Results 1 to 13 of 13
  1. #1
    3 Star Lounger
    Join Date
    Dec 2001
    Location
    Atlanta, Georgia, USA
    Posts
    272
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Question Setting up split DNS

    Hi everyone. I have an associate who owns a small business. He has only seven users on his network and he has one SBS 2003 server. He's utilizing Exchange 2003 and SQL Server 2005. His server also hosts the primary application his company uses including his time and billing data. His SBS server is around 10 years old now and he's finally ready to replace it. To that end he's purchased a new HP server. He has a Microsoft Action Pack subscription so he has access to Windows Server 2012 and Exchange 2013. So he's all set to make the move.

    His current Active Directory (AD) and DNS environment are working fine. However, his internal domain is company.local and as we all know you won't be able to get SSL certs with an internal only domain name around 2 years from now. As small as his setup is it wouldn't be a problem to setup his new server with his current public domain name (company.com) to avoid the SSL cert issue coming in around 2 years. However, the time and billing package he uses can't be moved to a new server at this time.

    So what I'm thinking of doing is joining the 2012 server to the SBS 2003 domain, adding AD and DNS to it (but letting the SBS 2003 server continue holding the FSMO roles so it won't freak out), and move everything BUT the time and billing software to the new server (including e-mail). The issue, of course, is that the new server will be joining a .local domain and we won't be able to change that later on without completely rebuilding the entire system.

    So I was thinking maybe we could use split DNS to solve this issue. I've been reading up on it and it sounds like it would be one way to resolve the issue heading our way 2 years from now. We'll get a SAN cert with mail.company.com and autodiscover.company.com and use split DNS to ensure that, even though the Exchange server will be in the company.local domain, it'll be able to use the cert and serve e-mail internally and externally.

    Thoughts?

  2. Subscribe to our Windows Secrets Newsletter - It's Free!

    Get our unique weekly Newsletter with tips and techniques, how to's and critical updates on Windows 7, Windows 8, Windows XP, Firefox, Internet Explorer, Google, etc. Join our 480,000 subscribers!

    Excel 2013: The Missing Manual

    + Get this BONUS — free!

    Get the most of Excel! Learn about new features, basics of creating a new spreadsheet and using the infamous Ribbon in the first chapter of Excel 2013: The Missing Manual - Subscribe and download Chapter 1 for free!

  3. #2
    Gold Lounger
    Join Date
    Dec 2009
    Location
    Earth
    Posts
    3,429
    Thanks
    7
    Thanked 211 Times in 200 Posts
    The standard for domain naming is company.com with your internal PCs/servers on ad.company.com. Obviously ad.company.com would have no external DNS records.
    Setting up the new server in this domain and then migrating your users is the easiest solution, but it's still a lot of work. You then add a domain trust to allow access to the old server / domain.
    Exchange should only ever have the external domain, company.com, as the mailbox domain. The same for the public facing web site.
    Your external firewall would then pass only specific requests / ports to Exchange and the web server.

    cheers, Paul

  4. #3
    3 Star Lounger
    Join Date
    Dec 2001
    Location
    Atlanta, Georgia, USA
    Posts
    272
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Okay, so from what I've read we should configure the internal and external URL's to point to the external URL addresses - mail.company.com and autodiscover.company.com - and setup split brain DNS on the internal DNS server. So his DNS will have company.local as well as company.com. I've looked at the information at the following link - http://www.petenetlive.com/KB/Article/0000830.htm - and am wondering if this is all I need to do in order to setup split brain DNS so it will work with my friend's situation?

  5. #4
    Gold Lounger
    Join Date
    Dec 2009
    Location
    Earth
    Posts
    3,429
    Thanks
    7
    Thanked 211 Times in 200 Posts
    You should have an external DNS and an internal one. The internal one is part of AD and is authoritative for company.com and ad.company.com, as shown in your link. The external one contains only company.com addresses that you want external people to see, mail, www etc and is hosted by an external DNS hosting company - usually your domain registrar. Do not host your own internet facing DNS as there is a chance of your internal addresses being discovered.

    As there is no upgrade path from server 2003 to server 2012 you need to use a new internal AD domain to allow you to transfer the users to the new server, ad.company.com.

    cheers, Paul

  6. #5
    3 Star Lounger
    Join Date
    Dec 2001
    Location
    Atlanta, Georgia, USA
    Posts
    272
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Hi Paul. Thanks for the reply. So what we were thinking might work is to join the 2012 server to the 2003 domain, add the AD and DNS roles to the 2012 box, also get Exchange 2013 up on the 2012 box (yes, we know you should have Exchange and AD/DNS on the same box), and move everything but the time and billing package to the new server and leave all of this up as long as is necessary. Once he's able to put the time and billing package on the new server we transfer the fsmo roles and decommission the sbs 2003 box. The domain will still be a .local, but if we use split DNS it sounds like this could work. What do you think?

  7. #6
    Gold Lounger
    Join Date
    Dec 2009
    Location
    Earth
    Posts
    3,429
    Thanks
    7
    Thanked 211 Times in 200 Posts
    Exchange should never be on the same box as AD/DNS. Then you can recover one without trashing the other.

    A 2003 domain is not a 2012 domain and you cannot move FSMO roles from one to the other. Create the 2012 server as a new domain, add Exchange and migrate your users and data.

    Back to your original post. There is no issue with SSL certificates and .local domains because you use SSL certificates on the internet and you can't use a .local domain on the internet. If the certificate is to be used internally create a self signed certificate and advise your users to trust it - although I can't see why you'd want one internally.

    cheers, Paul

  8. #7
    3 Star Lounger
    Join Date
    Dec 2001
    Location
    Atlanta, Georgia, USA
    Posts
    272
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Thanks Paul. The problem with the whole thing is that the 2003 box has to remain up and the users have to be able to access it so they can continue using a single application that's not ready to be used on the 2012 server. That's the only reason why we can't move everyone and everything off the old server and onto the new one. That was the original plan until my associate realized that the one application issue existed. So I have to have these two servers living side by side with the users being able to access the old application all day every day for a while. Using the 2 user terminal services license that the SBS box has by default (since it's a server) isn't an option. I'm just trying to come up with an easy way for the two servers to live side by side on the same domain. Any ideas because I was thinking the split DNS idea would work.

  9. #8
    Gold Lounger
    Join Date
    Dec 2009
    Location
    Earth
    Posts
    3,429
    Thanks
    7
    Thanked 211 Times in 200 Posts
    You have to use a new domain and a domain trust.

    cheers, Paul

  10. #9
    3 Star Lounger
    Join Date
    Dec 2001
    Location
    Atlanta, Georgia, USA
    Posts
    272
    Thanks
    0
    Thanked 0 Times in 0 Posts
    But SBS doesn't support domain trusts...

  11. #10
    Gold Lounger
    Join Date
    Dec 2009
    Location
    Earth
    Posts
    3,429
    Thanks
    7
    Thanked 211 Times in 200 Posts
    This MS page shows migration from SBS2003 to server 2012, but I haven't read the detail to know if you can still run the app on SBS2003. If that won't work you may have to go the new domain and persuade your users to log into the SBS box separately, or use a generic server login if the app has its own user management.

    cheers, Paul

  12. #11
    3 Star Lounger
    Join Date
    Dec 2001
    Location
    Atlanta, Georgia, USA
    Posts
    272
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Thanks. I think I'll rebuild the 2012 box, join it to the SBS 2003 domain and then install Exchange 2013 and go from there.

  13. #12
    Gold Lounger
    Join Date
    Dec 2009
    Location
    Earth
    Posts
    3,429
    Thanks
    7
    Thanked 211 Times in 200 Posts
    I doubt you will be able to join a 2012 server to a 2003 domain.

    cheers, Paul

  14. #13
    3 Star Lounger
    Join Date
    Dec 2001
    Location
    Atlanta, Georgia, USA
    Posts
    272
    Thanks
    0
    Thanked 0 Times in 0 Posts
    You actually can join a 2012 server to a 2003 funcational level forest/domain and Exchange 2013 will run in that functional level forest/domain as well.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •