I'm currently attempting to track down a problem with a Websense Web Filter breaking SSL connections for sites in a conditional forward. To do this, I need to know exactly how a conditional forward works.
How its been explained so far is that a request is made of my company's DNS from a host within the private network. The company's DNS does not know the IP of address but knows what DNS server does, it then queries Company B's DNS server for their internal IP for this site. When Company B's DNS responds, our DNS relays the information and a VPN session is established at the firewall to this site.
How its happening for SSL/HTTPS requests is that, the host is making that same request but instead we are receiving a "The DNS server could not resolve host" error message back. When the station or address is removed from WCCP via access-lists on the firewall, the host is then able to access the site as normal.
So TL;DR, I need to understand how conditional forwarding works to connect hosts via VPN to another's private network.