<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
As on other replies, a different internal zone is a huge project for
the company, not a quick win, unfortunately.<br>
<br>
<div class="moz-cite-prefix">On 04/11/2023 08:55, Michael Richardson
wrote:<br>
</div>
<blockquote type="cite" cite="mid:3438575.1699088157@dyas">
<pre class="moz-quote-pre" wrap="">
Given VPNs, RemoteAccess and the like, I strongly recommend against split-DNS
configurations. They were great ideas in 1993, when all sites were concave,
but that's just not the case anymore.
Instead, I recommend having a sub-zone, "internal.example.com", or some other
convenient name. Put a zone split ("NS" and "DS" records) there, and then
limit who can do queries to this zone by IP address. You'd acceptlist all of
your VPN sites, the v4 (RFC1918) and v6 (subnet) prefixes for your remote
access clusters.
Split-DNS finally has some actual IETF definition at:
<a class="moz-txt-link-freetext" href="https://datatracker.ietf.org/doc/draft-ietf-add-split-horizon-authority/">https://datatracker.ietf.org/doc/draft-ietf-add-split-horizon-authority/</a>
I'm specifically arguing to do:
<a class="moz-txt-link-freetext" href="https://www.ietf.org/archive/id/draft-ietf-add-split-horizon-authority-06.html#name-internal-only-subdomains">https://www.ietf.org/archive/id/draft-ietf-add-split-horizon-authority-06.html#name-internal-only-subdomains</a>
It's just so much easier, particularly if you are starting from scratch.
</pre>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
</blockquote>
<br>
</body>
</html>