Internal DNS / Enterprise DNS Teams

One Name.
The Right Answer.

Adam Lapins
Senior Specialist Solutions Engineer, Cloudflare
September 2, 2026

The tension

The same private name can be right in one site and wrong in another.

HQ query contextSource 192.168.101.20
app.citadel.internal

Expected answer: 192.168.101.20

DC-East query contextSource 192.168.102.20
app.citadel.internal

Expected answer: 192.168.102.20

Source: https://developers.cloudflare.com/dns/internal-dns/

The architecture

The query context chooses the answer.

Sources: https://developers.cloudflare.com/dns/internal-dns/ https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-wan/zero-trust/cloudflare-gateway/

The proof

Three queries tell the whole story.

Public control
$ dig +short @1.1.1.1 app.citadel.internal
(no public A answer)
HQ
$ dig +short @172.64.36.1 app.citadel.internal
192.168.101.20
DC-East
$ dig +short @172.64.36.1 app.citadel.internal
192.168.102.20
Staged control and site probes captured September 2, 2026.

The control model

Build left. Query right.

Build order / left to right
Internal zone
DNS view
Resolver policy
Query flow / right to left
Query context
Resolver policy
DNS view
Internal zone
Answer
Source: https://developers.cloudflare.com/dns/internal-dns/get-started/

The evidence

The decision is visible in Gateway.

HQ / staged event

query
app.citadel.internal
destination_ip
172.64.36.1
resolver_rule_id
d4dda74709974f038ae28c07cf0c9c84
internal_dns_view_tag
6e0d0d55ff744548b2de25f81d7a9ba0
resolved_ips
192.168.101.20

DC-East / staged event

query
app.citadel.internal
destination_ip
172.64.36.1
resolver_rule_id
fe397a85b0be4aaeb2827c5c59258521
internal_dns_view_tag
8c1ec8eb655743d0b173ac06887975f5
resolved_ips
192.168.102.20
Observed fields captured from Gateway DNS activity at 2026-09-02T16:00:14Z.

The next validation

Your DNS policy should describe your network, not our lab.

Outcome and proof

Which query context must return which answer?

Date and owner

What date matters, and who signs off?

First site and rollback

Which site goes first, and what restores service?

Choose one site and one name for the next validation.