Should DNS server be in DMZ?
If you have only one set of DNS servers for both internal and external DNS, you should place them in the DMZ and have internal users access them from the internal network rather than place them in the internal network and configure in your firewall for external DNS requests.
Should domain controllers be DNS servers?
In a small environment, at least one domain controller (DC) should be a DNS server. It is possible to install DNS on servers which are not DCs, including non-Windows servers, but installing DNS on DCs allows the use of AD-integrated lookup zones (see below), which improve security and simplify zone replication.
What DNS server should domain controller use?
Proper domain controller DNS setup is vital for Active Directory to work properly. Best practice dictates that each domain controller should be setup with a different DNS server as it’s preferred DNS server, and and the loopback address (127.0. 0.1) as it’s alternate DNS server.
Can I have two primary DNS servers?
You can have as many Primary DNS zones as you wish in your environment. again, one server can host multiple zones. Or if you wish you can have multiple DNS servers each hosting a primary zone.
Is the Exchange Server a DMZ DNS server?
Our exchange server is in the DMZ and authenicates to internal DC’s. This servers primary dns points to internal dns server and it’s secondary points to a dmz dns server. Can you tell me what the configuraton would look like for this setup. The DMZ dns servers are configured with our internal dns zone records for our 2 interal DC’s.
Is the DMZ the authoritative name server for Your Domain Name?
If your DMZ DNS servers are the authoritative name servers for your domain name, then they should be in the DMZ. They will also provide the Alias translation between public and private names.
Which is the best DMZ DNS configuration best practice?
Since LDAP, by default, is not encrypted, you really need to look at technology such as ADFS (Active Directory Federated Services) to effectively ‘proxify’ and sign/encrypt AD LDAP traffic to/from DMZ. Of course the best answer is to ‘say no’ and not allow AD to cross the firewall in the first place…. Yep!! big hole…
Do you have to cross the DMZ for AD DNS?
Of course the best answer is to ‘say no’ and not allow AD to cross the firewall in the first place…. Yep!! big hole… AD DNS really doesn’t have to cross into the DMZ.