Split-horizon DNS gives different users different maps
The same name can resolve to different addresses depending on who is asking, which is normal and occasionally confusing.
Internal users get the internal address, external users get the public one. It works well until somebody troubleshoots from the wrong place and draws the wrong conclusion, or until an internal-only name quietly becomes resolvable externally. The security question is whether the internal map reveals anything, because internal DNS is a good description of your estate.
More on DNS and domains
- DNS is a directory, not proof of safetyIt only answers where
- DNSSEC signs answers but does not hide themA sealed postcard
- Encrypted DNS protects the resolver path, not the destinationCovered to the desk, open to the door
- Registrar compromise can outrank server securityIt all hangs from one fitting
- Registrar locks add friction to domain theftThe pin that makes them stop
- Dangling DNS can point to somebody else's resourceYour plate, their locker