Create a subdomain for a internal server

No you don't need to have recursion on for authoritative DNS servers. Depending on who you ask it's even considered good practice that (if possible) your authoritative server not be recursive as it's a line of defence against some DoS attacks. (Cisco's document is here for example)

A sample from my domain is below (Server is running Bind 9 and is non-recursive).

; <<>> DiG 9.5.1-P3 <<>> mail.<snip> @<my authoritative master>
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1216
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 4, ADDITIONAL: 4

;; QUESTION SECTION:
;mail.<snip>.       IN  A

;; ANSWER SECTION:
mail.<snip>.        86400   IN  CNAME   ghs.google.com.
ghs.google.com.     158151  IN  CNAME   ghs.l.google.com.
ghs.l.google.com.   33    IN  A       74.125.47.121

;; AUTHORITY SECTION:
google.com.     153556  IN  NS  ns4.google.com.
google.com.     153556  IN  NS  ns2.google.com.
google.com.     153556  IN  NS  ns3.google.com.
google.com.     153556  IN  NS  ns1.google.com.

;; ADDITIONAL SECTION:
ns1.google.com.     169823  IN  A   216.239.32.10
ns2.google.com.     169823  IN  A   216.239.34.10
ns3.google.com.     169823  IN  A   216.239.36.10
ns4.google.com.     169823  IN  A   216.239.38.10

It sounds more like a DNS misconfiguration at the Windows 2003 DNS than anything else.

You can use your internal subdomain as a parent for additional child domains that you create to manage divisions within your company.

For example, to implement an internal subdomain of the external domain example.com:

1. Configure the external DNS server with the namespace example.com. This server contains a static zone with only records for servers that are to be available publicly on the Internet. These records would typically include such servers as www.example.com, ftp.example.com, and so on.

2. Configure the internal DNS server with the namespace corp.example.com. Note that while the internal namespace is a subdomain of the external namespace, the internal zone is not delegated from the external zone. That is, the external server does not have a delegation record.

3. Register all hosts in the organization's internal network in the corp.example.com namespace, either in the corp.example.com domain or in child domains within that namespace. For example, a server for the sales department might have the fully qualified domain name of salesvr1.sales.corp.example.com.

4. Disable dynamic updates on the external server because no computers in the company's internal network should be registered in the external namespace.

5. Configure the internal DNS server to forward Internet queries to enable internal hosts to resolve external (Internet) names. You can do this in one of two ways:

   • Configure the internal DNS server to forward to the external server, which enables recursion on the external server. In addition, you can configure the internal server as a secondary server to the external server. This enhances the security of the internal network by ensuring that the internal server never makes a query directly on the Internet.

   • Configure the internal DNS server to forward queries to the Internet service provider's DNS server. This method enhances security on the external server because it makes it possible to disable recursion on the external server.

Instead of using forwarders, the internal DNS server may be configured simply to use the standard Internet root hints to resolve Internet names. The DNS server is configured with the list of standard root hints when the DNS server role is installed. This option is the least secure, however, because it requires the internal DNS server to be able to access DNS servers on the Internet.