DNS glossary

What is split-horizon DNS?

Split-horizon DNS (split-horizon domain name system) is a DNS deployment method that returns different answers for the same name depending on the source of the query. It typically serves private addresses to internal clients and public addresses to external clients, using separate views or separate servers.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

Split-horizon DNS is a deployment method that returns different DNS answers for the same domain name based on the source of the query, typically serving private addresses to internal clients and public addresses to external clients. Organizations use this technique to allow employees and customers to access services by the same name while keeping internal infrastructure hidden from public reconnaissance and avoiding inefficient routing of internal traffic out to the internet and back. The primary operational risk involves views drifting out of sync when internal and external zones are maintained separately, requiring automation and change control to prevent users from receiving incorrect addresses or experiencing service failures.

  • Split-horizon DNS maintains two separate zone versions—one containing private addresses and internal hosts for internal clients, and another containing only public records for external clients—with the server selecting the appropriate view based on the query source address.
  • The technique reduces security exposure by keeping RFC 1918 private address ranges and internal host names out of public DNS zones, limiting reconnaissance opportunities for outside parties while still requiring firewalls and authentication for complete access control.
  • Common operational failures include view drift causing users to receive stale or mismatched addresses, VPN clients querying wrong resolvers, public resolver bypass when devices use third-party DNS services, and cached answers crossing views when shared resolvers serve both audiences.

Split-horizon DNS at a glance

AttributeValue
Full nameSplit-horizon DNS
CategoryDNS deployment method
Protocol and portDNS, port 53 over UDP and TCP
OSI layerApplication layer (layer 7)
Primary useServing different DNS answers to internal and external clients for the same domain name
Related termsDNS, authoritative DNS server, recursive resolver, DNS zone, DNS views, private DNS

How split-horizon DNS works

A split-horizon deployment keeps two sets of answers for one domain and selects between them when a query arrives. It can be built with separate servers or with a single server that supports views.

  1. Define the views: The administrator creates an internal version and an external version of the zone. The internal version holds private addresses and internal-only hosts, while the external version holds only public records.
  2. Match the client: When a query arrives, the server examines its source, most often the client IP address, and matches it against access rules for each view. Some servers can also match on the destination address or a signing key.
  3. Answer from the matching view: The server responds using only the records in the selected view. An internal client asking for a service name might receive a private address, while an outside client asking for the same name receives a public address.
  4. Resolve unmatched queries: Queries that match no internal rule fall into the external view or a default view, so unknown sources never see internal data.

Separate servers achieve the same result by placing internal resolvers on the private network and public authoritative servers on the internet. Internal and external zone data must be kept in sync by hand or by automation, because the steps above do not do this.

Why split-horizon DNS matters in enterprise networks

Split-horizon DNS lets organizations use one namespace for both private and public services. Employees reach an application by its private address on the corporate network, while customers reach the public front end using the same name. Without it, internal users may be routed out to the internet and back in, or organizations must maintain separate domain names that confuse users and complicate certificates.

The design also limits exposure. RFC 1918 reserves private IPv4 address ranges that are not routable on the public internet, and keeping those addresses and internal host names out of public zones reduces what an outside party can learn through reconnaissance. It is a visibility control, not an access control, so firewalls and authentication are still required.

Operational risk comes from drift. When internal and external zones are edited separately, records fall out of sync, and users see different behavior on and off the network. Remote users on VPNs may query the wrong resolver and receive public answers when they need private ones, or the reverse. Caches complicate this further if a resolver serves both audiences. Misconfigured views can also leak internal records to outside clients. Automation, change control and regular comparison of both views reduce these failures.

Split-horizon DNS vs Private DNS

Split-horizon DNS serves different answers for the same name depending on who asks, while private DNS is a namespace or service that resolves names only for internal clients and is not published publicly. What is Private DNS?

AttributeSplit-horizon DNSPrivate DNS
Answers for a shared nameInternal and external clients get different answers for the same nameOnly internal clients get answers; external clients get none from this service
Public records for the same domainMaintained in the external view or on external serversNot required
Main riskViews drifting out of syncInternal names failing to resolve outside the private network
Typical useOne name reached by both internal and public usersInternal-only services and hosts

Split-horizon DNS vs Conditional DNS forwarding

Split-horizon DNS changes the answer returned for a name based on the client, while conditional forwarding sends queries for specific domains to designated servers and does not alter the answers. What is Conditional DNS Forwarding?

AttributeSplit-horizon DNSConditional DNS forwarding
What it controlsWhich answer is returnedWhich server is asked
Decision based onQuery source, such as client addressDomain name in the query
Where it is configuredOn the authoritative server or its viewsOn a recursive or forwarding server

Common split-horizon DNS issues

A record is added to the external zone but not the internal one, or the reverse. Internal users then get NXDOMAIN or stale addresses for names that work from home or from the internet.

Access rules based on client address can put VPN clients, guest Wi-Fi or cloud workloads into the wrong view. Users see private addresses they cannot reach, or public addresses that route out and back in.

Devices configured with a public resolver, or browsers using encrypted DNS to a third party, skip the internal servers. Internal names fail to resolve or return the public address.

Internal and external endpoints behind one name may present different certificates. Clients see trust errors when the internal address serves a certificate that does not cover the shared name.

A shared caching resolver or forwarder in front of both views can store an answer from one view and serve it to the other audience. Symptoms are intermittent wrong addresses that clear when the cache expires.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

Split-horizon DNS FAQ

Related terms

Article

Private DNS

Private DNS is a DNS resolution service that operates within a private network, keeping queries and responses internal without exposure to public resolvers.

Learn more
Article

DNS zone

A DNS zone is a contiguous portion of the domain name space for which administrative responsibility and authority have been delegated to a single manager.

Learn more
Article

Authoritative DNS server / Authoritative name server

An authoritative DNS server provides original and definitive answers to DNS queries.

Learn more
Article

Conditional DNS Forwarding

Conditional DNS forwarding directs DNS queries for specific domains to designated DNS servers, allowing organizations to manage name resolution across different networks and environments.

Learn more
Article

RFC 1918 networks

RFC 1918 networks are ranges of IP addresses designated for private use on TCP/IP networks.

Learn more
Article

Recursive DNS server

A recursive DNS server is the first server contacted by a requesting host; it retrieves the proper IP address of the intended domain name and returns it to the requester.

Learn more
Article

DMZ (Demilitarized zone)

A DMZ (Demilitarized Zone) is a subnetwork that exposes an organization’s external-facing services to an untrusted network such as the internet.

Learn more
Article

DNSSEC (Domain Name Service Security Extension)

DNSSEC (Domain Name Service Security Extension) is a mechanism that uses cryptography to authenticate DNS data and verify the integrity of DNS queries and responses.

Learn more
Browse the full glossary