Active Directory – List ISP DNS servers as Forwarders

active-directorydomain-controllerdomain-name-system

Background: I have a relatively small Active Directory domain (Windows 2003 Functional level) with two domain controllers, both running DNS servers. They are the primary and secondary DNS servers for the LAN. No other local DNS. I do not have any subdomains or recursion going on.

My Question: In the DNS Manager, under server Properties, Forwarders tab. Should I have my ISP's DNS servers listed here (or the Google ones)? Or should I leave the Forwarders tab blank and rely on the Root Hints servers?

My Forwarders Tab

I Googled before posting. About half the advice I read said the use the ISP DNS as forwarders, and half said to just use the Root Hints. So, I have no idea which is "best" for my setup (which I imagine is pretty typical for a small shop).

Best Answer

Unless you have some reason to directly recurse from the root, I'd recommend using a forwarder; Google or your ISP is much more likely to have something in cache for a query, so it'll provide better performance for name resolution within your network.

As far as Google vs ISP, there are two reasons that you might want to use Google over your ISP:

  • Performance. Google's systems are anycasted and do some interesting stuff with cache; test and see if they're generally faster than your ISP.
  • Badly behaved ISP. Some ISPs fiddle with queries, doing dirty stuff like NXDomain hijacking.
Related Topic