Split-horizon DNS

Split-horizon DNS (also called split-view DNS) is a DNS server configuration in which the same domain name returns different answers depending on where the query came from. In other words, a single domain — for example app.company.com — can point to one address for a user on the local network and to another for a user on the internet.

How split-horizon DNS works

The DNS server maintains at least two independent "views" of the same zone. When it receives a query, it identifies the client's origin — usually by its IP address or the interface the query arrived on — and selects the appropriate version of the answer:

• internal view — for queries from the local network or over VPN; it returns private IP addresses of servers and services,
• external view — for queries from the internet; it returns public addresses, usually routed through a firewall or reverse proxy.

As a result, the same host name works consistently both inside and outside the company, but internal traffic does not have to "exit" to the outside and come back. Popular DNS servers support this configuration, among others through a views mechanism.

Split-horizon DNS in practice

Split-horizon DNS is standard in corporate networks and hybrid environments. It lets an employee in the office reach a system by a fast private address on the intranet, while the same address from outside routes through a public entry point secured by a reverse proxy and firewall. The approach improves performance, simplifies application configuration (one host name in every environment) and increases security by hiding the internal network topology from the outside world.