Squid Split DNS: Route Private Domains Through the Right Resolver

Putting an internal resolver first and a public resolver second does not tell Squid which names belong to each namespace.

In Squid 6 and 7, dns_nameservers replaces the usual resolver list with server addresses. Its syntax has no per-domain mapping. A valid negative answer is also different from an unreachable resolver, so alternates are not a reliable way to search incompatible namespaces.

Route queries by domain

A local DNS forwarder can express the missing policy. In an existing dnsmasq configuration, a private suffix can be routed like this:

server=/internal.example/192.0.2.53

Replace the domain and address. Configure an approved default upstream for other names, a suitable listener, and access restrictions. Then point Squid at that resolver using the installed version's supported configuration.

Alternatively, use an organizational DNS service that resolves both namespaces correctly. Avoid a public fallback that exposes private names without being able to answer them.

If a parent proxy performs the destination lookup, that hop needs the private namespace. A resolver on the local Squid host will not fix the parent's lookup.

Check the negative case too

Choose a valid private name, a valid public name, and a nonexistent private name. For each, identify the intended upstream and whether the expected answer is an address or a negative response. The last case reveals accidental public fallback after an internal negative answer.

Include the address families required by the client. A working A lookup does not establish that AAAA follows the policy or returns a reachable destination. Note cache state too: a cached answer can hide which upstream a fresh query would select.