Split-Horizon DNS

Split-horizon DNS (also called split-brain or split-view DNS) is a setup where the same domain name resolves to different records depending on the client's network location. Internal users get private addresses, external users get public ones.

Why it matters

Companies use it so that app.example.com points to a public load balancer from the internet but to a private 10.x address inside the office or VPC. It keeps internal traffic off the public path and avoids exposing internal hostnames. It also explains a common support puzzle: a site works from the office but is "down" from outside, or the reverse.

Example

In BIND, views choose the zone by client address:

view "internal" {
  match-clients { 10.0.0.0/8; };
  zone "example.com" { type master; file "int.example.com.zone"; };
};
view "external" {
  match-clients { any; };
  zone "example.com" { type master; file "ext.example.com.zone"; };
};

Cloud providers offer the same idea as private hosted zones attached to a VPC.

Common mistakes

• Updating only one view, so internal and external data drift apart.
• Testing from inside the network and concluding the public site works.
• Forgetting that a VPN or DNS-over-HTTPS setting can move a client into the wrong view.

Related

• DNS resolver
• Authoritative nameserver
• DMZ
• Tool: DNS checker

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.