Overview
Customers sometimes notice internal hostnames appearing in UltraDNS hostname query reports and assume those hostnames exist within their UltraDNS zone configuration.
In some situations, internal hostnames can appear in reporting data even when the corresponding internal DNS records are not hosted in UltraDNS.
This article explains why internal hostnames may appear in hostname query reports and how VPN clients or internal DNS configurations can contribute to this behavior.
Why This Happens
Some VPN clients and internal DNS configurations continue attempting to resolve internal hostnames when devices are operating outside of the corporate network.
For example, a user working remotely may attempt to resolve the same internal hostnames they normally use while connected to the corporate network.
When those queries are sent to a public recursive DNS resolver instead of the organization's internal DNS infrastructure, the normal DNS resolution process continues through the public DNS hierarchy.
If the domain name being queried matches a domain hosted in UltraDNS, the DNS hierarchy can direct the query toward the authoritative UltraDNS nameservers for that domain, even when the requested internal hostname record does not exist in the zone.
Common Example
An organization may use internal hostnames such as:
server01.example.comvpn.example.comfileshare.example.com
If a remote user's device attempts to resolve one of these names through a public recursive resolver, and example.com is hosted in UltraDNS, the query may reach UltraDNS authoritative nameservers even if the internal hostname is not configured in the public zone.
How This Affects Reporting
Because the query reaches UltraDNS authoritative infrastructure, the hostname may appear in hostname query reporting.
The presence of a hostname in a report does not, by itself, indicate that the hostname exists as a DNS record within the UltraDNS zone.
The report reflects query activity received by the authoritative DNS service.
Important Notes
- Internal hostnames appearing in reports do not necessarily indicate that those records are configured in UltraDNS.
- VPN clients and internal DNS configurations can generate queries for internal hostnames while users are outside the corporate network.
- These queries can be visible in hostname query reporting when the parent domain is hosted in UltraDNS.
- Queries received by UltraDNS authoritative nameservers count toward reported UltraDNS query volume.