How to Configure Split DNS on an MX WAN Appliance

Overview 

This article explains how to configure Split DNS on an CIsco Meraki MX WAN appliance. Some deployments require DNS queries for specific domains to be directed to specific DNS servers. This is often needed when a public-based DNS service, such as OpenDNS, handles most DNS queries, but internal resources or applications require local name resolution. 

When Split DNS is configured on an MX, the MX snoops DNS traffic. The MX intercepts DNS queries that match the configured domains for Split DNS and redirects them to the configured DNS server. The MX transmits these redirected DNS requests to the configured server in accordance with its routing behavior. 

The MX also intercepts the responses to these DNS queries and routes them back to the client that issued the original DNS request. The MX must see both the client's DNS requests and the server's response to properly redirect DNS requests to the configured DNS server and route the responses back to the client. 

Prerequisites 

MX firmware 19.1 or later. 

Step-by-step instructions 

Split DNS is configured via API. Complete the following steps: 

1. Create a Split DNS profile using create organization appliance DNS split profile. 

2. Assign the Split DNS profile using create organization appliance DNS split profiles assignments bulk create. 

3. Use the profile ID from the create split DNS profile request response body in the assignment. 

Troubleshooting 

Split DNS has the following limitations: 

• Split DNS does not currently support redirection through CNAMEs. If a client queries the A record of FOO but learns of BAR (a canonical name for FOO), a subsequent A record query for BAR will not be redirected unless BAR is also configured as a Split DNS domain. The MX will not recognize or treat BAR as an alias for FOO. 

• Split DNS supports redirecting DNS requests to only one DNS server. 

The MX must see the DNS request and the response from the configured DNS server for redirection to work properly.