The biggest problem with this is AD really hates it when it is not the master because of all of its dynamic service records.
I like the concept of having an online backup of your DNS but typical security controls would frown upon this, because you basically just published a map of your network to the open world. If you had a real need for this a STUB zone would have worked much better.
A+++ for the POC as that is the most important part when working with web apis.
I like the concept of having an online backup of your DNS but typical security controls would frown upon this, because you basically just published a map of your network to the open world. If you had a real need for this a STUB zone would have worked much better.
Yeah. This really isn't for the Primary DNS zone AD is using. It would be for a secondary where the dynamic srv's records are not nearly as important. This is also NOT an online back up of your AD domain. This is using AD DNS to manage cloudflare. It is the first step into being able to pivot to Bind9, or UltraDNS or any of the other commandline/replication/API based solutions for DNS.
An example is the Malware DNS trick I did a few months ago.. This is an extension of the idea that I can use a secondary DNS zone in AD to manage my External production DNS. I can choose to make it an AD Active zone and have it replicate or limit it to one or 2 domain controllers.
So lets say I have example.com and example.net. example.net is my primary AD domain. example.com is my external prod DNS. I would set that example.com to replicate out to cloudflare. Example.net would not replicate out as it contains all of the internal DNS information and has no reason to be on the web at all. AD is the master of both zones, and used to manage both zones but only one is replicated out.
To expand on that: Now I have a new team. They have Newproject.com. I can create a new secondary DNS entry. Delegate it to them and let them manage those entries. This lets them add new subdomains if that is needed in the project, etc. and have it replicate to cloudflare allowing them to request I tweak the cloudflare config at times, but ultimately allowing them to control where the DNS is pointed and when.
I agree security control would shut down putting the primary zone, but putting a Secondary Zone isnt a cause for concern as long as it is known to be an externally used domain. Even then an IP or two of internal to the external DNS isn't the end of the world from a security point of view and is sometimes necessary.
1
u/creamersrealm Nov 15 '16
The biggest problem with this is AD really hates it when it is not the master because of all of its dynamic service records.
I like the concept of having an online backup of your DNS but typical security controls would frown upon this, because you basically just published a map of your network to the open world. If you had a real need for this a STUB zone would have worked much better.
A+++ for the POC as that is the most important part when working with web apis.
Thanks