Internal domain name same as external domain - DNS issues!!
-
@JaredBusch said:
The only thing you could do is redo AD. Microsoft documentation uses ad.domain.com in their examples for this reason.
He had asked me about this offline and it appears, from our brief conversation, that the only impacts he is seeing is that he needs to manually put in external addresses into DNS (like www.mysite.com) so that it will resolve and the default domain points to the DC, not the website. As long as users are okay with that one URL not being usable and he's okay with the small amount of manual DNS entries, it looks like that is his only impact and he is fine not changing the domain at this point.
Unfortunate and not best practice, but it appears that the issues are minimal and his best option is to just remain with it as it is at this point. Not worthy modifying the domain now.
-
@scottalanmiller said:
@JaredBusch said:
The only thing you could do is redo AD. Microsoft documentation uses ad.domain.com in their examples for this reason.
He had asked me about this offline and it appears, from our brief conversation, that the only impacts he is seeing is that he needs to manually put in external addresses into DNS (like www.mysite.com) so that it will resolve and the default domain points to the DC, not the website. As long as users are okay with that one URL not being usable and he's okay with the small amount of manual DNS entries, it looks like that is his only impact and he is fine not changing the domain at this point.
Unfortunate and not best practice, but it appears that the issues are minimal and his best option is to just remain with it as it is at this point. Not worthy modifying the domain now.
Correct, Really it is just that users will have to be trained to enter www in front of domain.com to get to the website. All links to the website will have to explicitly use www or it will fail.
-
If having to tell/train users to type www. in front of their domain name to view their own website internally is the biggest problem I'll face then it's probably not worth me renaming/reconfiguring it all over again then.
Would there not be any other implications/issue's i'll face down the line?
If our email system is on office365 am I safe in saying the emails wont have any issues or be affected?Should I want to rename the domain name to be AD.domain.com is that a big task to do?
-
@Our-Tech-Team said:
Would there not be any other implications/issue's i'll face down the line?
If our email system is on office365 am I safe in saying the emails wont have any issues or be affected?You are safe, Office 365 is external and MX records are not a problem as Office 365 is outside of your AD Domain's DNS reach. Office 365 has no idea that you have a DNS overlap inside the LAN.
-
@Our-Tech-Team said:
Should I want to rename the domain name to be AD.domain.com is that a big task to do?
Yes, because you cannot simply rename a domain.
-
Yeah, you would basically be recreating your domain from scratch. It's rather a pain. You want to avoid it if possible, unless you are just like five users, perhaps.
-
@Our-Tech-Team said:
If having to tell/train users to type www. in front of their domain name to view their own website internally is the biggest problem I'll face then it's probably not worth me renaming/reconfiguring it all over again then.
You also need to look at the website code itself. If there are any hard links to http://domain.com in the code they will fail from within the office.
-
@Our-Tech-Team said:
Would there not be any other implications/issue's i'll face down the line?
If our email system is on office365 am I safe in saying the emails wont have any issues or be affected?You should not have any problems as long as there are no MX records on your internal DNS server.
-
no mx records are present on our server at all.
I dont have a problem with the website not working internally (without the www). I'll see if i can convince them next week though! Thanks for your help.Next time, i'll be sure to name it something other than the same domain name!!! sigh
-
@Our-Tech-Team said:
Next time, i'll be sure to name it something other than the same domain name!!! sigh
Current best practice is to use a subdomain, such as ad.yoururl.com. The addition "ad" at the beginning makes it obvious that it is just for AD and that it is not the same domain as anything else.
-
@scottalanmiller noted! lesson learned. thanks again
-
It is a common one, lots of people do that.
-
How is this a brand new problem unless they are a brand new company and new network.
If the while system is that new... It might be worth redoing AD....
As for email, you'll need to setup the needed records for active sync to work inside your network as well.
-
@Dashrender said:
If the while system is that new... It might be worth redoing AD....
Unless it is so new that they have not started using it, is that true? How does age of authentication change the effort in renaming?
-
@scottalanmiller said:
@Dashrender said:
If the while system is that new... It might be worth redoing AD....
Unless it is so new that they have not started using it, is that true? How does age of authentication change the effort in renaming?
If they only have one or two servers and a small handful of folders to change permission on.. If you were ever going to do it... Now would be the time.
-
@Dashrender said:
@scottalanmiller said:
@Dashrender said:
If the while system is that new... It might be worth redoing AD....
Unless it is so new that they have not started using it, is that true? How does age of authentication change the effort in renaming?
If they only have one or two servers and a small handful of folders to change permission on.. If you were ever going to do it... Now would be the time.
Regardless of how many that is, wouldn't the current state be "all of them?"
-
It will always be all of them... But unless you are at 10 today and plan to never grow.... Then why not do it when you're small.
Are you saying the effort is just never worth it until there is a reason to worry about it? While that can make sense, assuming the effort is around 10 computers. I think the ounce of prevention today is worth it.
Of course if he is so swamped doing other things that makes the company more money, more efficient, etc.... Then he should do those things
-
@Dashrender said:
It will always be all of them... But unless you are at 10 today and plan to never grow.... Then why not do it when you're small.
That doesn't make sense. What if he put it in twenty years ago but was only at ten people today?
You can make an argument, like I did earlier, that if the environment is small enough it might be worth moving now. You could make an argument that if you expect to grow dramatically that it might be worth moving for some reason, although I don't believe that this is true - having to type in www is an easy fix at any scale. But what I don't see is how the age of the environment is a factor. If you are five minutes old and have a million users or twenty years old and have five, it is the number of users, not the age of the environment that determines if the effort might be worth it.
-
@Dashrender said:
Are you saying the effort is just never worth it until there is a reason to worry about it? While that can make sense, assuming the effort is around 10 computers. I think the ounce of prevention today is worth it.
No, just saying that the age of the environment is not a factor. That's a form of the sunk cost fallacy - you are thinking about the means and ignoring the ends. But that doens't work. It's the state of things that determines the value for the future, not "how it got to be this way."
-
While I probably did mention age, most would not fixate on it. As you said the important part is the number of users. Of course the expectation of someone posting here who has a brand new AD would be that they had a million users.
To me this is you being weird, fixating on a wit and not my intent - of course we're in IT and need to be specific.... But I'm posting from my phone, and often don't word things perfectly when doing so.
