Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Exclude Certain DNS Records From Propogating Across to RODC

Posted on 2014-10-28
5
Medium Priority
?
452 Views
Last Modified: 2014-10-29
Our main office is home to our AD and DNS Servers.  We are still using a .local for our AD (Unfortunately) so we have a .local as well as our .com as Forward Lookup Zones.  For the .com zone, we have our public facing servers resolving to their internal IP.

Now that we have a branch office with a RODC, this is causing an issue for us.  We have an MPLS that is routing most of the office traffic except for our DMZ subnet.  Because this is not routing (and I dont think we want to at this point) and the RODC is resolving an internal IP, the branch office users cannot reach the DMZ Servers.

Is there any way to have those particular records for the DMZ on the RODC be different or not replicate over at all from the primary domain controller to the RODC?  I would like those particular records to resolve over public DNS.
0
Comment
Question by:AllDaySentry
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
5 Comments
 
LVL 59

Accepted Solution

by:
Cliff Galiher earned 2000 total points
ID: 40409487
If you have an AD-Integrated zone, no. AD-Integrated is exactly that and replicates with AD.

The only way to do what you want is to make your zone non-AD integrated so it doesn't replicate *and* manage the zones independently at each site (a primary/secondary setup would still transfer all records with Windows DNS.)  You'd effectively be setting up a variant of split-DNS.

-Cliff
0
 

Author Comment

by:AllDaySentry
ID: 40409611
I added the .com zone in manually to work with our hosted / server applications.  Each time I have a new public facing server, I manually add in the DNS entry.

Does this mean that zone is still AD-integrated or can it be disabled from replicating?
0
 
LVL 59

Expert Comment

by:Cliff Galiher
ID: 40409765
Manually created zones can still be either AD-integrated or file-based. AD-integrated zones, even manually created ones, replicate.
0
 

Author Comment

by:AllDaySentry
ID: 40409782
Thats what I figured.  They look to both be AD-integrated.  I was just hoping there would be an easier solution in DNS for this.
0
 
LVL 59

Expert Comment

by:Cliff Galiher
ID: 40409787
The underlying issue is that DNS as a protocol is older than the public internet. Split DNS, and NAT for that matter, both exist because of the shortcomings of IPv4. So the "correct" solution is to deploy IPv6 whenever and wherever possible. Long term the world is going that way anyways.
0

Featured Post

On Demand Webinar: Networking for the Cloud Era

Did you know SD-WANs can improve network connectivity? Check out this webinar to learn how an SD-WAN simplified, one-click tool can help you migrate and manage data in the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Originally, this post was published on Monitis Blog, you can check it here . It goes without saying that technology has transformed society and the very nature of how we live, work, and communicate in ways that would’ve been incomprehensible 5 ye…
Resolving an irritating Remote Desktop connection that stops your saved credentials from being used.
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…

688 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question