Skip to main content

Set Up Split DNS

Configure per-tunnel DNS routing so only specific domain queries go through your VPN connection.

Set It Up

  1. Open a user-created tunnel and choose Edit, or begin creating a new tunnel.
  2. Open the Vylos tab in the tunnel form.
  3. Add Match Domains for DNS queries that must use the tunnel.
  4. Add optional Search Domains for suffixes that should be tried with bare hostnames.
  5. Save the tunnel.

Managed tunnels receive Split DNS settings from the organization's VPN profile and cannot be edited inside Vylos.

How It Works

Split DNS lets you route DNS queries for specific domains through the VPN tunnel while leaving all other DNS queries on your default network. This is useful when you need to resolve internal hostnames (such as company intranet domains) through the VPN without sending all DNS traffic through the tunnel.

When split DNS is configured for a tunnel, the system intercepts DNS queries and checks the domain against the configured rules:

  • Match Domains — DNS queries for these domains are sent through the VPN tunnel's DNS servers. For example, if you add corp.example.com, any lookup for server.corp.example.com will be resolved through the tunnel.
  • Search Domains — Fallback domains that are appended when a bare hostname query fails. For example, if you add example.com as a search domain, a query for intranet will retry as intranet.example.com.

Domain Validation

Each domain entry must be a valid hostname. Vylos also accepts an optional leading wildcard and a trailing dot for a fully qualified name.

In plain terms:

  • A normal domain label must start and end with a letter or digit.
  • May contain hyphens, but not at the start or end of a label.
  • Labels are separated by dots.
  • May begin with *. to describe subdomains.
  • May end with . to use fully qualified form.
  • No spaces, underscores, or special characters.

Examples of valid domains include example.com, internal.corp.example.com, *.internal.example.com, and example.com..

File Representation

Split DNS values are stored in the [SplitDNS] section of a .vylos archive's settings.conf entry. See Vylos File Format for the canonical schema and a complete example.

For a managed tunnel, place that same settings text in the VPN profile's VendorConfig dictionary as VylosConfigBase64 or raw VylosConfig. See Split DNS Settings Transport for a copyable .mobileconfig example.