Separate internal and external answers with AD-integrated split-brain DNS policy

Use this document to resolve one bounded operational decision: Separate internal and external answers with AD-integrated split-brain DNS policy. Only the official source and traced locations below supply facts. Confirm applicability before acting.

Source fact:

The official Use DNS Policy for Split-Brain DNS in Active Directory from Microsoft supports the following bounded statements:

• Windows Server extends DNS Policy support to Active Directory-integrated zones for split-brain deployments. The research record locates this support at Article introduction.
• The documented example selects a zone scope from the server interface on which a query arrives. The research record locates this support at Section ‘How DNS Policy for Split-Brain DNS in Active Directory Works’.

Keep the evidence boundary at these traced claims. They support a review of Windows DNS servers, AD-integrated zones, policies, forwarders, logging channels, clients, and administrative roles; they do not support conclusions outside the source’s stated conditions.

What the source does not establish

The example does not establish that interface-based classification, record parity, delegation, and information-disclosure controls are correct for every split-DNS design. No current deployment state or change approval follows from the source alone. Validate Active Directory replication, domain-controller health, service accounts, routing, time, certificates, and upstream resolution, and treat examples or options as conditional inputs rather than defaults.

Applicability questions

• For source statement 1 at Article introduction, which observable configuration, record, or test can confirm applicability here?
• For source statement 2 at Section ‘How DNS Policy for Split-Brain DNS in Active Directory Works’, which observable configuration, record, or test can confirm applicability here?
• What inventory proves which parts of Windows DNS servers, AD-integrated zones, policies, forwarders, logging channels, clients, and administrative roles are in and out of scope?
• Which condition in Active Directory replication, domain-controller health, service accounts, routing, time, certificates, and upstream resolution must be healthy before evidence is trustworthy?
• What result would disprove the working assumption and return the issue to the owner?

DSE recommendation:

DSE recommends using the cited source as the evidence anchor for this decision. Anchor the review in the cited section and keep observation separate from interpretation. Record the source location, examined part of Windows DNS servers, AD-integrated zones, policies, forwarders, logging channels, clients, and administrative roles, observed and expected states, owner, and reason for deviation.

If the review warrants change, use a bounded implementation with prerequisites, test population, monitoring, abort criteria, and a rehearsed reversal. Sequence checks for Active Directory replication, domain-controller health, service accounts, routing, time, certificates, and upstream resolution and sanitize protected material before retention.

Verification and evidence

A reviewer should be able to retrace the decision from Article introduction; Section ‘How DNS Policy for Split-Brain DNS in Active Directory Works’ through PowerShell exports, zone and policy inventories, sanitized query tests, event-channel data, replication state, and rollback commands. Record what was collected, where, when, by whom, and which system or role it represents.

Record the decision even when no change is made, including uncertainty and the next trigger. Use safe testing conditions for disruptive work, preserve rollback proof, and revisit the conclusion after relevant platform, dependency, vendor, or ownership changes.

Official references

• Use DNS Policy for Split-Brain DNS in Active Directory — Microsoft