Single AD site needs alternative DNS records for two hosts in AD integrated DNS

active-directorydomain-name-systeminternal-dns

We have 6 different AD sites all connected by IPSec tunnels in a full mesh aside from one office which cannot connect to our data centre for stupid ISP related reasons that are not fixable currently. We have AD integrated DNS and there are two web servers, with public IPs, which replicate the internal address across our AD sites and are accessed via the IPSec tunnels. Since both of these servers are in our DC the site which cannot connect to the DC is unable to access both of these sites.

We need to replicate the rest of our AD DNS to this site, so removing replication is not an option. These sites are also in our primary domain's DNS, and updating them to either use an alternate name, or alternate domain suffix is not a viable option as it will break links for this office.

Is there a way to have this one site use alternate DNS records and not replicate those across AD?

Is my best option to GPO all client/server computers in that site to add the public IP for these two hosts to the local hosts file?

This doesn't need to be a permanent, elegant fix as we will be changing ISPs soon(ish). I just need something that will be stable and reliable for this office for the mid-term future. Simplified Network Diagram

To clarify: Toronto and New York can talk to Tokyo, each other and the data centre. Tokyo can talk to Toronto and New York, but not the data centre. We have resources in each site, as well as AD replication, that need to be accessed from all the other sites.

Two of these resources are in our data centre, and have public IPs as well as internal IPs, and use the same hostname internally and externally. That hostname is integrated into our Active Directory DNS. All access from New York and Toronto to these sites is done via the internal IP addresses.

We need Tokyo to access these two hosts via their public IP, not their internal one. We cannot use different hostnames as these sites are heavily integrated into our other applications, communications, etc.

Best Answer

If I am understanding your question correctly, you need two DNS servers in two different locations to answer the same query with two different responses, each one specific to its location; this record is located in an AD-integrated zone which is replicated on both DNS servers, and you would like to turn off replication only for this record, so that you can hand out different answers from different servers.

If this is the case, your solution is to create a subdomain instead of an A record, and configure it as a primary zone on both servers, without AD integration; then on each zone create an unnamed record pointing to the correct IP address; an unnamed record answers to requests for the zone name, thus it will be effectively equivalent to an A record in the top-level zone.

Example:

Your domain is domain.local; this is an AD-integrated zone.
Your DC/DNS in Site 1 is called DC1. Your DC/DNS in Site 2 is called DC2. Your record is server.domain.local; you need it to point to 10.20.30.40 if requested to DC1, but you need it to point to 192.168.90.42 if requested to DC2.

  • Create a standard primary zone on DC1 for the (sub)domain server.domain.local; then, in this zone, create an unnamed A record pointing to 10.20.30.40.
  • Create a standard primary zone on DC2 for the (sub)domain server.domain.local; then, in this zone, create an unnamed A record pointing to 192.168.90.42.

This way, when DC1 is asked for server.domain.local, it will answer with 10.20.30.40; if the same query is made to DC2, it will answer with 192.168.90.42.

Related Topic