Split-Brain DNS

You can now test your split-brain configuration from your workstation. But before you do, make sure to flush your DNS cache by entering the following from a command prompt: ipconfig /flushdns Type www.mydomain.com into your browser, and your site should load. Neat, isn’t it?

You can add additional hosts to your newly created zone for any other resources, such as a mail server or a terminal server, that you want to access by the same name both internally and externally.

Divide to Conquer
You can modify the solution presented above by having your internal AD DNS servers answer queries only for AD resources and forwarding all other requests to another set of internal DNS servers. This other set would contain your private IP records for mydomain .com and recursively answer queries for all other domains. This type of segregation can help both with risk mitigation and administration delegation because the AD DNS servers would be separate from the DNS servers you use for split-brain resolution.

An alternative to split-brain DNS would be to use a third-party solution at the edge of your network that can rewrite the IP addresses returned in packets containing DNS data. For example, Cisco’s PIX and ASA appliances have a feature called DNS Doctoring that performs such rewrites. All of these methods are fairly easy to execute, but you should still try them in a test environment before making changes to your production environment. Happy querying!