Split-brain DNS Synchronizer

The latest version of the script available at GitHub.

Many companies use the same domain name for both internal and external servers hosting. When an internal domain name is a name of AD DS domain, and internal users must access some of the servers by their external IP-addresses, the problem arises: somehow all these external names must exist in the internal zone and the record information in these internal records must be in correspondence with the external ones. There are several possible solutions to resolve such situation:

1. Blindly forward all external requests to AD DS controllers. In this case, domain controllers are the primary name servers for the zone.

Pros:

  • Single point of management.
  • No new software on domain controllers required.

Cons:

  • You cannot point internal and external users to different hosts for the same DNS-record.
  • Requires to allow external users access to internal servers, which might be impossible due to security policies. Possible exposure of internal infrastructure to an external malicious user.
2. Have two separated set of DNS-servers for internal and external zones.

Pros:

  • You can point internal and external users to different hosts for the same DNS-record.
  • External users do not access internal servers.
  • No new software on domain controllers required.

Cons:

  • Two different points of management. DNS-records may become outdated.
3. Use DNS policies – the new Windows Server 2016 functionality.

https://blogs.technet.microsoft.com/teamdhcp/2015/08/31/split-brain-dns-in-active-directory-environment-using-dns-policies/

Pros:

  • Single point of management.
  • You can point internal and external users to different hosts for the same DNS-record.

Cons:

  • Requires domain controllers migration to the latest software, which is not possible for some organizations.
  • Requires to allow external users access to internal servers, which might be impossible due to security policies. Possible exposure of internal infrastructure to an external malicious user.

 

Currently, I prefer the second method, with two sets of DNS servers. But in that case we have another challenge: How to ensure that all DNS-records, which must point to the same location for both external and internal users, are in sync?

I decided that for such records external DNS-servers will be the single point of management . Information from external servers must be replicated to the internal servers but only for the records which must be the same at both sets of NS.

To achieve such synchronization, I created a script which you may find below and at my GitHub. The script supports multiple domain zones and requires two input files:

  • One, with FQDNs of records you would like to synchronize. (Sync-DNSZones-REC.txt)
  • Another one, with name servers sets. Here you define which NS servers to use for which DNS zone. You may define subdomains too: In that case, the best match for a DNS record will be chosen. (Sync-DNSZones-NS.txt)

 

Say that you have defined you NS file as following:
Zone;ExtIP;IntIP
example.com;192.0.2.2;198.51.100.2
example.net;192.0.2.3;198.51.100.3
foo.example.net;192.0.2.4;198.51.100.4

And in the records file you have this list:
foo.bar.example.com
foo.example.com
foo.example.net
bar.example.net
bar.foo.example.net

Therefore, these records will match defined zones like this:
foo.bar.example.com - example.com
foo.example.com - example.com
foo.example.net - example.net
bar.example.net - example.net
bar.foo.example.net - foo.example.net

By default, the script will create a new Event Log with “DNS Zones Synchronizer” name, where errors and warning will be logged. You may setup your monitoring solution to alert you about events in this log.
In addition to the Event Log, the script creates a text log-file by daily basis. These files contain more detailed information about its actions.

If you know any other techniques to synchronize split-brain DNS or have suggestions about the script, you are more than welcome to leave a comment or to create a pull-request.

Leave a Reply

Your email address will not be published. Required fields are marked *