Split-horizon DNS (also known as split-view DNS, split-brain DNS, or split DNS) is a term used when two zones for the same domain are created—one zone is used by the internal network and the other by the external network (usually the internet). This means that a domain can resolve to different IP addresses depending on which DNS server you are using, which depends on whether you're "inside" or "outside" the network.
On Windows, Secure Access Layer (SAL) is used to enforce policy, which is a DNS method of enforcement. This essentially means that all DNS lookups are done by SAL, which is a problem for split-horizon DNS because the IP address of internal services can only be resolved by your internal DNS and not SAL.
If a user at home visits api.jamf.com through their browser, this would use a public DNS service, which would resolve to IP 1.2.3.4. If that user went to the office, connected to the office Wi-Fi, and visited api.jamf.com through their browser, then this would use the private DNS service configured on the Wi-Fi router and resolve to IP 1.2.3.6.
This is a common security measure for internal resources to limit an attacker's ability to discover and enumerate domains.
If the site can be resolved to an IP address by a public DNS service but the IP address isn't correct or can't be accessed, then you may need to perform the steps below to configure a DNS allowlist. This option stops the Windows app from using SAL for certain FQDNs altogether.
If the device is capped this will still prevent the page from loading, unless it is added to your data usage policy allowlist.
Confirm whether the FQDN can be resolved by public DNS. If it cannot, you may not need to configure Windows to support Split-Horizon DNS.
To confirm, use the following procedure:
- Type in the FQDN of the internal site, for example: internal.site.customer.com
If no DNS records are found, then you do not need to configure Windows to support Split-Horizon DNS.
If an IP address is returned, then you can continue with the procedure to configure Windows to support Split-Horizon DNS by creating an allowlist.