Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running split dns and generally have access to my sites internally.

The exception comes when I am hosting a site that is not under my main domain.

I can set up external and internal dns entries for anything I have at * and reach these sites both internally and externally.

My problem comes with sites not under *

Say I have just set up, It has an internal ip of say I threw the address in an extrenal browser and I see what I want.

So If I try giving an A and PTR entry pointing to the address in my internal dns that does not work.

I am sure there is a fantastic reason for this as you would not want others hijacking your domain, but I would also like my internal users to see these sites.

Can anyone point me in the right direction?

share|improve this question
up vote 0 down vote accepted

I don't know if I'm just grossly misunderstanding the real issue here, but if they're just going to be for internal use only, why not make a new zone for internal use only? For example, you could make an "int" zone and make A and PTR records for your website in there like could point to All of our company's internal sites are in the "cs" zone, like at sitename.cs and so only internal people can access them, or remote people need to connect to the VPN. Hope that provides some ideas for you.

share|improve this answer

You cant just add an arbitary A record to your dns server and have it resolve to a particular address. You could create a new zone on your dns server but that will break all the addresses for and not just the one you are trying to spoof. If your goal is to point at while testing on a set of boxes you can modify /etc/hosts on linux and mac and the hosts file on windows ( That will give you a good way to test.

Now if you are are trying to deal with this in prod, you likely need to take another look at your architecture and find a solution that doesn't include messing with dns.

share|improve this answer
cwebber, Thanks, I figured that you can not just add whatever you like, as what I said in my question. I will look into the zone. I am not a fan of the hosts as the 9:30 P.M. calls I receive asking me how do I remove that entry from the hosts file again... – grantk Mar 24 '11 at 13:58

Using something like DNSMasq to act as your internal DNS server would allow you to add the entry to one hosts file. It can be configured to point at your split DNS server or to act as a cache on its own.

share|improve this answer

cwebber is correct about setting up a zone file in bind. He mentions this flaw:

You could create a new zone on your dns server but that will break all the addresses for and not just the one you are trying to spoof.

The way to work around this is to set up zone files for each name you wish to control, e.g. create a zone file for, not

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.