Authoritative DNS server returning private IP

[beatdown]

We have a Windows Server 2008 box, acting as an authoritative DNS server. The server is behind a firewall, and has a private IP address.

We've setup the necessary host records, and everything works fine if someone on the internet browses to

http://www.ourdomain.com,

or ftp.ourdomain.com, etc...

The problem is if they leave out the

http://www or

ftp, and just go to ourdomain.com. The result, is that it resolves to the private IP of our DNS server, which obviously won't work on the public internet. Likewise, if they try to ping ourdomain.com, it resolves to the private IP.

In the DNS console of the server, I can see there is a host (A) record with the private IP, with the host name listed as (same as parent folder). This record is automatically created, and if I delete it, it just automatically comes back after a little while.

If it matters, the DNS zone is Active Directory integrated.

Can anyone tell me how to fix this, so the server stops responding to DNS queries with it's private IP?

Thanks!

 

[TechyMcSe2k]

Is your internal (LAN) domain name the same as your public (WAN) facing domain name?

http://www.samtechconsulting.com

_______________________________________
Great knowledge can be obtained by mastering the Google algorithm.

 

[beatdown]

Yes, the domain name is the same for both the internal active directory domain, and the public domain.

 

[TechyMcSe2k]

OK, not best practice on that one. That is your issue. You are going to have to put your website in your DMZ on a workgroup server that is not on the domain. You will need your outside DNS to resolve into that box with a public IP assigned to one of its NICs. You shouldnt have your website on your internal LAN at all.

http://www.samtechconsulting.com

_______________________________________
Great knowledge can be obtained by mastering the Google algorithm.

 

[TechyMcSe2k]

or just NAT the public IP to the private address of the external facing nic.

http://www.samtechconsulting.com

_______________________________________
Great knowledge can be obtained by mastering the Google algorithm.

 

[TechyMcSe2k]

If you have outside DNS, then point your root domain.com to the same IP as you have

http://www.domain.com

and you should be fine. That way when someone on the internet puts domain.com in their browser, it goes to the same NAT'd webserver you are hosting internally.

http://www.samtechconsulting.com

_______________________________________
Great knowledge can be obtained by mastering the Google algorithm.

 

[beatdown]

I should add some more details about this environment...

This DNS server acts as a Dynamic DNS (DDNS) server, just like dyndns.org or one of the well known public ddns services.

One of the requirements of the DDNS software, is that it be put on a domain controller, and that the DNS be Active Directory integrated.

So this DNS server already exists in a DMZ, and there is nothing else in that DMZ. This isn't the Active Directory server we use on our LAN.

The server has a private IP, and the firewall is setup to NAT the public IP, and pass traffic on port 53.

So there is no website involved, and there is no outside DNS server...this server is the authoritative server for the domain.