What is Split Brain DNS and why does it matter?
DNS is how computers turn a name like intranet.yourdomain.com into an address they can connect to. Your public DNS records are kept by a provider such as your domain registrar, DNS host, or web host, and that's where the internet looks them up. Many organizations running on-premises Active Directory also keep a private, internal copy of their domain on their own domain controllers. This setup is called split-brain DNS: one domain, two separate sets of records.
When split-brain DNS is present, computers inside your office ask your domain controllers about your domain instead of asking the internet. If the intranet record is added only to your public DNS, the internal copy doesn't know about it. That means the intranet will work from home and on phones but fail from inside the office.
How do I check for Spit Brain DNS?
The check below asks your network which server claims to own your domain.
Replace yourdomain.com with your actual domain name.
From a Windows Computer
On a Windows computer inside your network, press the Windows key, type cmd, and press Enter.
Type the command below and press Enter:
nslookup -type=soa yourdomain.com
From a Mac Computer
Open Terminal
Type the command below and press Enter:
dig SOA yourdomain.com
How to read the result
Look for the line that says primary name server.
What the primary name server looks like | What it means |
A DNS provider or registrar, such as a name containing godaddy, cloudflare, azure-dns, awsdns or your web host | No split-brain DNS. Only the public record is needed. |
One of your own servers, such as dc01.yourdomain.local or srv-dc2.yourdomain.com | Split-brain DNS is present. Your IT team will need to add the intranet record internally as well. |
Not sure? Send us the screenshot at [email protected] and we can help!
If split-brain DNS is detected
You will need to add the CNAME record for your intranet to your internal DNS for Synthesis to be accessible inside your network.
In the DNS Manager on a domain controller:
Open Forward Lookup Zones
Open the zone named yourdomain.com
Add the same CNAME record provided in your DNS setup instructions from KA
If the zone is Active Directory–integrated, the change replicates to your other domain controllers automatically
The change typically needs 5-10 minutes to replicate, longer if replication settings have been changed from Microsoft’s defaults.