ISSUE: Your boss has tasked you with creating some new service (such as an instant messaging server), or perhaps management wants to move your company’s external website from third-party hosting to internal hosting. In either case, the service will be accessed by both internal and external users. Traditionally, this would require the use of two names: an internal one (“chatserver.internaldomain.local”) and an external one (“chatserver.externaldomain.tld”).
PROBLEM: Using two names creates confusion in two ways. First, your users might not be technically savvy enough to understand the difference between internal and external names. They might try accessing the chat server or website using the external name from inside the company or the internal name externally, either of which will result in failed connections. Secondly, your firewall or proxy server software might not handle internal->external->internal connections gracefully. If your internal users try to connect to your company’s external website, chances are that DNS will resolve to an external IP address; most firewall, proxy or NAT software that I’m familiar with don’t care for this type of setup at all, and problems may result from configuring your domain this way.
SOLUTION: Use a Forward Lookup Zone in your local DNS to resolve “external” IP addresses to local ones. This allows you to give your users a single address for the new chat or web server. And since anyone inside the company will use local DNS to resolve your external domain to local addresses, you can avoid any unpleasantness with your proxy\firewall software, since the packets will never hit the proxy in the first place.