Forwarder Zone querying Split Horizon App on other Server

[tkriener]

Hello,

I have a construct, where a first DNS-Server with a primary Zone including a record for Split Horizon App is located in one site.
In another site I have a second DNS-Server with a Forwarder Zone pointing to the first DNS Server.

This is working well, if I query for records with failover app.
But If I try to query the second server for a record of the split horizon app, I get an empty response of the second server to my client. In the log of the primary server I see the correct answer.
Also if I use the nslookup command on the second server to directly query the first server, I get the correct answer.

My config for the record on the first server is as follows:
{
"10.10.0.0/16": [
"10.10.0.18"
],
"10.9.0.0/16": [
"10.9.20.18"
]
}

What could be the reason, that is doesn't work for split horizon records, while working for failover records, when querying the second server?

Regards,
Thomas

[ShreyasZare]

Thanks for the post. The info is not sufficient to figure out the issue. Please share screenshot of both the zones showing the relevant records. Also share the output of the queries you do for tests. It would be best if you test this using DNS Client tool on the DNS admin panel instead of using nslookup command since the DNS Client output shows the entire response details which helps debugging such issues.

[tkriener]

I hope this information helps:

Entry in zone on first server (10.9.20.4):

Entry in Forwarder Zone with same name on second server (10.10.x.x):

Response using the DNS-Client on second server

{
  "Metadata": {
    "NameServer": "dns.test.de (127.0.0.1)",
    "Protocol": "Udp",
    "DatagramSize": "56 bytes",
    "RoundTripTime": "12.2 ms"
  },
  "EDNS": {
    "UdpPayloadSize": 1232,
    "ExtendedRCODE": "NoError",
    "Version": 0,
    "Flags": "None",
    "Options": []
  },
  "Identifier": 0,
  "IsResponse": true,
  "OPCODE": "StandardQuery",
  "AuthoritativeAnswer": false,
  "Truncation": false,
  "RecursionDesired": true,
  "RecursionAvailable": true,
  "Z": 0,
  "AuthenticData": false,
  "CheckingDisabled": false,
  "RCODE": "NoError",
  "QDCOUNT": 1,
  "ANCOUNT": 0,
  "NSCOUNT": 0,
  "ARCOUNT": 1,
  "Question": [
    {
      "Name": "proxy.int.test.de",
      "Type": "A",
      "Class": "IN"
    }
  ],
  "Answer": [],
  "Authority": [],
  "Additional": [
    {
      "Name": "",
      "Type": "OPT",
      "Class": "1232",
      "TTL": "0 (0s)",
      "RDLENGTH": "0 bytes",
      "RDATA": {
        "Options": []
      },
      "DnssecStatus": "Disabled"
    }
  ]
}

I don't know how to use DNS-Client of the second server to directly query the first server.
Response from the second server dns.test.de (10.10.x.x), when directly asking 10.9.20.4 using dig from os-level:

# dig @10.9.20.4 proxy.int.test.de

; <<>> DiG 9.11.36-RedHat-9.11.36-16.el8_10.6 <<>> @10.9.20.4 proxy.int.test.de
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22813
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;proxy.int.test.de.	IN	A

;; ANSWER SECTION:
proxy.int.test.de. 3600 IN	A	10.10.0.18

;; Query time: 3 msec
;; SERVER: 10.9.20.4#53(10.9.20.4)
;; WHEN: Thu Mar 12 15:00:42 CET 2026
;; MSG SIZE  rcvd: 72

[ShreyasZare]

Thanks for the details. Its strange that the DNS Client output is coming different from the output when queried to the second server. Please check what records are cached on the second server for the domain name. You can check that from the Cache tab on the panel and browse to the domain name in question. Share the json record data you see in the cache section for the domain name.

[tkriener]

It is even more weird. In the cache it looks fine:

[
  {
    "name": "proxy.int.test.de",
    "type": "A",
    "ttl": "1846 (30m46s)",
    "rData": {
      "ipAddress": "10.10.0.18"
    },
    "dnssecStatus": "Disabled",
    "responseMetadata": {
      "nameServer": "10.9.20.4",
      "protocol": "Udp",
      "datagramSize": "72 bytes",
      "roundTripTime": "2.71 ms"
    },
    "lastUsedOn": "2026-03-13T09:49:22.262925Z"
  }
]

[ShreyasZare]

Ya, that's weird. Do you have any DNS app in the App section? Or any other records in the Conditional Forwarder zone? It could be that something is overriding and answering the request.

[tkriener]

That was it.
I have deployed "DNS Rebinding Protection" and did not configure the private Domains.
After adding our domains to the private domains it now works.

Many thanks.

[ShreyasZare]

Ya, that app does this. You're welcome.