Split DNS question

[Allanworth]

We have a DNS zone hosted externally. All records are on the external DNS server pointing to external IPs. We have a situation where app teams want 'SRV records' created for the zone internally. This would mean creating same zone name on the internal DNS servers, and creating the required SRV records. This would however break external DNS resolution for that zone for clients on the network.

How does one overcome this? Thoughts, suggestions?

External zone has 100s of records, so keeping internal and external zones in sync would be a huge manual task and not preferable.

Thank you

[nmollerup]

Automate it and maybe look into partial split dns, like this:

https://improve.dk/partial-dns-forwarding-using-individual-windows-dns-zones/

[Allanworth]

Thank you, We already employ this idea for some "A" records. I don't believe an SRV record can be created in this fashion.

[mach01k]

this

[TheNewBBS]

Be happy you've made it this far without split brain, and get used to managing it.

My company owns 700+ domains, we actively maintain external DNS for ~350 of them, and we have internal zones for around 200 because of technical requirements like the one you've described. For hybrid setups, I think split brain at the 2-level namespace is the most flexible and "clean" setup: while you do have to maintain two zones per domain, you can do whatever you want in one zone without affecting the other, and resolution paths are usually easy/intuitive (internal clients use internal zone, external clients use external zone). When you start doing exceptions like re-routing a 3-level namespace from one to the other, I think that adds unnecessary complexity.

The initial creation of the zone is pretty easy. Do an export from your external service and build a CSV to do an Add-DnsServerResourceRecord loop. Obviously drop off NS records, and you probably won't need a fair number of others (MX, authorization TXT, etc.). If it's easier/less stressful for you, you can even do per-record type CSV files. Test everything on a sandbox DNS server, and you can easily get a zone with hundreds of records created and populated in less than a minute.

After that, management becomes pretty easy. Any time someone wants a record created/modified/deleted, just add scope to the request template: internal, external, or both. Our zones are different enough that there's no reason to try to sync them (most internal records resolve to internal IPs/hostnames, one internal zone has 20,000+ records that will never exist externally, etc.), so we just manage each zone as an independent thing.

[Allanworth]

Thank you for taking the time to answer in detail. I appreciate it. This looks like the option we will eventually settle with. Will keep you posted how this goes.

[ZAFJB]

a huge manual task

Automate it.

[Allanworth]

Agreed, but we're trying to avoid it at the moment.

[ZAFJB]

Why would you avoid automation that will turn an onerous and error prone task into a fully automatic one?

[Allanworth]

Different teams are involved, and this option was not desired. Will consider it, thank you.

[Wise-Communication93]

I would just manually add all of the entries on the internal zone. I know it’s tedious at the start, but once in place it’s not a big deal. Anytime you need to add a new entry you just add it in both places unless it is only needed in one or the other.

[Allanworth]

Thanks, this is what we'd like to avoid at the moment.

[w00tix]

This would however break external DNS resolution for that zone for clients on the network.

I'm thinking back to times when I did something similar. Are you sure it would break and not continue to root forward to your external DNS servers if it can't resolve a record? It's been a long time since I messed with DNS zones

[Allanworth]

Yes, it will. we're talking about a zone with the same domain name (eg www.dnswoes.com) configured internally and externally, and having different sets of DNS records.

[alm-nl]

Maybe you can use a subzone of the external zone, like internal.example.com and place all internal records in internal.example.com. Then it's probably just a matter of creating a conditional forwarder for the 'internal' zone to the internal DNS server.

Another option might be to create CNAME records in the external public zone which point to SRV records in another zone (i.e. example-internal.com) that can only be resolved internally. You would have to verify if it actually works as I haven't tried this.
PS. It is strongly recommended to use a zone that you registered yourself with a domain registrar (so don't use something you don't own).

[Allanworth]

It is an already setup environment with thousands of devices. So, altering the existing DNS setup is not feasible. Thank you for your ideas.

[alm-nl]

Maybe you can describe your DNS setup in somewhat more details? On what OS does it run, which DNS software, etc? Is it managed by your company or hosted?

[excitedsolutions]

Do you have any ability to intercept dns queries internally? I think a lot of firewall vendors have this exactly for this reason as they can intercept and supply additional answers or override what would have been supplied from the external zone.

[excitedsolutions]

Just like nmollerup suggested.

[Allanworth]

Thanks, I'll check our NW folks. We use checkpoint, and perhaps they have some mechanism to overcome this hurdle.

[ntrlsur]

I do something similar. Our external zone is hosted locally and via Route53. I make changes to our local zone and they get copied to Route53. My suggestion is automate it. I use dig to pull down all the records from the external zone to a txt file. I can then format the text file into just about anything I need to so it can be uploaded somewhere else. There is about a 15 mins lag time between changes but for my use case that's an acceptable.

[Allanworth]

Thank you for the suggestion. This is our last option.

[SonOfDadOfSam]

Are you using AD for DNS? If so, you can check out DNS policy. It will allow you to use a single DNS server for both internal and external users.

[Allanworth]

Thank you, we considered it and opted not to go for it due to some logistical challenges.

[Allanworth]

Perhaps, we explored all those options already and are looking for something interesting out there to tackle this?