External Mail Issue

[zatch]

Thanks in advance for helping out a DNS newbie.

We have AD domain with domain name = x.local. Within this domain is a mail server that hosts the domain y.com (not the same domain as the AD.) We have a few users that work on notebooks and I'd like to give them access to Exchange Server through Outlook both from within the network and externally when they are on the road. What I'd like to do, then, is setup the Outlook client to connect via the mail server: mail.y.com. This, I assume, would work fine outside of our local network (since we can currently use Outlook Web Access using mail.y.com/exchange but that address will not work from within our network. From what I've read, here is what I think/thought I needed to do:

1) Setup a new Forward Lookup Zone in DNS called y.com (since it is named differently than my local domain, which is x.local)

2) Right-Click on this newly created y.com Forward Lookup Zone, Click New Alias. Alias name = 'mail' Fully Qual Name for host = myServerName

3) Repeat #2 for Alias name = 'www' and place the ip address of the webserver in for the FQND (since it's external of our network.)

Is this correct? I have tried this several times and I have really gotten nowhere. After I create the Forward Lookup Zone y.com our clients are unable to access our website. I thought that when I put the

http://www alias

to the external site in there they would be able to access

http://www.y.com,

but they are not. Also, when I go into Outlook and try to setup a client using mail.y.com it does not find the server.

How can I gain access to mail.y.com from inside our network?

Thanks.

Zatch

 

[somebigguy]

The best way to do this is to spoof your external DNS records internally with internal IP addresses.

For example, on an internal DNS server, create a zone called y.com. Create an address record in this zone call mail and point it to the internal IP address of the mail server. Then as long as they are pointing to the spoofed DNS server when connected internally, they will resolve the mail.y.com to it's internal IP address and connect. Externally, they will resolve it using external DNS servers which will give them the external address.

One issue with this is the internal DNS server with the spoofed zone will not be able to talk to any servers that you have spoofed via their external IP address, since it will only know it's internal address. Furthermore, internal users using the spoofed zone will have the same issue, being only to resolve internal IP addresses. This usually isn't a problem, but could be if users need to access these machines using the external IP address for some reason.

Also, create records for all of your external hosts in the spoofed zone, even if they still resolve to the external address, otherwise if someone tries to access a host that doesn't exist in the spoofed zone but does exist externally, the spoofed zone will tell them the host does not exist.