Split DNS: the right resolver for each network

A VPN usually replaces your resolver for the whole machine. Split DNS sends each domain to the network that knows it, and leaves the rest alone.

The problem: one resolver for the whole machine

A WireGuard configuration names a single resolver on its DNS line, and while the tunnel is up the system uses it. That is fine when the tunnel is the only network you care about.

It stops being fine the moment you still need your own. Reaching server.customer.local over HTTPS means that name has to resolve — and it only exists on the customer’s DNS. Point the whole machine at that resolver and your own internal names stop resolving, because the customer’s DNS has never heard of them.

What split DNS does

Split DNS decides per domain which resolver answers. The customer’s domains go to the customer’s resolver; everything else keeps using the one you normally use.

You reach internal resources by their real hostnames — which is also what makes their HTTPS certificates validate — without giving up name resolution on your own network.

Why it matters once several networks are connected

With one tunnel, pointing everything at the remote resolver is a workable compromise. With several customer networks connected at the same time, it stops being one: there is no single resolver that knows all of those names, and whichever one you pick is wrong for the others.

This is the point at which per-domain resolution stops being a convenience and becomes the only arrangement that works. Split DNS is available on Mac, iPhone and iPad.

It is not the same thing as split tunnelling

The two are easy to confuse and they answer different questions.

• Split tunnelling decides which traffic goes through the tunnel. That is AllowedIPs.
• Split DNS decides which resolver answers a name. That is the DNS line, applied per domain rather than to everything.

You generally need both, and having one without the other is the single most common reason a tunnel gets described as “connected but nothing works” — the addresses are reachable, the names simply never resolve. See DNS, routing and split tunnelling for how the routing half is set.