[There's a reason that Yoda is the unofficial mascot of SBS.  Size indeed matters not.] More on why we want .local, .lan, .bozo, .whocares but not .com, .net or .org - THE OFFICIAL BLOG OF THE SBS DIVA
Tue, Aug 30 2005 21:59 bradley

More on why we want .local, .lan, .bozo, .whocares but not .com, .net or .org

Read this KB

Quoted from there:

The following list describes some of the advantages when you use a separate and private domain name for the local Small Business Server network:

 

  • The management of the local namespace is controlled by the Small Business Server Server. When you use a private FQDN for local DNS name resolution, the DNS server becomes the start of authority for the local domain. This result means that a query to external DNS root servers is not required for local resource name resolution. 
  • The security may be increased for your DNS server by not enabling zone transfers by means of the zone transfer properties of the forward lookup zone. Because dynamic registration of internal hosts can occur with the DNS server, if you disable the zone transfers from external clients, you can limit the exposure of internal host names to the Internet.
  • The natural separation of internal and external networks occurs because of the use of a separate internal namespace. A client query generated from the Internet for www.contoso.local does not return any valid domain information because .local, at the present time, is not a registered domain name. However, by using the Web Publishing rules in Internet Security and Acceleration (ISA) Server, internal Web sites can be hosted externally and viewed by using resolvable domain names. This hosting still requires a registered domain name as well as the appropriate public DNS records that resolve to the external IP address of Small Business Server. Refer to "Configuring Publishing" in ISA Server Help for more information about Web Publishing rules.

 

The disadvantages of using the sub-domain of a publicly registered domain name or a publicly registered domain name include, but may not be limited to, the following issues:

  • Internal clients may be able to resolve resources on the internal domain, however, queries to external resources of the domain are not resolved by the DNS server. For example, if the internal network namespace is configured by using the publicly registered domain name of Contoso.com, only resources that have "A" (Host) records in the forward lookup zone for Contoso.com are available to local clients. This behavior can pose a problem if Contoso.com hosts resources, such as, a web server by means of an external provider or Internet service provider (ISP). Any queries from internal clients to www.contoso.com are resolved as a negative query by the local DNS server because the "A" record for "www" does not exist in the forward lookup zone for Contoso.com. For clients to access external resources, "A" records must be added to the forward lookup zone of the DNS server for those resources.
  • The use of a publicly registered sub-domain name can pose the same problems as described for a publicly registered domain name. If at any time, the start of authority for the registered domain (Contoso.com, in this example) adds records for sub-domains, the currently configured private sub-domain may become public.
  • Name resolution problems that are created by using a publicly registered domain name can be avoided by planning the private namespace around a .local first-level domain so that, in this example, Contoso.com and Contoso.local are both available to internal clients, but Contoso.com is only available to external internet clients.

# re: More on why we want .local, .lan, .bozo, .whocares but not .com, .net or .org

Wednesday, August 31, 2005 6:29 AM by bradley

The SBS group does a great disservice to the SBS community by creating FUD rather than showing them how easy it is to create Host (A) records to support externally hosted Web sites. I've done this in my articles, but haven't given them a SBS spin. Now that I have a better idea of how SBS handles the DNS issues, I'll write up yet another series of docs on elegance and the ecstasy of a well-design split DNS infrastructure.
Thanks!
Tom

# re: More on why we want .local, .lan, .bozo, .whocares but not .com, .net or .org

Wednesday, August 31, 2005 7:09 AM by bradley

FUD maybe. But we have to keep in mind that SBS isn't designed to be managed by an IT professional. It designed to be managed by the end user. While I think that Microsoft needs to get off of it and drop this as a design element, the different domains names do prevent you from doing an accidential zone transfer. It's a little warm fuzzy to have a "private" DNS structure.

# re: More on why we want .local, .lan, .bozo, .whocares but not .com, .net or .org

Wednesday, August 31, 2005 1:23 PM by bradley

In my 6 years of experience in planning, designing, and deploying Active Directory I have never recommened any organization use a split-brain / single-zone DNS structure. This to enhance network security, privacy, and a bunch of other resaons Microsoft gives.

While I have seen split DNS work using the same doman name on the inside and outside, one of the biggest problems I have seen is the need to manage multiple host records in both of the DNS systems. For example, if you are using mycorp.com on the inside and the outside you need to add host records (such as for "www")on the internal DNS servers as wellas the outside DNS servers. This is because the internal servers are setup as the SOA of the domain name and will not forward outside in attempts to resolve the same domain (mycorp.com) name. This potentially increases administration overhead of managing DNS and can complicate the troubleshooting process as well. This is often overlooked.

If a compnay wants the ability route into their internal network, it would be a better idea to use a sub domain such as "corp.mycorp.com". This would still provide a layer of security and simplfy the DNS management.

# re: More on why we want .local, .lan, .bozo, .whocares but not .com, .net or .org

Monday, September 12, 2005 7:52 AM by bradley

Came across this article during google search. Could someone assist in this question?

http://www.experts-exchange.com/Operating_Systems/Win2000/Q_21558207.html

dsfeiken@gmail.com