Router DNS for internet queries instead of AD DNS

Question

Hi,

One of the clients has the following situation - only one AD server located in another data center, outside the client's office. There is a router in the office with DHCP and DNS enabled. An IPsec tunnel is established from the router to the data center where AD is located.

Currently, domain joined computers receive their IP address from the router's DHCP server. The router's DHCP gives the AD IP address as the primary DNS server, followed by two external DNS servers. At the same time, the AD DNS server has the same two external DNS servers listed as forwarders.

Question - is this ok? I don't want the router's DHCP to give the domain joined computers only one DNS server that would be the AD IP, because if the IPsec tunnel goes down, which has happened a couple of times (but not very often), then the computers will no longer have internet.
Is there a possibility that AD DNS is not processing internet queries at all, but only internal queries - the ones that AD needs to?

btw Windows Server DNS is not my strong point. :/

Thanks!

Answer 1

Domain controller and all members must use the static ip address of DC listed for DNS and no others such as router or public DNS. Having the router handle DHCP isn't a problem but do not hand out public DNS. Better option is to add a domain controller at the site.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

Yes, having domain controller at the site would be best option. However, the customer is a government entity and has the ability to keep AD in a secure data center at low cost. And with the client's office space being as big as it is, they don't want to keep a separate server just to run AD because of DNS.

I understand that DNS is basically the basis for AD to work at all, but I think it's kinda stupid that keeping all DNS records on it is a requirement given the various situations. :/