Hosting Only a Subdomain in Azure DNS Service

You can use your internal subdomain as a parent for additional child domains that you create to manage divisions within your company.

For example, to implement an internal subdomain of the external domain example.com:

1. Configure the external DNS server with the namespace example.com. This server contains a static zone with only records for servers that are to be available publicly on the Internet. These records would typically include such servers as www.example.com, ftp.example.com, and so on.

2. Configure the internal DNS server with the namespace corp.example.com. Note that while the internal namespace is a subdomain of the external namespace, the internal zone is not delegated from the external zone. That is, the external server does not have a delegation record.

3. Register all hosts in the organization's internal network in the corp.example.com namespace, either in the corp.example.com domain or in child domains within that namespace. For example, a server for the sales department might have the fully qualified domain name of salesvr1.sales.corp.example.com.

4. Disable dynamic updates on the external server because no computers in the company's internal network should be registered in the external namespace.

5. Configure the internal DNS server to forward Internet queries to enable internal hosts to resolve external (Internet) names. You can do this in one of two ways:

   • Configure the internal DNS server to forward to the external server, which enables recursion on the external server. In addition, you can configure the internal server as a secondary server to the external server. This enhances the security of the internal network by ensuring that the internal server never makes a query directly on the Internet.

   • Configure the internal DNS server to forward queries to the Internet service provider's DNS server. This method enhances security on the external server because it makes it possible to disable recursion on the external server.

Instead of using forwarders, the internal DNS server may be configured simply to use the standard Internet root hints to resolve Internet names. The DNS server is configured with the list of standard root hints when the DNS server role is installed. This option is the least secure, however, because it requires the internal DNS server to be able to access DNS servers on the Internet.

I originally wrote this as a comment, but honestly, I think it's really your best course of action.

Your DNS provider lost all its marbles for several hours and it won't support secondary DNS off-premises, and your response is to try to hack around it? I'd be curious to know what Azure would have to do to actually lose your business; shoot your dog, maybe? Myself, I'd be running for the exit so fast no-one would see the blur. It's time to change your DNS provider to one that doesn't suck.