using dns in dmz for queries. Good Idea?

Just wanted some general ideas about preventing AD servers from DNS lookups (just forwarding) and instead use a DNS server in the DMZ (probably Linux) doing the actual lookups.  Our security guy wants to do this and was wondering what the implications are.

Has anyone had any good or bad experiences with this kind of setup?  

I assume it's not that common any more?
billFmurrayAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Cliff GaliherCommented:
Well, many things in AD *need* DNS to work right, so getting such a setup would still require the DMZ DNS server to talk to the AD DNS server, virtually eliminating any security benefit. I'm not sure I understand the purpose.
0
DrDave242Commented:
Just wanted some general ideas about preventing AD servers from DNS lookups (just forwarding) and instead use a DNS server in the DMZ (probably Linux) doing the actual lookups.
Are you referring to external lookups (i.e., resolution of internet names)? DNS is used extensively for internal lookups by everything in the domain, so you wouldn't want to restrict that, but yes, you can restrict external lookups if you'd like. Your domain controllers can be configured to use the DMZ server as their only forwarder, and that server can then do the dirty work. You can then configure the firewall so that only DNS queries from your DCs are allowed to pass from the LAN to the DMZ, and only DNS queries from the DMZ server are allowed to pass through to the internet.

One disadvantage that I can see is that there's a single point of failure anytime you use only one forwarder: if your DMZ DNS server goes down, nobody in the domain will be able to get to the internet until it comes back up or you do a bit of reconfiguration.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.