Can't add DNS CNAME record

Question

I have internal AD domain: ad.domain.com external public: domain.com

on DNS I have two forward lookup zone:

ad.domain.com for my active directory, and mail.domain.com - with black A record pointing to my internal IP Mail server.

On public DNS my domain register pointing mail.domain.com to my public IP on router which is next dst-nat to internal mail server - do you think that this configuration is OK?

Now I need that local users typing in web browser address: mail.domain.com automatically go to mail.ad.domain.com, so on mail.domain.com I'm trying to create CNAME pointing it to A record that resides in ad.domain.com with name "mail" and ip address of mail server, and get this error:

"A new record cannot be created. An alias (CNAME) record cannot be added to this DNS name. The DNS name contains records that are incompatible with the CNAME record."

Solution

You are talking about web browsers and location bars, so probably you have some kind of webmail service at the mail.ad.example.com.

The CNAME DNS record has nothing to do with this. A CNAME is just an alias that tells that everything on that hostname is actually on another, canonical host name. Therefore, if you have a CNAME, you can't have any other records for the same hostname. Also, because you probably have MX 0 mail.example.com., it should be A, not CNAME. Do not touch your DNS for this! The only thing you could do is to have local DNS server answering with the local IP for mail.example.com. Even with this you could have problems with local DNS cache.

For redirections, install a web server. If you had external mail.example.com, you could have installed the web server there and set up a HTTP redirect to mail.ad.example.com. Now that the mail.example.com is pointing to the external IP of your network, this is not possible. Second best alternative would be a separate http://webmail.example.com for doing the redirection conditionally:

• if the request is coming from your network, redirect to http://mail.ad.example.com/,
• otherwise redirect to http://mail.example.com/.

There, you should use status code 302 Moved Temporarily, to avoid caching it.

Comments

[Admin]

CNAME is not a HTTP redirection, and there cannot be a CNAME if you have any other record on the same hostname.

[Admin]

What is "DSN" and what is a "forward zone"? I think you need to do some reading on how DNS works.

[zuku]

but I would access my mail server by it's LAN ip not Public WAN IP, so without mail.domain.com as forward zone with A pointing to mail lan ip I wouldn't do that because users then get mail server IP from outside DNS so this IP will be Public one. The second, users need type in browsers mail.mydomain.com, not mail.ad.mydomain.com - so hot to do this without this forward lookup zone?

[Jose Ortega]

Then the zone should just be "domain.com" and you need to add the mail and AD records, you don't need to create a forward zone for each "subdomain" you wanna have in your root. That's bad by design... If you set the internal IP in you mail.domain.com using the only zone (domain.com) and the one you have for the local domain (domain.local zone, usually the one that you used to configure the active directory) that should work fine. They will still have your local IP since it's in the registry you're using . .

[zuku]

I don't want to add mydomain.com to my internal DNS because I have websites on it and other subdomains on it accesible on internet and it's managed by my domain provider. I need to use internally only one - mail.mydomain.com. Only I want to do to could use mail.mydomain.com locally that users save in minds correct e-mial server address, because if they go outside to home or customers they don't get to e-mail server typing my ActiveDirectory internal address: mail.ad.mydomain.com

[Jose Ortega]

Well can't help you're managing badly your DNS

[zuku]

It's the reason I'm here ;)

[zuku]

Can't install mail server on my domain.com as I said I have active directory with "ad" at the begining, and my mail server is already configured at: mail.ad.mydomain.com. Every computer on my network is: pc1.ad.mydomain.com and so on. I do not have locally mx statement.

[Jose Ortega]

you need to get all your sites and do it properly so you can get it to work as it should. If you don't want to add "mydomain.com" as it should i really can't help if you don't wanna do it properly.

[Esa Jokinen]

What happens of you go to the mail.ad.example.com with a browser? What happens, if you go to mail.example.com, having A in the local DNS to the same local IP?

[Esa Jokinen]

So, when you try to open it inside the local network, nothing just happens (or possibly you get some page from the router).

[zuku]

I can open mydomain.com, and mail.mydomain.com DNS responses then are coming from public DNS not my internal. I simply want in LAN type in browser mail.mydomain.com and this would go to internal mail.ad.mydomain.com on webserver internal IP and don't know how to do this.