Split-Horizon DNS: Different Answers for Internal and External Clients

Split-horizon DNS (also called split-view DNS) serves different answers for the same name depending on whether the query comes from inside your network or from the public internet. Internal users get private/internal addresses; external users get public ones. It is a common pattern for organisations running their own services.

The problem it solves

Imagine a server that internal staff should reach on a fast private IP, while the outside world reaches it via a public IP (perhaps through a firewall). You want the same friendly name — app.company.com — to work for both, but return a different address to each audience. Split-horizon does exactly that.

How it works

The authoritative DNS is configured with two "views" of the same zone:

• Internal view — answered for queries from your internal network, returning private/internal addresses.
• External view — answered for queries from the public internet, returning public addresses.

In BIND this is done with the view feature, matching clients by source address and serving each the appropriate zone data. Other DNS servers offer equivalent mechanisms.

Common uses

• Internal shortcuts — staff reach internal services directly rather than hair-pinning out to a public IP and back.
• Hiding internal structure — external users only ever see public records, not your internal hostnames and addresses.
• Testing and staging — internal clients can be pointed at different backends.

Things to watch

• Consistency — you now maintain two views; keep them in sync where they should match.
• Caching confusion — a device moving between networks (e.g. a laptop leaving the office) may briefly hold a cached internal answer that does not work outside. Sensible TTLs help.
• Verification — test each view from the right vantage point; dig from inside and outside confirms both.

Frequently asked questions

Why not just use one public IP for everything?

Internal users hitting a public IP often take a slower path out and back through the firewall, and it exposes structure unnecessarily. Split-horizon lets internal traffic stay internal while the public sees only public records.

Does split-horizon work on shared hosting?

It is really an infrastructure pattern for networks you control (offices, data centres, VPS environments), not typical shared hosting. It needs a DNS server you can configure with views and clients you can identify by source network.

My laptop can't reach the service after leaving the office.

It may be holding a cached internal answer that only works inside the network. Once the cached record's TTL expires it will fetch the external answer. Lower TTLs reduce how long this mismatch lasts.