内部域控制器无法解析DNS：为何需重复配置及能否规避？

Great question—this is a super common headache when combining public cloud DNS (like Route 53) with corporate internal networks. Let’s break down the "why" first, then dive into solutions to cut down on duplicate work.

Why You Have to Update Both DNS Systems #

Your company’s internal network and the public internet use separate DNS infrastructure:

• When you add foo.example.com to Route 53, that only makes the record available to public DNS resolvers (like your home ISP’s servers or Google’s 8.8.8.8).
• Internal devices (your work laptop, desktop, etc.) are configured to use your domain controller’s DNS servers by default. These servers don’t automatically check Route 53 for records—they only look at their own internal zone files unless explicitly told otherwise.
• If your internal domain matches your public domain (e.g., both are example.com), your internal DNS will prioritize its own records over any public ones. Even if it forwards unknown queries to public DNS, it won’t do so for domains it considers "its own."

In short: Your internal DNS and Route 53 are two separate silos—they don’t talk to each other unless you set up that communication.

How to Avoid Duplicate DNS Configuration #

Here are practical, actionable solutions depending on your network setup:

1. Configure Conditional Forwarding on Your Internal DNS #

Set up your domain controller’s DNS to forward queries for specific records (or the entire example.com domain) to Route 53’s public resolvers:

• For a single record like foo.example.com, create a conditional forwarder that sends all queries for that subdomain to Route 53’s resolver IPs (you can find these in your Route 53 hosted zone settings).
• If most of your public records live in Route 53, forward the entire example.com domain—just ensure your internal DNS doesn’t have conflicting records for the same names (e.g., an internal mail.example.com that shouldn’t point to the public IP).

2. Use Route 53 Private Hosted Zones #

AWS lets you create private hosted zones tied to your AWS VPCs. If your corporate network connects to AWS via VPN or Direct Connect:

• Create a private hosted zone for example.com (or foo.example.com) in Route 53, and add the same record you have in the public zone.
• Configure your internal DNS to forward queries for that domain to AWS’s private DNS resolvers (the VPC DNS endpoints).
• To avoid manual duplication, use AWS tools like the aws route53 CLI or CloudFormation templates to sync records between your public and private hosted zones automatically.

3. Centralize DNS Management with Route 53 #

If your IT team allows, move your internal DNS authority to Route 53:

• Set up Route 53 as the primary DNS for your internal domain, and configure your domain controllers to use Route 53 as their upstream resolver.
• This way, you only maintain records in Route 53, and both internal and public users get the correct resolution (you can use Route 53’s geolocation or weighted routing if needed for internal vs. public traffic).

4. Implement Split-Horizon DNS #

If your internal DNS server supports "views" (like BIND), set up split-horizon DNS:

• Create two views: one for internal users, one for public users.
• For internal users, return the appropriate IP (could match the public IP, or an internal private IP if needed). For public users, return the Route 53 record.
• Use automation tools (like Ansible or custom scripts) to sync records between your internal DNS and Route 53, so you only update one source of truth.

Key Notes #

• Always test changes in a staging environment first—misconfiguring DNS can take down internal or public services.
• Coordinate with your internal IT team before modifying domain controller settings, as they may have security or compliance policies to follow.

内容的提问来源于stack exchange，提问作者Muhammad Rehan Saeed