[Myner]

Is it advisable to set up a Windows 2003 native mode network (win 2003 servers, winxp pro clients) so that clients have one internal nameserver (for AD info) and one external (public) one?

Or is it better to have both name servers as internal (both with the full AD service entries), with forwarding set up for queries for external hosts?


Basically, we have the problem where the clients query the outside nameservers first even though the internal NS is listed first in their config.

I understand the XP resolver does not necessarily query the first NS in the list. Is there a way to force it to do so?

Or, will setting NegativeCacheTime to zero be sufficient to force clients to always try the internal NS if they query the public NS first and fail to get an A record for the requested host?

Thank you,
Myner

[Myner]

I am stupid.

The clients should be set to use the internal nameservers, and the nameservers should have forwarding correctly set for domains the internal ns's aren't authoritative for--correct?

I would appreciate if it someone could confirm. (Because I am stupid but very appreciative!)

[wkasdo]

> and the nameservers should have forwarding correctly set for domains the internal ns's aren't authoritative for--correct?

Correct. You should NEVER have a situation where two DNS servers listed in the TCP/IP properties do different things. That way lies madness. The usual setup is that DNS clients point to one (or two) internal DNS servers, and that these DNS servers somehow resolve the rest of the world. The usual trick is to have them forward to the DNS of your ISP.

[wullieb1]

I'm in agreement with wksado.

Setup your internal DNS servers to resolve for internal client. Add in forwarders to your internal DNS server (Typically your ISP DNS server but can be any). Set your clients to resolve all DNS to internal DNS only.

I have seen situations where a client was running an ADSL router and using it for DNS resolution. This was fine as they were using a mixture of 98 and ME clients (don't ask i never set it up) then they started to implement XP. As we all know XP is very reliant on DNS. That is when the fun started.

It eventually took me 4-5 hours of debugging to determine that they were not using the correct DNS settings.