@Dashrender - You generally rely on one or the other. I don't know that it will use both root hints and forwarders.

You do get slightly better performance out of forwarders, but we're talking about miliseconds. Also, if you have multiple DNS servers, you should remember that forwarders are not stored in Active Directory. You would need to configure your forwarders on each of your DNS servers independently.

Root Hints tend to provide more redundancy. While you only see thirteen of them in the list, many of them are distributed geographically and provide their own type of fault tolerance. I believe there are 457 active root DNS servers right now.

The difference in performance is so small that it's really only a matter of preference. You'll get the same result with either. The only real difference is that when you are using Root Hints, you'll perform a series of iterative queries and expect referrals until you get the authoritative server for the domain you're interested in. When you use a forwarder, you're sending a single recursive query to the forwarder and letting that DNS server handle all of the iterative queries and return you the final answer.

Personal preference. I go with the one that requires less configuration and provides more reliability, even if it's at the expense of a few miliseconds on the response time.

I generally skip forwarders all together. I've never used them. But then again, I've never found a reason to.

Have you considered using Firewall Builder? I've used it before to configure iptables and it works quite well.

@JaredBusch,

If the website is hosted externally, and you are using that same domain name internally (guardiananytmie.com) then you may need to set up a delegation for the www subdomain. You would delegate another DNS server (Google's public one or maybe your ISP's) to resolve the subdomain.

I've seen this help many times, so I hope it helps you, too.