In modern enterprise environments, DNS is rarely a single, monolithic zone. Organisations often need:

• Different responses for internal vs. external users (split‑brain DNS)
• Resolution of partner/cloud domains that aren’t part of your namespace (conditional forwarding)
• Integration with Azure, AWS, or third‑party DNS for hybrid cloud

In this lab, you’ll learn:

• What split‑brain DNS is and why it’s essential
• How to configure conditional forwarders for partner or cloud domains
• How to integrate on‑prem DNS with Azure Private DNS
• How to troubleshoot forwarding and split‑brain issues

Split‑brain DNS (also called split‑horizon or split‑view DNS) means serving different DNS responses to internal and external clients for the same domain name.

2.1 Why Split‑Brain?

• Security – Internal clients see internal IPs; external clients see public IPs (or get no resolution).
• Performance – Internal clients connect directly to internal resources without going through public NAT.
• Control – You can expose only the records you want to the internet.

2.2 Split‑Brain Options

2.3 Implementation Options

• Separate internal and external DNS servers – Classic approach. Internal DNS serves internal records; external DNS serves public records.
• DNS policies in Windows Server – Windows Server 2016+ supports DNS policies that can respond differently based on client IP.
• Third‑party solutions – Cloudflare, AWS Route 53, Azure DNS offer split‑brain capabilities.

A conditional forwarder tells your DNS server to forward queries for a specific domain to a different DNS server. This is essential for:

• Resolving partner company domains (B2B)
• Integrating with Azure Private DNS
• Hybrid cloud scenarios
• Split‑brain environments

3.1 How Conditional Forwarders Work

# Query for app.partner.com goes to partner's DNS
# Your DNS server checks: Is this for a domain I have a forwarder for?
# Yes → Forward to the specified DNS server
# No → Use normal resolution (root hints or forwarders)

3.2 Lab – Configure a Conditional Forwarder

# Add a conditional forwarder for partner.lab
Add-DnsServerConditionalForwarderZone -Name "partner.lab" -MasterServers 10.10.20.10 -ReplicationScope "Domain"

# Verify the forwarder
Get-DnsServerZone -Name "partner.lab"

DNS Manager – Conditional forwarder configuration

4.1 Scenario

Our organisation, corp.lab, hosts a website at www.corp.lab. Internal users should resolve to 10.10.10.100. External users should resolve to the public IP 203.0.113.10.

4.2 Internal Zone – Internal IP

# On your internal DNS server, add/update the A record
Add-DnsServerResourceRecordA -ZoneName "corp.lab" -Name "www" -IPv4Address "10.10.10.100"

4.3 External Zone – Public IP

For external clients, you need a separate DNS zone hosted publicly (e.g., at your domain registrar or Azure DNS).

# Example: Azure DNS PowerShell (if using Azure)
# Create an A record in Azure DNS
$rs = New-AzDnsRecordSet -Name "www" -RecordType A -ZoneName "corp.lab" -ResourceGroupName "DNS-RG"
Add-AzDnsRecordConfig -RecordSet $rs -Ipv4Address "203.0.113.10"
Set-AzDnsRecordSet -RecordSet $rs

Azure DNS – Public zone with www A record

4.4 Test Split‑Brain Resolution

# From an internal client (should resolve to internal IP)
Resolve-DnsName -Name www.corp.lab
# Expected: 10.10.10.100

# From an external client (using public DNS, e.g., 8.8.8.8)
Resolve-DnsName -Name www.corp.lab -Server 8.8.8.8
# Expected: 203.0.113.10

5.1 Scenario

Your organisation works closely with partner.lab. Internal users need to resolve resources in partner.lab using their internal DNS server.

5.2 Create the Conditional Forwarder

# Add a conditional forwarder for partner.lab
Add-DnsServerConditionalForwarderZone -Name "partner.lab" -MasterServers 10.10.20.10 -ReplicationScope "Domain"

5.3 Verify Resolution

# Test resolution of a partner resource
Resolve-DnsName -Name app.partner.lab

# Check that the query went to the forwarder
# Enable debug logging if needed:
dnscmd /config /loglevel 0x0100

DNS Manager – Conditional forwarder for partner.lab

5.4 Conditional Forwarder with Replication

# Replicate to all DNS servers in the domain
Add-DnsServerConditionalForwarderZone -Name "partner.lab" -MasterServers 10.10.20.10 -ReplicationScope "Domain"

# Replicate to specific DNS servers (forest)
Add-DnsServerConditionalForwarderZone -Name "partner.lab" -MasterServers 10.10.20.10 -ReplicationScope "Forest"

6.1 Scenario

You have Azure Virtual Machines that need to be resolvable from your on‑premises network. Azure Private DNS zones provide this capability.

6.2 Create an Azure Private DNS Zone

# PowerShell – Create Private DNS Zone in Azure
# (Requires Az module)
New-AzPrivateDnsZone -ResourceGroupName "DNS-RG" -Name "azure.corp.lab"

6.3 Add Records to the Private Zone

# Add an A record for an Azure VM
$rs = New-AzPrivateDnsRecordSet -ResourceGroupName "DNS-RG" -ZoneName "azure.corp.lab" -Name "webapp" -RecordType A
Add-AzPrivateDnsRecordConfig -RecordSet $rs -Ipv4Address "10.0.1.4"
Set-AzPrivateDnsRecordSet -RecordSet $rs

6.4 Create Conditional Forwarder to Azure

# On your on-prem DNS server, forward azure.corp.lab to Azure DNS
Add-DnsServerConditionalForwarderZone -Name "azure.corp.lab" -MasterServers 168.63.129.16 -ReplicationScope "Domain"

Azure Private DNS zone with records

Windows Server 2016+ supports DNS policies that can respond differently based on client IP. This allows a single DNS server to act as a split‑brain resolver.

7.1 Create Subnet Definitions

# Define internal subnet
Add-DnsServerClientSubnet -Name "Internal" -IPv4Subnet "10.10.10.0/24"

# Define external subnet (everything else)
Add-DnsServerClientSubnet -Name "External" -IPv4Subnet "0.0.0.0/0"

7.2 Create DNS Policy

# Policy: Internal clients get internal IP
Add-DnsServerQueryResolutionPolicy -Name "SplitBrainPolicy" `
    -Action ALLOW `
    -ClientSubnet "Internal","External" `
    -ZoneScope "corp.lab" `
    -Criteria "ClientSubnet"

# Add zone scopes for different responses
Add-DnsServerZoneScope -ZoneName "corp.lab" -Name "InternalScope"
Add-DnsServerZoneScope -ZoneName "corp.lab" -Name "ExternalScope"

# Add records to each scope
Add-DnsServerResourceRecord -ZoneName "corp.lab" -ZoneScope "InternalScope" -A -Name "www" -IPv4Address "10.10.10.100"
Add-DnsServerResourceRecord -ZoneName "corp.lab" -ZoneScope "ExternalScope" -A -Name "www" -IPv4Address "203.0.113.10"

8.1 Common Issues

Forwarder Not Working

• Symptom: Queries for the forwarded domain time out or return SERVFAIL.
• Fix: Test connectivity to the forwarder: Test-NetConnection 10.10.20.10 -Port 53.

Internal Clients Getting External IP

• Symptom: Internal users resolve to public IPs.
• Fix: Check client DNS configuration. Internal clients must use internal DNS servers only.

DNS Policies Not Working

• Symptom: All clients get the same response.
• Fix: Use Get-DnsServerQueryResolutionPolicy to verify policy exists and is enabled.

8.2 Diagnostic Commands

# Test forwarder resolution
Resolve-DnsName -Name app.partner.lab -Server 10.10.10.96

# View conditional forwarder configuration
Get-DnsServerZone -Name "partner.lab" | Select-Object Name, ZoneType, MasterServers

# Test policy resolution (simulate client subnet)
Resolve-DnsName -Name www.corp.lab -ClientSubnet "10.10.10.0/24"

# Enable debug logging for DNS queries
dnscmd /config /loglevel 0x0100
dnscmd /config /logfilepath C:\DNSLogs

Debug logging – DNS query trace

9.1 Remove Conditional Forwarder

# Remove a conditional forwarder
Remove-DnsServerZone -Name "partner.lab" -Force

# Verify removal
Get-DnsServerZone | Where-Object { $_.ZoneName -eq "partner.lab" }

9.2 Disable DNS Policies

# Remove a DNS policy
Remove-DnsServerQueryResolutionPolicy -Name "SplitBrainPolicy" -Force

# Remove zone scopes
Remove-DnsServerZoneScope -ZoneName "corp.lab" -Name "InternalScope" -Force
Remove-DnsServerZoneScope -ZoneName "corp.lab" -Name "ExternalScope" -Force

9.3 Restore Default Forwarders

# Reset to default forwarders (clear all)
Set-DnsServerForwarder -IPAddress $null -PassThru

• Split‑brain DNS provides different responses to internal vs. external clients – critical for security and performance.
• Conditional forwarders enable resolution of partner/cloud domains without full trust.
• Azure Private DNS integrates seamlessly with on‑prem DNS via conditional forwarders.
• DNS policies in Windows Server 2016+ allow a single server to act as a split‑brain resolver.
• Testing and troubleshooting require tools like Resolve-DnsName, Test-NetConnection, and debug logging.