Advanced Concept: Split-Horizon DNS

The same name, different answers

Sometimes you want the same domain name to resolve to different IP addresses depending on who is asking. This is called Split-Horizon DNS (also called Split-Brain DNS or Split-View DNS).

Consider a company's internal application server:

• An employee inside the office should resolve app.company.com to 10.0.0.5 — a fast, private internal address that bypasses the firewall entirely.
• The same employee working remotely should resolve app.company.com to 198.51.100.5 — the public IP of the company's VPN gateway.

The DNS server achieves this by maintaining two separate views of the zone. It inspects the source IP address of the incoming query and returns the appropriate answer:

Internal view (source IP in 10.0.0.0/8):
  app.company.com.    A    10.0.0.5

External view (all other source IPs):
  app.company.com.    A    198.51.100.5

This pattern is extremely common in enterprise and cloud environments. AWS Route 53 implements it as "Private Hosted Zones" — a zone that is only visible to resources inside a specific VPC, while a separate public zone serves the same domain name to the outside world.

Failure mode to watch for: If a developer's laptop is connected to a VPN that routes DNS through the internal resolver, they will receive internal IPs even when testing from their home network. This can make it appear that a public-facing service is working when it is actually resolving to an internal address that external users cannot reach.