Split Horizon DNS: Internal and External Views
Return different IP addresses based on the origin of the DNS query.
Split horizon DNS (or split-brain DNS) is a technique where the DNS server returns different responses based on the query origin. Typically, internal queries (from LAN) receive private IP addresses while external queries receive public IP addresses. This optimizes routing, avoids NAT hairpinning, and can secure access to internal resources. It's a common configuration but complicates monitoring and troubleshooting.
Symptoms of Split Horizon Problems
- A service works internally but not externally (or vice versa)
- The IP returned by dig varies based on the network you test from
- External monitoring tests don't match internal experience
- SSL certificates report domain mismatch
Split Horizon Use Cases
- Intranet access: intranet.company.com returns 10.0.1.50 internally and doesn't exist (or redirects) externally.
- NAT optimization: Avoids NAT hairpinning where internal traffic would go out to Internet to come back.
- Security: Hides internal topology from external queries while allowing named access internally.
Split Horizon Diagnosis
- Test from internal: dig @internal-dns-server example.com to see internal response.
- Test from external: dig @8.8.8.8 example.com to see public response.
- Compare both results and verify they match expected configuration.
- Document which domains use split horizon and what responses are expected.
Multi-View Monitoring
MoniTao can monitor both sides of your split horizon:
- Monitoring from Internet to validate external view
- Configuration of internal monitors for private view
- Alert if a view returns unexpected response
Split Horizon Best Practices
- Clearly document what response is expected for each view
- Use explicit subdomains when possible (internal.example.com)
- Ensure SSL certificates cover both access cases
- Regularly test both views to detect configuration drifts
FAQ - Split Horizon DNS
Is split horizon a security flaw?
No, it's a legitimate segmentation technique. But misconfiguration can expose internal info.
How to configure split horizon?
With BIND, use "views". With cloud DNS, create private zones. Details depend on your stack.
Does CDN work with split horizon?
Yes, but configure CDN to use public IP. Internal queries can bypass CDN if desired.
How to monitor both views?
Configure MoniTao monitors from IPs in each network, or use an internal agent for private view.
Useful Links
Ready to Sleep Soundly?
Start free, no credit card required.