Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I own a domain. I will call it I want to set up a local BIND server on my private network. I have a box with the private IP address of

I would like to have this box named, Is it considered normal practice to add an A record for at my DNS provider pointing to the private ip (, so that can resolve to my machine inside my private network?

share|improve this question

marked as duplicate by Iain, Jacob, MichelZ, dawud, Cristian Ciupitu Jun 28 '14 at 19:21

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

As long as you understand that this ip address won't be reachable except by those on your internal network. The other consideration is that external clients may inadvertently be redirected to a host on their own network if they use the same ip address range and resolve this A record for your domain. – joeqwerty Jun 27 '14 at 18:45
up vote 5 down vote accepted

Is it considered normal practice to add an A record for at my DNS provider pointing to the private ip (, so that can resolve to my machine inside my private network?

That will certainly work, but it's not best practice as it opens the door for a bit of information leakage about your private network.

Run an instance of DNSMasq locally, which all of your LAN clients can point to. Then in DNSMasq you can add additional hosts to your domain and/or host-overrides that will take precedence over your authoritative DNS server externally.

share|improve this answer
So, bind is not necessary? – true Jun 27 '14 at 18:10
Correct, it's likely that BIND is overkill for what you need. – EEAA Jun 27 '14 at 18:11
Okay, so using DNSMasq would allow me to not have to worry about setting up the A record at the DNS provider? – true Jun 27 '14 at 18:12
Yep, that's correct. To your internal clients, it would appear as if there was a proper A record, but that record would only resolve from your DNSMasq clients. – EEAA Jun 27 '14 at 18:13
No thanks, can't right now. As far as your original question is concerned, you have your answer. Look into getting DNSMasq set up. If you have further questions about that process, post them as a separate question. – EEAA Jun 27 '14 at 18:20

Absolutely valid. There's a way to persent different versions of the same zone with ISC's BIND to different requesters (it's called "view"), so you can limit this information to the LAN only, if needed. But I doubt you'd would bother.

share|improve this answer

There's no problem doing that - in fact, one of the major consumer router manufacturers used to provide a domain name which had an A record pointing to (though I can no longer find any documentation of this).

However, if you will only need this DNS record on your local network, you should run a local DNSmasq or TinyDNS as suggested by @EEAA above.

The situation where I would put the private address in a public DNS server is if you are using Vagrant (or similar) Virtual Machines for development. For example, if I had a Vagrant VM for development of with the IP address which is a private address only accessible on the machine hosting the VM, then I would create an A record for which points to so that other developers can use it without needing to add their own DNS records locally.

share|improve this answer
So, I run the development instance as a server VM from Windows 8, I can get to the VM via my browser if I type the IP address in, but not if I type the hostname. – true Jun 27 '14 at 18:36
If you literally can't connect to the VM at all by name, that means the DNS is not configured correctly (or hasn't had time to propagate). Run nslookup DNS_NAME to see if that is the case. If you connect to the VM and get a "default" webserver page (something like one of these), then your VM's web server is just not configured to respond to that name and you need to configure it. – Moshe Katz Jun 27 '14 at 18:51

Perfectly fine, you can for example have a server with two interfaces and resolve the name internally to the local address and for the web with public address, as was already mentionend with views in bind.

For one machine it's probably easier to just add an entry to /etc/hosts:

If you want use bind and expose this entry to the external world, it probably will not matter because you don't have authority over the domain and nobody will ask you.

But if you think about a real name from your domain, it would be nice to have an external address that at least points to one of your servers that will answer with an error message instead of letting people wait forever until they realize they are not in the internal network. (forgot to start tunnelblick/openvpn, or whatever reason)

  • just read your comment about windows 8, there should be a hosts file too.
share|improve this answer
I have control of the DNS. I don't want the internal machine exposed to the world. – true Jun 28 '14 at 1:13
Just add it then, if not as view and if you have people working from home on that machine, consider putting up a fake server like in my answer. – marty Jun 28 '14 at 1:24
So, I made an A record for pointing to and it is working. What do you mean a fake server? – true Jun 28 '14 at 1:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.