Web Mail Not Working After Adding New DNS Zone

alex.olynyk

yes and it does not

Kelly

By creating the zone you have given your internal DNS servers responsibility for the entire roseradiology.com domain. Therefore, if they do not have a given record they cannot resolve it.

alex.olynyk

So if I add a record for mail.roseradiology.com that should fix?

Kelly

And any other *.roseradiology.com records you will need, e.g. www. ., etc. I'm trying to remember best practices for this. I'm drawing a blank, other than I know that creating a new zone is not what you want to do...

Sorry, today is a little nuts.

JaredBusch

We went down this rabbit hole with you before in the original thread.

As @Kelly just said, if you add roseradiology.com as a zone, then you will need to handle the DNS for it also. Basically you will need to set everything on your internal server to match your external DNS settings. Effectively setting everything twice.

TAHIN

You become authoritative for that domain once you add it as an forward lookup zone - so machines on your internal domain will look there first and only. If you're missing an A record in your new zone, lookups will fail.

alex.olynyk

@JaredBusch So its a bad idea right?

alex.olynyk

so is it better to keep it on rose.internal and register that domain?

alex.olynyk

so what is the best practice here? set everything twice?

Dashrender

@alex.olynyk said in Web Mail Not Working After Adding New DNS Zone:

@JaredBusch So its a bad idea right?

Really - it depends. But I wouldn't say it's bad, it's just a split horizon DNS that you've created.

Dashrender

@alex.olynyk said in Web Mail Not Working After Adding New DNS Zone:

so is it better to keep it on rose.internal and register that domain?

is there a .internal TLD? and what good would it do? You wouldn't want to put internal IPs into a global answering DNS server.

Dashrender

@alex.olynyk said in Web Mail Not Working After Adding New DNS Zone:

so what is the best practice here? set everything twice?

Best Practice - great question,

I see to options

do what you did and manage internal IPs and external IPs separately.
if your router supports hairpin routing, then you can skip the internal hosting of zone roseradiology.com.

Hairpin routing means that your PC wants to go to an internal resource, but DNS declares that it's on the internet somewhere. When the packet gets to the router, it (the router) realizes that the packet is really meant for an internal source, so it sends the packet back to the internal server. Not all routers/firewalls support this.

Mike Davis

As far as best practice goes, Microsoft has gone back and forth on the issue between split DNS and internal domain name. The last time I looked, they recommended a subdomain for your internal network. So instead of domain.com inside and out, or domain.local inside and domain.com outside, they use ad.domain.com inside and domain.com outside.

I've dealt with them all and they all have their advantages and disadvantages. At the end of the day, I think you just need to understand them and pick the one that works best for that client.

alex.olynyk

@Dashrender so a split horizon DNS would be creating a zone for roseradiology.com and then adding internal records for mail, www, etc

Our new active directory domain is rose.internal so would that be the top level domain?

Kelly

What about creating a CNAME that points to the internal A record?

For example:

A 192.168.1.5 ownlcloud.rose.internal
CNAME owncloud.roseradiology.com owncloud.rose.internal

Dashrender

@alex.olynyk said in Web Mail Not Working After Adding New DNS Zone:

@Dashrender so a split horizon DNS would be creating a zone for roseradiology.com and then adding internal records for mail, www, etc

Our new active directory domain is rose.internal so would that be the top level domain?

Correct, rose.internal is your internal TLD. But .internal does not exist on the internet, so you asked about registering it, you can't register is for use on the internet. Think of it like the 10.x.x.x network. You can use that internally, but not on the internet. You can have any TLD internally that you want, but when it comes to what is used on the internet, you have to follow the ICANN rules.

Dashrender

@Kelly said in Web Mail Not Working After Adding New DNS Zone:

What about creating a CNAME that points to the internal A record?

For example:

A 192.168.1.5 ownlcloud.rose.internal
CNAME owncloud.roseradiology.com owncloud.rose.internal

Is of course is the best solution when using Split Horizon DNS because if the internal IP changes, the records will all follow.

alex.olynyk

so whoever hosts the DNS for my domain should be able to create a CNAME to alias owncloud.roseradiology.com to owncloud.rose.internal? Correct?

Dashrender

@alex.olynyk said in Web Mail Not Working After Adding New DNS Zone:

so whoever hosts the DNS for my domain should be able to create a CNAME to alias owncloud.roseradiology.com to owncloud.rose.internal? Correct?

No, that is something you would do internally, on the DNS servers you control. In a Split Horizon setup, the two systems, internal DNS and external DNS, they both are handled completely separately.

But, internally, where you have both rose.internal and roseradiology.com, you can create a record from one domain pointing to the other if you want.

scottalanmiller

@alex.olynyk said in Web Mail Not Working After Adding New DNS Zone:

So if I add a record for mail.roseradiology.com that should fix?

Yes, but it's far from ideal.