Notifications
Clear all
Topic starter
23/06/2026 7:08 pm
TL;DR: DNS forwarding separates internal from external resolution by sending selected queries to a designated forwarder, reducing recursive traffic and limiting exposure of internal DNS information, according to DigiCert. The governance lesson is that DNS design can shape both performance and visibility, so routing decisions belong in identity-aware infrastructure planning, not just network tuning.
NHIMG editorial — based on content published by DigiCert: DNS Forwarding: A Comprehensive Guide for DNS Specialists
Questions worth separating out
Q: How should teams configure DNS forwarding in segmented environments?
A: Teams should assign a dedicated forwarder for external resolution and use conditional forwarding only for the namespaces that truly need it.
Q: Why does DNS forwarding matter to security teams?
A: DNS forwarding matters because it controls which systems see internal query patterns and how much external resolution work each resolver performs.
Q: What breaks when organizations do not separate internal and external DNS resolution?
A: Without separation, every DNS server may handle external lookups, increasing traffic and multiplying the places where internal resolution patterns can be exposed.
Practitioner guidance
- Separate external and internal resolution paths Route external queries through dedicated forwarders and keep internal namespace resolution on controlled resolvers.
- Map conditional forwarding to namespace ownership Document which domains and subdomains are forwarded, which resolvers receive them, and who owns each namespace.
- Treat forwarders as monitored control points Apply logging, capacity monitoring, and failover testing to designated forwarders because they concentrate outbound DNS activity.
What's in the full article
DigiCert's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step guidance on configuring DNS forwarders for external and internal queries
- Practical examples showing when conditional forwarding is appropriate for large intranets
- Explanation of DNS terminology that helps specialists avoid confusing forwarding with CNAME or HTTP redirection
- Operational discussion of how forwarder placement affects performance and security
👉 Read DigiCert's guide to DNS forwarding for specialists →
DNS forwarding for internal and external queries: what changes?
Explore further
25/06/2026 2:59 am
DNS forwarding is a control-separation problem, not just a routing optimisation. The article’s main value is that it treats forwarders as a way to split internal and external resolution duties, which reduces unnecessary query sprawl. That separation matters because DNS handling is part of the infrastructure trust boundary for workloads, service accounts, and user access paths. Practitioners should read forwarding design as a governance decision about where resolution authority sits.
A few things that frame the scale:
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which is why naming and controlling resolution boundaries matters across machine identity environments.
A question worth separating out:
Q: How do identity and infrastructure teams decide whether to use conditional forwarding?
A: They should use conditional forwarding when a subset of internal domains needs controlled handling by a dedicated resolver, especially in large intranets with multiple zones. The decision should be based on namespace complexity, ownership clarity, and whether the forwarding path reduces ambiguity without creating hidden dependencies.
👉 Read our full editorial: DNS forwarding and internal resolution: why separation matters
