Changes to support DNS scaling?

Question

Hello DNS Gurus,
I'm not sure I have the best subject for this question so let me describe my situation.  I have:
my own registered domain (example.com)
one ML/Server 2.2.2 2010 MacMini (call it server1).
another 2010 MacMini server (call it server2) that I'm bringing into the network and was trying to set up as secondary zone for primary DNS server (on server1)
a record for example.com with dyndns.org because getting a staic ip address isn't an option with my ISP (although I want one--I wish Santa could bring me one).
routers that I have used and have successefully NATd and port forwarded for services I want to access.
When I set up server1, followed the Server.app set up, I put server1.example.com as the hostname which then set up DNS, creating a primary zone for server1.example.com.  Ok, having read a few threads here and around the net, I realize with a brand new server I could delete that and set up the zone as example.com.  Technically, it appears Server.app would also let me add another primary zone so I guess I could add example.com as a primary zone?
But server1 is currently providng serveral services to the small network including profiles and MDM.  I suspect if I make too dramatic of DNS changes I'll have to reenroll all my devices which is manageable.  But, I'm also concerned about messing up other services permanently?
One thing about this configuration I do not like is that I have to use example.com (or a web hop) to access my network from outside but I have to use server1.example.com from the inside.  This isn't very seamless, especially as I work to open a couple more services to the outside.  That said, since I primarily use VPN it has been manageable.
I've also read that a primary zone should only be hosted in one place, which for my domain is currently at dyndns.org.  So, if I add a primary zone record on an internal server, will I be angering the DNS gods?  Since I don't plan to open up the DNS to the outside, I suspect it doesn't matter.  Am I wrong?
I'm adding the second server in because I'm working a migration of the ML to Mavericks/Server 3 and I am expanding capabiliteis of the network which I plan to host off server2.  I could skip DNS with it but where would the fun in that be?  Oh, and since my third party cert is coming due in about two weeks, this is a good time to start the process. 
It seems my options are:
Skip DNS on the second server and leave the rest of the DNS records alone.
Add a second primary zone on server1 for example.com.  Then add records for the server2 and my linux servers until that zone.
Redo the DNS on server1 and reconfigure services as requried.  I don't mind the workk but data loss would not be acceptable.  I'm guessing that I could shut down services before makind the DNS changes and then bring them back up after rebooting without too many problems (except for re-enrolling devices).
Other options?  I can user server 2 to test option 2 for DNS configuration, but it won't help me with potential loss of service data if I try making the change on server1.
Comments and suggestions are welcome.
Thanks!
Tim

Answer 1

Please make no references to DynDNS here.  DNS is not hosting your domain for you.  They're giving you a pointer from within their DNS servers, which is a very handy way for a dynamic site to not have to refer to whatever IP address your ISP DHCP server most recently coughed up.  That's separate from a DNS registration, and not a domain you should be running DNS services for.
I'd strongly advice against configuring your internal network as "squatting" in one of the DynDNS domains.   Particularly if you might ever obtain static IP, and start working with your own public and private DNS.  You'll just have to undo all that and migrate to a domain you have registered.   Treat DynDNS as a cheap and effective way to get to your firewall for a VPN or related, and plan to replace that as soon as you can utilize static IP.  Put another way, keep control of your own domain and your own registration, and of your own network.
Yes, your zone would be example.com.   Not server1.example.com.
As for your new server, I'd likely set up the new server as a secondary of your existing DNS server, and update your DHCP and local static IP references to refer to both of your DNS servers.  Both configured for the example.com zones; one primary, one secondary.
I'd usually have no references to DNS servers located off your network.  Not explicitly, and probably also not as a DNS forwarder.
I'm also fond of having a VPN server in the gateway firewall for cases such as this, as this avoids the VPN (which wants to identify and maintain the endpoints of the connections) and NAT (which wants to hide the end-points of the connections) from working at cross-purposes.  It also means there are no dependencies on a particular host; your VPN terminates on your private network, as if it were another host on your internal network.
FWIW, stay out of 192.168.0.0/24 and 192.168.1.0/24, given you're planning on using VPNs.  VPNs are based on IP routing, and IP routing doesn't like finding the same subnets on both ends of a connection, and there are a gazillion coffee shops, hotels and home networks in 192.168.0.0/24 and 192.168.1.0/24.  Pick another subnet in 192.168.0.0/16, or somewhere in 172.16.0.0/12 or 10.0.0.0/8; somewhere else in the private blocks.
In addition to the main DNS article referenced above, please also see Suffering DynDNS Confusion when setting up DNS services?