I have a (public) domain and an internal DNS server for my (internal) subdomain zones. Is it OK to have a public CNAME point to an interal domain name?

  • Let's say example.com is the public zone (managed by my webhoster) with some publicly reachable servers (e.g. www.example.com, git.example.com).
  • local.example.com is the interal zone (internal DNS server points to private IP addresses)

Now I moved a deprecated public service into my intranet. Are there any objections to have a CNAME like service.example.com -> deprecated.local.example.com? DNS requests from the internet will always get a NXDOMAIN. The main benefit for me is that internal consumers of the deprecated service can use the same URL as before.

  • I make a habit of publicly publishing NS records for internal subdomains with their glue records, makes life just a little easier. (New DNS servers with access to DNS servers internally automatically resolve internal records) – Jacob Evans Feb 1 '18 at 17:37

On a purely technological level? Sure, that's fine.

On an institutional level, you might want to check with your security team to make sure they don't have policies forbidding it. They might consider it a non-permissible leakage of internal network details.


Technically you can. It would just confuse outside clients stumbling upon this label and not being able to fully resolve it.

So the better setup (but more work) would be to make sure that this local.example.com resolves at all only internally and that outside queries for it would return NXDOMAIN without even a CNAME to walk.

  • The local subdomain is only resolved in the internal network. It has no NS/SOA record in the public DNS. I suppose a split zone would be needed to implement your approach? – code_onkel Jan 31 '18 at 21:26
  • @code_onkel. Yes, typically. – Patrick Mevzek Feb 1 '18 at 16:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.