Split-horizon DNS: one name, different answers inside and outside

Split-horizon DNS is a technique used to provide different IP addresses for the same domain name based on whether the query comes from inside or outside your local network. This approach can improve performance and security by avoiding unnecessary traffic over the internet.

Problem It Solves

Your service might be accessible at myapp.domain.com. When accessed externally, it should resolve to a public IP address (e.g., via Cloudflare). However, resolving this domain internally results in slower performance because of hairpin NAT issues or broken internal routing. Split-horizon DNS resolves the same name differently based on the source of the query—internal clients get an internal IP address, while external clients receive the public one.

How to Build It at Home

Using PI-HOLE/ADGUARD

• Ease of Use: These tools are straightforward and already have built-in features for handling split-horizon DNS.
  • Add a local DNS record in the "Local DNS Records" page: myapp.domain.com → 192.168.1.x.
  • Every client using this resolver will get the internal IP, while external resolvers fall back to normal upstream resolution.

Using UNBOUND or dnsmasq

• Underlying Tools: These tools require manual configuration.
  • For UNBOUND: Use local-zone and local-data entries.
  • For dnsmasq: Add address=/myapp.domain.com/192.168.1.x.

Using Firewall Resolvers (e.g., OPNsense/PFSense)

• GUI Features: These firewalls have a "Host Overrides" feature that can be used to configure split-horizon DNS.
  • Add the necessary host overrides in the GUI.

Rule of Thumb: Override only the specific names you need internal answers for, and let everything else resolve normally. Resist running an entire authoritative copy of your zone inside.

Common Gotchas

TLS Compatibility

• Elegant Solution: TLS certificates remain valid because both internal and external requests use the same domain name (myapp.domain.com), ensuring seamless certificate validation.
• Why It Beats Raw IPs: Using raw IP addresses breaks TLS validation, whereas split-horizon DNS maintains it.

Client Resolver Bypasses

• Browsers and DHCP Clients: Devices with hardcoded resolvers or those using DNS-over-HTTPS will receive the public IP address.
  • Fixes:
    • Configure DHCP to hand out only your resolver.
    • Disable DoH on managed devices or run a DoH-capable internal resolver.

Remote Access

• WireGuard/Tailscale Clients: These clients should use the internal resolver when tunneled home, ensuring remote access also gets internal answers. Set DNS in the tunnel configuration to achieve this.

Documentation and Future Debugging

• Override Documentation: Document your split-horizon configurations for future reference.
  • This helps debug issues like "why does this resolve differently on my laptop" by providing clear explanations of the setup.

By following these steps, you can effectively implement split-horizon DNS in your home network to improve performance and security.