Split DNS (Split-Horizon DNS) — How to Configure It

Split DNS, also called split-horizon DNS or split-brain DNS, is a configuration where a domain resolves to different IP addresses depending on where the query comes from. Internal users on your corporate network get one answer. External users on the internet get a different answer.

This is common in business environments. An internal employee accessing company.com should reach the internal server, which has faster access to internal resources and databases. An external customer accessing company.com should reach the public web server. Split DNS makes this work without requiring users to remember different domain names.

Why Use Split DNS?

The main reason is network efficiency. Without split DNS, internal users trying to reach an internal service through its public domain name would have their traffic go out to the internet and back. This is called hairpinning or NAT reflection. It is slower, wastes bandwidth, and can cause connectivity issues with certain applications.

Security is another motivator. Internal services should not be accessible from the public internet. Split DNS lets you keep sensitive services on internal IP addresses while still using standard domain names. Employees use the same domain names as external users, but the DNS resolution keeps traffic internal.

Split DNS also simplifies user experience. Employees do not need to remember different domain names for internal and external access. They type the same URL whether they are in the office, working from home, or on the road. The DNS resolution changes based on their location, not the URL they type.

How Split DNS Works

Split DNS requires two DNS zones for the same domain: an internal zone and an external zone. The internal zone is served by DNS servers on the corporate network. It contains private IP addresses for internal services. The external zone is served by public DNS servers and contains public IP addresses for services that should be accessible from the internet.

Internal computers are configured to use the internal DNS servers for resolution. When an employee queries company.com, the internal DNS server returns the private IP address (like 10.0.1.5). External users query the public DNS and get the public IP address (like 203.0.113.5). Both queries resolve successfully, but to different addresses.

The configuration is managed by setting up separate DNS zones on separate servers, or by using DNS server software that supports view-based resolution. BIND, Windows DNS Server, and most enterprise DNS solutions support split DNS natively.

How to Configure Split DNS

Configuring split DNS involves three steps: setting up the internal DNS zone, setting up the external DNS zone, and configuring clients to use the correct DNS server based on their location.

For the internal zone, install a DNS server on your corporate network. Create a zone for your domain with internal IP addresses. Include A records for internal servers with their private IPs. Configure the server to only respond to queries from internal networks. This prevents external users from discovering your internal IP addresses.

For the external zone, your public DNS provider already handles this. Ensure the public zone contains only the IP addresses and services intended for internet access. Remove any internal services from the public zone. Review the records carefully to avoid accidentally exposing internal infrastructure.

For client configuration, internal computers should use the internal DNS server as their primary resolver. This is usually configured automatically through DHCP. External users resolve through public DNS naturally. For remote employees connecting via VPN, configure the VPN to push the internal DNS server as part of the connection.

Common Split DNS Use Cases

Corporate intranets are the classic example. An internal website like intranet.company.com should be accessible to employees from the internal network. External users do not need access. Split DNS ensures internal users resolve intranet.company.com to the internal server while external users get no answer or a different destination.

Email services often use split DNS. Internal mail clients connect to the internal mail server directly. External senders connect to the public mail server. Both use the same domain name. The MX records in the external zone point to the public mail server, while internal clients resolve to the internal server.

Development and staging environments benefit from split DNS. Developers working on a staging copy of the website access it using the same domain as production, but split DNS resolves it to the staging server on the internal network. This eliminates confusion between production and staging URLs.

Split DNS Best Practices

Keep internal and external zones in sync for common records. If you update the external A record for your website, update the internal record too. Otherwise, internal users might see outdated content or experience errors. Use DNS management tools that support synchronized views to automate this.

Restrict zone transfers on internal DNS servers. Even though the server is on your internal network, zone transfers should only be allowed to authorized secondary servers. A compromised internal device could request a zone transfer and expose your entire internal network map.

Use different TTL values for internal and external zones. Internal records can have short TTLs because the DNS server is on the local network and queries are fast. External records benefit from longer TTLs to reduce query load and improve performance for remote users.

Monitor both zones for errors. DNS monitoring services can check both internal and external resolution. This catches configuration drift where records get out of sync. For more on DNS monitoring, see our DNS monitoring guide.