What is split-brain (or split-horizon) DNS?

Your company uses the same hostname internally and externally, but you don't want internal servers exposed to the open internet. So your IT team sets up two different DNS "views" for the same domain. Inside the office, mail.yourcompany.com resolves to a private IP. From the outside world, it resolves to a public one. That's split-brain DNS (also called split-horizon DNS) in a nutshell.

It's a completely legitimate infrastructure pattern, and plenty of companies use it. The catch is that it creates two separate sets of DNS records that have to stay in sync. When they don't, things break in ways that are genuinely hard to debug.

For email senders, the part that matters most is your SPF record and how your sending IPs are published. When a receiving mail server like Gmail or Outlook checks whether your email is legitimate, it queries your public DNS. It doesn't care what your internal DNS says. If your external SPF record doesn't match the IP that actually sent the email, the check fails, and your message may be rejected or marked as spam.

DKIM and DMARC have the same exposure. Your DKIM public key needs to be in your external DNS, visible to any server in the world looking it up. If it's only in your internal view, signatures will fail for every external recipient.

The risk with split-brain DNS isn't the setup itself. It's the maintenance. Someone updates a record in one view and forgets the other. Suddenly your SPF is broken externally, your DKIM lookups are returning nothing, and you're chasing a mystery that feels impossible to reproduce from inside your own network (because internally, everything looks fine).

If you're troubleshooting something like this, our free SPF checker queries your public DNS the same way a receiving server would, so you can see exactly what the outside world sees. If something looks off and you're not sure why, the SOS hotline is free and we're happy to take a look with you.