1

We are planning to switch our environment from workgroup to domain (active Directory services). We are planning to register our top domain at some public register. That domain is going to be used just for ActiveDirectory and internals. We are planing to use simple domain name as possibile mycompany.com

My DNS is going to be at private subnets and private IP addresses. When I do register my domain, registrar is going to ask me for DNS servers. Shodu I give them my local DNS servers for public registers ? Or is better to by some www reachibile DNS like AWS route 66 and point my domain to that DNS after that on that DNS server do redirect to local DNS servers. Or it is OK to do public register domain whit private DNS servers.

adopilot
  • 1,521
  • 6
  • 25
  • 41
  • If you have no intention of using it publicly then don't point it at anything. The Registrar will host the DNS zone on their name servers and will probably point the domain to a generic landing page. As Dan stated in his answer, use a subdomain of your public domain for AD, like `ad.company.com`, or whatever. – joeqwerty Jan 29 '15 at 17:19

2 Answers2

2

If you're buying the domain purely to reserve the name (And that's fine and recommended because you shouldn't be using AD Domain Names that you don't control) then it simply doesn't matter. It doesn't need to resolve to anything externally at all - you're just ensuring that the domain belongs to you and that you can buy certificates for it in future etc. I'd advise against having them point to your local internal Active Directory DNS, though.

The only time this stuff really matters is when deciding what to do with regards to DNS from inside and outside. Inside, mycompany.com has to always resolve to your Domain Controllers using Round Robin DNS - so, essentially, you're cutting off the ability to access mydomain.com internally. In your case, that may be fine, but you should be aware of it because it's not really something you can fix - just work around horribly at best.

A better approach may be to simply use a subdomain of a company domain you already own. So if you have mycompany.net already (Or plan to expand that into a website), simply use ad.mycompany.net. Again, there's no need to actually DO anything from the outside on this - the point is simply that you control ad.mycompany.net. Internally, mycompany.net can still use external DNS servers (Unless you want Split DNS) without breaking anything.

Dan
  • 15,430
  • 1
  • 36
  • 67
0

Certainly register your my company.com domain and use something like AD.mycompany.com. If you decide to selfhost the DNS zone you will need to setup a publically accessible dns server. As I suspect your top level domain will be largely unused,i suggest you use a registrar that provides DNS services. You can then delegate the AD subdomain to your servers.

Since you mentioned IP subnets do not forget to take IPv6 into consideration now rather than later.

Jim B
  • 24,081
  • 4
  • 36
  • 60