com', 'subdomain2.domain.com', etc need to be hosted on this newly built workgroup DNS server in VLAN3.
My original thinking was that I would just convert domain.com to a Primary DNS server on VLAN1 and then create the Secondary DNS servers on VLAN3, but then I was informed that it couldn't communicate to the Primary.
I then thought maybe I could create the new Primary in VLAN3 and then convert VLAN1 to a secondary, but then I couldn't create a delegate on VLAN3 of child.domain.com
If I create a new DNS Primary zone 'domain.com' on VLAN3, can I create a forwarder on the child.domain.com to point to the new Primary domain for all domain.com resolution? Would that impact domain services at all since it is a child of the forest root?
The thing is, all other services across every VLAN in the LAN/WAN will be using the new DNS server(s) in VLAN3, so VLAN1 dns isn't necessary so much. But it still needs to be there for itself right?
I guess another option is to have VLAN3 the Primary of domain.com and create all of the subdomains on there including child.domain.com and make all DNS servers on VLAN1/2 secondary servers rather than AD integrated. Is DNS ok using NAT for this purpose?
One catch is that all DNS servers must be on Windows 2012.
Anyway, your feedback would be greatly appreciated.