Gfrktyl

I am relatively new to Active Directory.

In the LAN, we need to return some local addresses for some names but for some other names, we just want to get the IP as-is from the external DNS.

Example: IN LAN:
name1.domain.com : 192.168.1.114 (this would be resolved by AD and points to a LAN server)
name2.domain.com : 52.45.123.21 (this would be resolved by a public DNS)

OUTSIDE THE LAN:
name1.domain.com : 34.54.12.56 (this would be resolved by a public DNS)
name2.domain.com : 52.45.123.21 (this would be resolved by a public DNS)

How can we do that without replicating all the DNS entries from the public server in the Active Directory DNS ?

What I see now is that to get the IN-LAN examples to work, I need to define BOTH name1 AND name2 (even though I dont want to modify the IP of name2 -- the public DNS value is what I want).

In other words, I wish to redefine some of the DNS entries but not others.

Any way to do that ?

Thanks

Unfortunately, manual setup is the name of the game for this scenario. As @Seth pointed out in his comments, you're talking about what we call a Split-Brain DNS setup. And while there are several methods to accomplish this, depending on your exact network layout and the software running your various services, they all come down to "manual upkeep."

The Domain Name System is designed with the idea that each zone has only one record of authority. That is, if your zone is domain.com then every record that ends in domain.com is defined the same. It may be replicated among multiple name servers, but that is for redundancy reasons not for "different values in different places" reasons. Which in turn means that name1.domain.com, by the DNS design, should return the same value everywhere.

You can "hijack" this by exerting overriding control within a network that you fully control.

One common method is Split-Brain DNS. If you have a private internal DNS server on your network, then you can load it up with local zones that don't match the publicly available information (one brain on the internet, the other on the LAN). Now your local server will answer with information from its zone configuration, assuming that it is the primary authority for up-to-date info; and likewise the public DNS will believe it is in charge. Neither will look to the other for information because they believe they are the primary source. But that is the kicker, each one thinks it is in charge, so there is no reason for it to look elsewhere. And that results in you having to maintain two separate zone configurations (not always fun, but a part of the average day for most of us). If either server realized it needed to look elsewhere it would be admitting it wasn't authortative for the zone, and that it needs to look elsewhere for every request made of it.

Another method that you'll still see fairly often is the DNS Rewrite (aka DNS Doctoring). This method is only effective if the domain.com name isn't your AD domain (read: nothing internally needs to be able to automatically update DNS entries on this domain using the built-in Windows DNS client). In the event that you have an existing external domain.com setup for services other than AD-DS, but you want internal users to hit a different IP (an internal portal version, a faster route, whatever) then you can do re-writing. In this setup the one and only DNS server is the internet/public DNS, and you have elements at your network edge that modify DNS responses. This used to be a common setup on lots of NAT devices when making static maps (like when setting up DMZ elements). The NAT sees a DNS response coming through with the response value of 34.54.12.56 and it automatically replaces the data in the payload so that the response received by the client is 192.168.1.114. In this scenario, you maintain the full DNS zone in the external server; and then you keep your rewrite rules up-to-date with only the things you need to have be "different" within your network. Again, there is manual upkeep here as well, but this method has the advantage that you only double-enter the specific items that need doctoring, not every single record (and the down side is that you have to open/inspect/modify packets flowing through the network at the LAN edge).

Either way requires manual intervention and double-entry of data. The more common and stable approach is the Split-Brain method. But, as DNS Doctoring shows, there are other ways to accomplish what you're aiming for; each with their own benefits and drawbacks.

TLDR If you want the standard approach that is most commonly used, and that we know works through plenty of experience, then you should stick with Split-Brain DNS. It works with AD, even on the primary AD/DS domain. But it does require having a fully authoritative zone in both the internal and external worlds.