We are offering multiple SSL-enabled services in our local network.
To avoid certificate-warnings we bought certificates for server.ourdomain.tld and firewall.ourdomain.tld.

We now created a zone in our local DNS-server in which we pointed the hosts to the corresponding private-ips.

Now, each time another record for ourdomain.tld, like for example www.ourdomain.tld or alike are changed, we need to update it on both our public-dns-server AND the local dns-server.

I would like our local bind-dns to serve all the information from our public-dns but serve different information for these 2 hosts.

I know I could possibly have our private-ips in our public-dns but I don't want that for security reasons.

The internet dns-server is being managed by a third party, while we have full control of the intranet one. Because of this I am looking for a solution which lets the intranet retrieve the records from the internet one.

1 Answer 1


Use at a Split DNS configuration in bind. You should be using this anyway to prevent the use of your bind server in amplification attacks. Once you have that running you proceed to a split configuration of your zone file.

Create a zone file for intranet (internal) users and another for Internet (external) users. Place only sub-domains that have different IP addresses in each file. Create a third file containing the rest of the IP addresses and include it in the first two zone files. I would place the serial number in the include file.

Using this configuration you will be able to edit in one place and reload. If you need to change the IP address of one of the servers which has different IP addresses for local and Internet users, you will need to increment the serial number in the third file.

The above approach may leak information about servers you don't want reachable from the Internet. You may be better using two zone files, one for intranet users, an the second for the Internet. If you plan your network well, IP addresses should only need to be changed in one file at time.

The zone file for the Internet should only contain information on domains you want to access from the Internet. It should only include Internet routeable IP addresses.

The zone file for the intranet can contain all the servers you want. It can include servers with private IP addresses:,, and/or If you use a VPN, configure your split DNS to include VPN hosts on the intranet size.

EDIT: Work really hard at stabilizing the IP addresses visible on the Internet. I have yet to work on a project where they were dynamic. You really should have as few domains as possible visible from the Internet. They should all reside within a DMZ. If possible, multi-home IP address for domains that move frequently. If not, consider creating a sub-domain on the internet side where you change the IP addresses and use CNAMES to point to these records from both the Internet and intranet.

Server/services that must be exposed to the Internet include DNS, Web, SMTP (Mail), and VPN. Carefully consider the risk for other servers/services. (Multiple) Web domains are easily handled with CNAMES. In most cases, database servers should not be exposed to the Internet.

  • Thanks for your answer, good idea. Sadly the intranet dns-server and internet dns-server are not running on the same machine. The internet one is being fully managed by a third party while the intranet one is under our full control. Sorry if I didn't point that out correctly.
    – Zulakis
    Sep 22, 2012 at 21:31
  • @Zulakis This automatically gives you split DNS using different servers. Do consider my notes on the second option. Your external IP addresses should be stable.
    – BillThor
    Sep 22, 2012 at 21:55
  • Sorry, I don't really understand. I got to access the internet-domains from both intranet and internet. If one of the internet ips changes now, I must update 2 zone files. This exactly what I got at the moment and want to avoid.
    – Zulakis
    Sep 22, 2012 at 22:43
  • @Zulakis I have attempted to clarify in my edit of my response.
    – BillThor
    Sep 22, 2012 at 23:05
  • I understand. But still, I would like to have ns records, even if changes only appear every few month, to be updated automatically on both internet and intranet. Edit: Reason for it is that someone else manages the internet-dns while I manage the intranet one. I want to be sure that changes get deployed automatically.
    – Zulakis
    Sep 22, 2012 at 23:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.