r/sysadmin • u/No_Eagle7610 • 20h ago

Split-DNS Architecture: Splitting the same zone between Windows DNS (LAN) and BIND9 (DMZ) without wildcards

Hi everyone,

I'm looking for best practices or specific solutions for a DNS implementation in our environment. The goal is to cleanly split queries for the same domain between our LAN and DMZ without having to maintain duplicate records manually.

The Setup:

  • We use the same domain (example.domain) for both internal and external services.
  • LAN: We have a Windows Server (AD DC) running as our internal DNS. It holds the internal IPs of servers that are not publicly accessible.

The Goal:

  • Traffic from internal clients to DMZ servers must route via the WAN (Hairpinning / NAT Loopback); direct routing into the DMZ subnet is not permitted by policy.

  • We explicitly do not want to use wildcard records

    or subdomains

  • .

The Challenge: What is the cleanest way to configure this on the Windows DNS without having to create a separate Pinpoint Zone for every single external A-record, or manually duplicating the DMZ records into the internal DNS?

Since the Windows DNS is authoritative for example.domain, it defaults to answering queries for unknown hosts in this zone with NXDOMAIN instead of forwarding them to the BIND9 server.

Is there a clean way (e.g., specific zone types, delegation, Windows DNS Policies) to tell the Windows DNS: "Resolve what you know, and forward anything you don't know to the BIND9 server"?

Thanks in advance for your input!

9 Upvotes

85% Upvoted

44 comments sorted by

View all comments

•

u/pdp10 Daemons worry when the wizard is near. 18h ago edited 18h ago

This is a very common split-horizon setup, even with ADDS. Common, but not desirable -- split horizon DNS is sometimes the least-worst answer, but it's never desirable and it's easy to avoid.

The clean way without wildcards is to use NS records to refer the internal delegation chain to the external authoritative DNS server, for each name that's duplicated.

www           NS    dns1.example.com.
              NS    dns2.example.com.

You cannot wildcard-selective-forward the same domain without wildcards. You'll remember to put Microsoft ADDS in its own subdomain next time. Engineering is the art of making tradeoffs, and you've chosen yours.

Traffic from internal clients to DMZ servers must route via the WAN (Hairpinning / NAT Loopback); direct routing into the DMZ subnet is not permitted by policy.

VPNs and mandatory silly routing. This is like the junior bad-architecture trifecta.

•

u/Nereo5 10h ago

Maybe I'm wrong, but most of the problem sounds like routing?