When you’re naming domains, it should be planned as carefully as you would in naming your first child – of course I’m exaggerating – but it’s worth planning carefully. For those of you who fail to heed this advice, we’ve written a tutorial on how to rename a domain. 🙂
Popular Domain Naming Mistakes
Before we discuss current best practices, there are a couple of popular practices that are no longer recommended.
The first is using a generic top-level domain. Generic TLDs like .local
, .lan
, .corp
, etc, are now being sold by ICANN, so the domain you’re using internally today – company.local
could potentially become another company’s property tomorrow. If you’re still not convinced, here are some more reasons why you shouldn’t use .local
in your Active Directory domain name
Secondly, if you use an external public domain name like company.com
, you should avoid using the same domain as your internal Active Directory name because you’ll end up with a split DNS. Split DNS is when you have two separate DNS servers managing the exact same DNS Forward Lookup Zone, increasing the administrative burden.
Get the Free PowerShell and Active Directory Essentials Video Course
Better Naming Options
For the time being, until things change, as they inevitably do, here are two domain naming options for you.
The first one is to use an inactive sub-domain of a domain that you use publicly. For instance: ad.company.com
or internal.company.com
. Advantages to this most-preferred approach includes:
- Only one domain name needs to be registered – even if you later decide to make part of your internal name publicly accessible
- Enables you to simply and separately manage internal and external domains
- All internal domain names will be globally unique
The only microscopic drawback is that you’ll have more to type when entering FQDNs on your internal network, so make your subdomain name as short as possible!
However, if it is not feasible for you to configure your internal domain as a subdomain, you can use another domain that you own, which isn’t used elsewhere. For instance, if your public web presence is company.com
, your internal domain can be named company.net
, only if it’s registered and if it’s not used anywhere else. The main advantage is that you’ve secured a unique internal domain name. However, the disadvantage is that this approach requires you to manage two separate names.
And, once you’ve mulled over names, you’ll want to visit this site to ensure you don’t let a tiny colon :
or tilde ~
ruin your day.
What you should do now
Below are three ways we can help you begin your journey to reducing data risk at your company:
- Schedule a demo session with us, where we can show you around, answer your questions, and help you see if Varonis is right for you.
- Download our free report and learn the risks associated with SaaS data exposure.
- Share this blog post with someone you know who'd enjoy reading it. Share it with them via email, LinkedIn, Twitter, Reddit, or Facebook.

Michael Buckbee
Michael has worked as a sysadmin and software developer for Silicon Valley startups, the US Navy, and everything in between.