I'm advising a large client on how to isolate their dev and testing from their production.

They already have one domain, lets say xyz.net with the active directory domain as "XYZ01".

I want to add second domain say QAxyz.net and make its active directory domain "QA01"

All development and QA servers would be moved to the QAxyz.net domain, the machines would be part of the QA01 domain. Note: Some of these servers will have the same name as the production servers for testing purposes.

I believe we would have separate DNS servers for each domain.

If I am logged into the QA01 domain, to access the production domain I would qualify my access like so: \PRODSERVER.xyz.net login: XYZ01\username

Do I need to add a forwarder to my QAxyz.net DNS server so that it can see xyz.net? Would I need to do the same to the xyz.net DNS server to see QAxyz.net?

I don't know how to advise them in this.

Does anyone have any other recommendations to isolationg a QA domain?

Many Thanks in advance! Tim