This has been a fun topic of discussion on Server Fault. There appear to be varying "religious views" on the topic.
I agree with Microsoft's recommendation: Use a sub-domain of the company's already-registered Internet domain name.
So, if you own foo.com
, use ad.foo.com
or some such.
The most vile thing, as I see it, is using the registered Internet domain name, verbatim, for the Active Directory domain name. This causes you to be forced to manually copy records from the Internet DNS (like www
) into the Active Directory DNS zone to allow "external" names to resolve. I've seen utterly silly things like IIS installed on every DC in an organization running a web site that does a redirect such that someone entering foo.com
into their browser would be redirected to www.foo.com
by these IIS installations. Utter silliness!
Using the Internet domain name gains you no advantages, but creates "make work" every time you change the IP addresses that external host names refer to. (Try using geographically load-balanced DNS for the external hosts and integrating that with such a "split DNS" situation, too! Gee-- that would be fun...)
Using such a subdomain has no effect on things like Exchange email delivery or User Principal Name (UPN) suffixes, BTW. (I often see those both cited as excuses for using the Internet domain name as the AD domain name.)
I also see the excuse "lots of big companies do it". Large companies can make boneheaded decisions as easily (if not moreso) than small companies. I don't buy that just because a large company makes a bad decision that somehow causes it to be a good decision.
According to this link and the Windows Server 2008 R2 Best Practices Analyzer, the loopback address should be in the list, but never as the primary DNS server. In certain situations like a topology change, this could break replication and cause a server to be "on an island" as far as replication is concerned.
Say that you have two servers: DC01 (10.1.1.1) and DC02 (10.1.1.2) that are both domain controllers in the same domain and both hold copies of the ADI zones for that domain. They should be configured as follows:
DC01
Primary DNS 10.1.1.2
Secondary DNS 127.0.0.1
DC02
Primary DNS 10.1.1.1
Secondary DNS 127.0.0.1
Best Answer
In Windows 2000 era, typically you would criss cross them:
DC/DNS Server A: Primary DNS points to Server B Secondary DNS points to Loopback
DC/DNS Server B: Primary DNS points to Server A Secondary DNS points to Loopback
That was how I last understood it to be at least, and I believe it was someone on here who even corrected me about it.
EDIT: It looks like that best practices link in the other question linked above indicates the above to be correct. I suggest you follow that. I have removed my other lines as I do not want to confuse anybody!
Your primary nameserver should be another server with low latency, preferably in the same site in AD Sites and Services. That way replication partners can be quickly discovered and if something is wrong with the DNS service starting you can still perform resolution. You can also specify tertiary servers, but the order past the primary is for the most part irrelevant.