Accessing a self-hosted service by its real domain name should work the same whether you’re sitting at home or connecting remotely — but by default, a domain pointed at your public IP forces even local devices to route traffic out to the internet and back in again unnecessarily. Split-horizon DNS solves this, serving different answers to the same domain name depending on whether the request comes from inside or outside your home network.
What Is Split-Horizon DNS?
Split-horizon (also called “split-brain”) DNS means your DNS server returns different IP addresses for the same hostname depending on the source of the query. Internal devices querying jellyfin.yourdomain.com get your server’s local IP address directly, while external queries for the same hostname get your public IP address, letting one consistent domain name work correctly from anywhere.
Why This Matters for a Home Lab
Without split-horizon DNS, a device on your home network accessing jellyfin.yourdomain.com would resolve to your public IP, then have to route out through your router, across the internet to your ISP, and back in through port forwarding — a completely unnecessary round trip for traffic that never needed to leave your local network in the first place. This adds latency and, depending on your router, sometimes doesn’t work at all due to “NAT hairpinning” limitations some consumer routers have.
Setting This Up with Pi-hole or Technitium
If you’re already running Pi-hole or Technitium DNS Server as your home network’s DNS resolver, split-horizon behavior is straightforward to configure through Local DNS Records (Pi-hole) or the equivalent zone configuration (Technitium):
- Add a local DNS record mapping your domain (e.g.,
jellyfin.yourdomain.com) directly to your service’s internal IP address. - Ensure all home devices use your Pi-hole or Technitium server as their DNS resolver (already the case if you followed the earlier ad-blocking setup guides).
- External DNS records for the same domain, managed through your actual domain registrar or a service like Cloudflare, continue pointing at your public IP as normal.
Now, internal devices querying that domain get the fast, direct local answer, while anyone outside your home network gets the public IP and routes in through your normal port forwarding or reverse proxy setup.
Verifying the Setup Works Correctly
From a device on your home network:
dig jellyfin.yourdomain.comConfirm the returned IP matches your internal server address, not your public IP. Then test from an external network (mobile data, for instance) to confirm the same domain correctly resolves to your public IP instead.
Handling Certificates for Both Access Paths
Since both internal and external access use the same actual domain name, a single Let’s Encrypt certificate (or one issued from your local Certificate Authority, ) obtained for that domain works correctly for both internal and external connections — no need for separate certificates or accepting browser warnings on one path but not the other.
Combining with a Reverse Proxy
Split-horizon DNS pairs naturally with Nginx Proxy Manager (covered earlier): internal DNS records point directly to your reverse proxy’s internal IP, external DNS records point to your public IP forwarded to that same reverse proxy, and NPM handles routing based on the requested hostname identically regardless of which path the traffic arrived through.
Common Pitfalls
- Forgetting to update internal DNS when adding new services – each new internally-routed service needs its own local DNS record added, or it’ll fall through to the public DNS answer and take the unnecessary round trip
- DNS caching delays – changes to local DNS records may take a moment to propagate depending on cached TTL values on client devices; flushing a device’s DNS cache helps when testing changes immediately
- Inconsistent behavior on guest networks – devices on a separate guest VLAN not using your internal DNS resolver won’t get the split-horizon benefit, resolving purely through public DNS instead
Final Thoughts
Setting up split-horizon DNS for your home lab ensures your self-hosted services work efficiently and consistently regardless of where you’re connecting from, avoiding unnecessary round trips to the internet for traffic that never needed to leave your home network. Combined with a reverse proxy and a single shared certificate, it rounds out a genuinely seamless experience across both internal and external access paths.
Leave a Reply