Understanding Disjoint Namespace Scenarios with Exchange 2007

Microsoft Exchange Server 2007 will reach end of support on April 11, 2017. To stay supported, you will need to upgrade. For more information, see Resources to help you upgrade your Office 2007 servers and clients.

Applies to: Exchange Server 2007, Exchange Server 2007 SP1, Exchange Server 2007 SP2, Exchange Server 2007 SP3

Every computer that is on the Internet has a Domain Name System (DNS) name. This is also known as the machine name or host name. Every computer running the Microsoft Windows operating system with networking capabilities also has a NetBIOS name.

A computer running Windows in an Active Directory directory service ___domain has both a DNS ___domain name and a NetBIOS ___domain name. The DNS ___domain name consists of one or more subdomains separated by a dot (.) and is terminated by a top-level ___domain name. For example, in the DNS ___domain name corp.contoso.com, the subdomains are corp and contoso, and the top-level ___domain name is com. Typically, the NetBIOS ___domain name is the subdomain of the DNS ___domain name. For example, if the DNS ___domain name is contoso.com, the NetBIOS ___domain name is contoso. If the DNS ___domain name is corp.contoso.com, the NetBIOS ___domain name is corp.

A computer in an Active Directory ___domain also has a primary DNS suffix and can have additional DNS suffixes. By default, the primary DNS suffix is the same as the DNS ___domain name. For detailed steps about how to change the primary DNS suffix, see the procedures later in this topic.

You define the DNS ___domain name and NetBIOS ___domain name of an Active Directory ___domain when you configure the first ___domain controller in the ___domain. For more information about configuring ___domain controllers, see Domain controller role: Configuring a ___domain controller.

The following figure illustrates the page in the Windows Server 2003 Active Directory Installation wizard in which you define the DNS ___domain name of an Active Directory ___domain.

DNS ___domain name

The following figure illustrates the page in the Windows Server 2003 Active Directory Installation wizard in which you define the NetBIOS ___domain name of an Active Directory ___domain.

NetBIOS ___domain name

The procedures in this section describe how to view the following items on a computer that is running Windows Server 2008 or Windows Server 2003:

• DNS host name

• Primary DNS suffix

• DNS ___domain name

• NetBIOS name

• NetBIOS ___domain name

To view the DNS host name, primary DNS suffix, DNS ___domain name, NetBIOS name, and NetBIOS ___domain name of a computer running Windows Server 2008

1. Click Start, right-click Computer, and then click Properties.

2. In System, the DNS host name and primary DNS suffix are displayed under Computer name, ___domain, and workgroup settings, next to Full computer name. The DNS ___domain name is displayed next to Domain.

3. Click Change settings.

4. In System Properties, on the Computer Name tab, click Change.

5. In Computer Name/Domain Changes, click More. The primary DNS suffix is displayed under Primary DNS suffix of this computer. The NetBIOS computer name is displayed under NetBIOS computer name.

   To change the primary DNS suffix, type the new primary DNS suffix under Primary DNS suffix of this computer, and then click OK.

6. From a Command Prompt window, type set. The variable USERDNSDOMAIN displays the DNS ___domain name. The variable USERDOMAIN displays the NetBIOS ___domain name.

To view the DNS host name, primary DNS suffix, DNS ___domain name, NetBIOS name, and NetBIOS ___domain name of a computer running Windows Server 2003

1. Click Start, right-click My Computer, and then click Properties.

2. In System Properties, click the Computer Name tab. The DNS host name and primary DNS suffix are displayed next to Full computer name. The DNS ___domain name is displayed next to Domain.

3. On the Computer Name tab, click Change.

4. On the Computer Name Changes page, click More. The primary DNS suffix is displayed under Primary DNS suffix of this computer. The NetBIOS computer name is displayed under NetBIOS computer name.

   To change the primary DNS suffix, type the new primary DNS suffix under Primary DNS suffix of this computer, and then click OK.

5. From a Command Prompt window, type set. The variable USERDNSDOMAIN displays the DNS ___domain name. The variable USERDOMAIN displays the NetBIOS ___domain name.

Disjointed Namespaces

In most ___domain topologies, the primary DNS suffix of the computers in the ___domain is the same as the DNS ___domain name. The following figure illustrates a typical namespace scenario in which the primary DNS suffix, the DNS ___domain name, and the NetBIOS ___domain name match.

Typical namespace (not disjointed)

In some cases, you may require these namespaces to be different. This is called a disjointed namespace. For example, a merger or acquisition may cause you to have a topology with a disjointed namespace. In addition, if DNS management in your company is split between administrators who manage Active Directory and administrators who manage networks, you may need to have a topology with a disjointed namespace.

A disjointed namespace scenario is one in which the primary DNS suffix of a computer does not match the DNS ___domain name where that computer resides. The computer with the primary DNS suffix that does not match is said to be disjointed. Another disjointed namespace scenario occurs if the NetBIOS ___domain name of a ___domain controller does not match the DNS ___domain name.

Exchange 2007 and Disjointed Namespaces

In Microsoft Exchange Server 2007, there are three supported scenarios for deploying Exchange in a ___domain that has a disjointed namespace. The supported scenarios are as follows:

• Scenario 1   The primary DNS suffix of the ___domain controller is not the same as the DNS ___domain name. Computers that are members of the ___domain can be either disjointed or not disjointed.

• Scenario 2   A member computer in an Active Directory ___domain is disjointed, even though the ___domain controller is not disjointed.

• Scenario 3   The NetBIOS ___domain name of the ___domain controller is not the same as the subdomain of the DNS ___domain name of that ___domain controller.

These scenarios are detailed in the following sections.

Scenario 1

In this scenario, the primary DNS suffix of the ___domain controller is not the same as the DNS ___domain name. The ___domain controller is disjointed in this scenario. Computers that are members of the ___domain, including Exchange servers and Microsoft Outlook client computers, can have a primary DNS suffix that either matches the primary DNS suffix of the ___domain controller or matches the DNS ___domain name.

Domain controller and member computers are disjointed

To allow Exchange 2007 servers to access ___domain controllers that are disjointed, you must modify the msDS-AllowedDNSSuffixes Active Directory attribute on the ___domain object container. You must add both of the DNS suffixes to the attribute. For detailed steps about how to modify the attribute, see The computer's primary DNS suffix does not match the FQDN of the ___domain where it resides.

In addition, to make sure that the DNS suffix search list contains all DNS namespaces that are deployed within the organization, you must configure the search list for each computer in the ___domain that is disjointed. The list of namespaces should include not only the primary DNS suffix of the ___domain controller and the DNS ___domain name, but also any additional namespaces for other servers with which Exchange may interoperate (such as monitoring servers or servers for third-party applications). You can do this by setting Group Policy for the ___domain. For more information about Group Policy, see the following topics:

• Group Policy Frequently Asked Questions (FAQ)

• New group policies for DNS in Windows Server 2003

For detailed steps about how to configure the DNS suffix search list Group Policy, see How to Configure the DNS Suffix Search List for a Disjoint Namespace.

Scenario 2

In this scenario, the primary DNS suffix of a member computer on which Exchange 2007 is installed is not the same as the DNS ___domain name, even though the primary DNS suffix of the ___domain controller is the same as the DNS ___domain name. In this scenario, you have a ___domain controller that is not disjointed and a member computer that is disjointed. Member computers that are running Outlook can have a primary DNS suffix that either matches the primary DNS suffix of the disjointed Exchange server or matches the DNS ___domain name.

Member computer is disjointed

To allow disjointed Exchange 2007 servers to access ___domain controllers, you must modify the msDS-AllowedDNSSuffixes Active Directory attribute on the ___domain object container. You must add both of the DNS suffixes to the attribute. For detailed steps about how to modify the attribute, see The computer's primary DNS suffix does not match the FQDN of the ___domain where it resides.

In addition, to make sure that the DNS suffix search list contains all DNS namespaces that are deployed within the organization, you must configure the search list for each computer in the ___domain that is disjointed. The list of namespaces should include not only the primary DNS suffix of the disjointed member computer and the DNS ___domain name, but also any additional namespaces for other servers with which Exchange may interoperate (such as monitoring servers or servers for third-party applications). You can do this by setting Group Policy for the ___domain. For more information about Group Policy, see the following topics:

• Group Policy Frequently Asked Questions (FAQ)

• New group policies for DNS in Windows Server 2003

For detailed steps about how to configure the DNS suffix search list Group Policy, see How to Configure the DNS Suffix Search List for a Disjoint Namespace.

Scenario 3

In this scenario, the NetBIOS ___domain name of the ___domain controller is not the same as the DNS ___domain name of the same ___domain controller.

NetBIOS ___domain name does not match DNS ___domain name

Getting Additional Help

It is supported to run Exchange 2007 in any of the disjointed namespace scenarios described in this topic. If you have a disjointed namespace scenario that is not one of the three scenarios described in this topic, you must work with Microsoft Services to deploy Exchange 2007. For more information, see Microsoft Services.

In September 2007, the Microsoft Sustained Engineering and Microsoft Product Team created a DNS Disjointed Namespace and Multi-Tree test plan that can be used by customers to test DNS namespace environments that may not supported by Exchange 2007.

For more information, see DNS Disjoint Namespace and Multi Tree Test Plan.