Can I create an Active Directory domain with external DNS name?

[link470]

Hey guys,

 

I'm creating a new domain for a department in the district who has a separate setup than the rest of our district, and I've always used .local domains in the past. However, for this setup I'm thinking of using the actual domain name, . Now, if I use that domain name when I configure this new server running Windows Server 2012 Standard when I'm adding the Active Directory role, can anyone see any downsides? This server also hosts the website for this department via IIS [previously 6 on 2003, now will be 8 on 2012], which is accessed at , the same domain. As I said, in the past, I've used .local on their last network [XP/Server 2003, which I'm currently switching them from and then updating their laptops to Windows 7 and connecting to the new domain once I've configured it].

 

Does anyone see a problem with using the same domain name as the internal Active Directory Domain? I'd usually think not, but I seem to remember in University at one point our instructor saying "if you make the domain name the same as your external domain name you may have some issues". Any advice would be great! I plan to install the Active Directory roll today. Thanks in advance!

Edited July 18, 2013 by link470

[teklogic]

I have seen this done in a academy trust, it enabled user to login with an email address, ie [email protected], I also agree with remember somebody saying about problems. Having said that, it may have been on older 2003 servers.

[Netwacky87]

Most places I have seen use their external DNS name as their internal domain name, All I have found is you have to create an A record for 'www' to point to your web hosting for your externally hosted website. Other than that, I don't see a problem

[free780]

Would it only be an issue if subdomain.domain.com was the same as computer.domain.com I thought the .local suffix can cause issues.

[Mr.Ben]

Just built a new domain with the external domain name as the dn. Life is so much easier with the ad UPN of users being their email address. All that was needed was a DNS pointer for www.

[seawolf]

We changed from a .local to a public DNS 7 months ago. All of the supposed downsides to doing so turned out to be illusions, but the benefits were substantial for us. We have quite a few Macs and iPads and improvements for those systems were immediate and dramatic (.local and Apple mDNS don't mix well, some other systems have similar problems). Besides that, it just makes maintaining DNS records easier with one less domain to update.

[link470]

Awesome, that's exactly the kind of responses I was hoping for : D Very glad to hear you are all having positive experiences with using the external domain name. Just installed Active Directory on Server 2012 and went with the external domain name myself. I think as long as I add the right host header name and one for www in IIS, and add a www cname to DNS, I should be set.

 

We have quite a few Macs and iPads and improvements for those systems were immediate and dramatic (.local and Apple mDNS don't mix well, some other systems have similar problems).

I'm glad I'm not the only one, I've definitely heard of the exact same issues with Mountain Lion completely dropping support for .local and some other strange apple related issues. Seems the .local TLD is on its way out.

 

Thanks again!

Edited July 18, 2013 by link470

[m25man]

The .local syndrome and never use your FQDN on your internal network myth all came about from ye olde NT4 W2K migration days when most SME's had domain names owned and poorly managed by web designers, local authority or hosting companies that just wanted to screw every last penny they could from the Domain Owner.

DNS management through cpanels was voodo and NAT Traversal was still something only seen in Star Trek...

 

Fortunately we have evolved and DNS is almost idiot proof so using your FQDN and its umpteen variants has become the norm.

 

As others have stated all you need is to look after your internal DNS properly and it's easy to use whatever you want.

 

It's only harder for those that inherited legacy Netbios single label domains or split domains (Netbios Domain and AD Domain using entirely different formats) Don't laugh, I have a legacy 2003 domain set up by one of the very well known educational suppliers that has a Netbios name (NT Domain name) using a 5 letter acronym and the AD using the FQDN... It works but is so confusing for the users.

 

If your building from new, use your FQDN and never look back.

[Geoff]

FQDN as AD domain and using hairpin NAT rather than split DNS. No issues at all.

[link470]

Thanks again everyone, trying to figure out something else now that could potentially pose a problem, but I'm sure there's a workaround in DNS. Let's say that I have the website, , hosted outside of this windows domain on a central web server running websites for our whole school district. Right now, since I'm using FQDN for the internal Active Directory domain name, if I go to a test domain member and type in http://department.district.province.country, I of course reach the default IIS 8 page for the domain controller. Pings from inside the domain network for resolve to the domain controller. If I add an A record for www and point it to the district web server IP address, I can ONLY use the www. prefix before the web address to access the site, and even then the page doesn't load any CSS or images because the page redirects to http://department.district.province.country without the www's because we're trying to get people away from using www's in front of subdomains.

 

Is there a change I can make in DNS somehow for this to happen? Or now that I'm using the FQDN for the domain controller, do I HAVE to have the website hosted on the domain controller? There has to be a way to redirect outside the network, even without www's.

 

Thanks!

[seawolf]

Why are you using the same FQDN for your website as for the domain controller? You're domain controller should have a FQDN of something.doman.com and the website should be either http://www.domain.com or somethingelse.domain.com. If you insist on the website having the same FQDN as you have given the domain controller, then yes you will have to make the DC the web server as well. You could use DNS to make it work externally (public domain), but all queries internally would still resolve to the DC and not the website otherwise.

 

However, I've never seen such a thing done, am highly against it, and suggest you not do it.

[link470]

Ah, too bad. I totally thought this is what everyone was recommending I do, I didn't know I should have made a subdomain instead. Does anyone else have any ideas of how this could be done? I'd prefer to not completely scrap the domain and restart, but I guess I could if I have to.

[link470]

Just a quick update, I rebuilt the domain controller today and used a subdomain of the FQDN. I think this should work ok. I'm able to access the externally hosted website now at least from the domain controller so I think I'm set.

[apeman]

I dont think thats what seawolf was getting at.

 

Creating a sub domain of your external domain name is now Microsofts best practice this is so you avoid split brain dns and the few issues it brings like the www problem mentioned above.

 

So for best practice you should have internal.external.com for your Active Directory name and your DC could be DC01.internal.external.com.

 

You can still have the users logon with there email address e.g. [email protected] you just create a upn suffix in domains and trusts.

[link470]

Yup, I ended up using a subdomain of the external domain name when I did the rebuild a week ago, and that server is currently in production now and working great, with the website hosted externally outside the network.

[seawolf]

* Spammy post quoted removed *

 

A subdomain is the current best practice, but using a "real" domain name for the AD domain does not in fact have to be a PITA. You do NOT need to duplicate all of the DNS records if you do so either. If you already have an external primary DNS server for your domain then all you need to do with your internal DNS server(s) is to make them the authoritative DNS for all clients of the internal LAN, but set them up so they forward all DNS queries for hosts they don't know about to your primary external DNS.

 

So, for example, lets say you have an internal only Intranet server hosted on your LAN and you want to name it "intranet.somedomain.com", then you would create an A record in your internal DNS and that could be the only record you have in your internal DNS server with all other queries such as "www.somedomain.com" or "server.somedomaim.com" being redirected to the external DNS server just like it was previously. This works 100% if setup correctly and I've done it more than once for clients.

Edited August 14, 2013 by elsiegee40

[seawolf]

See http://technet.microsoft.com/en-us/library/cc782142(v=ws.10).aspx for more info on possible ways to configure this.