What is Split DNS and how do I implement it in 3CX V20?

---

Introduction to Split DNS (Domain Name System)

Split DNS is a network configuration that allows a single domain name to resolve to different IP addresses, depending on whether the request originates from within an internal network (intranet) or from the external internet. This technique is commonly used in organizations that want to direct internal and external traffic to different servers for the same domain, often for reasons related to load balancing, security, or resource optimization.

The transition from using internal IP addresses to fully qualified domain names (FQDNs) for devices behind Network Address Translation (NAT) by platforms like 3CX represents a significant shift in approach towards managing internal and external network communications, particularly for VoIP (Voice over Internet Protocol) systems. This change is primarily motivated by several critical factors, including security, scalability, and compatibility with modern Internet standards.

Why the Shift to FQDNs?

• Security Enhancements: Using FQDNs can enhance security by enabling SSL/TLS certificates, which secure communications between clients and servers. By using FQDNs, all internal and external communications can be encrypted, reducing the risk of interception.
• Simplification of Configuration: FQDNs simplify the configuration of devices and services in environments with complex network topologies, including those with multiple sites or cloud-based resources. They allow a uniform access method regardless of the location or network from which a request originates.
• Improved Compatibility with NAT: NAT can complicate VoIP and other communications, especially when maintaining session integrity across the network boundary. Using FQDNs allows for sophisticated DNS strategies like Split DNS, facilitating smoother communication setups that are aware of NAT boundaries and can intelligently route traffic.
• Ease of Certificate Management: With the increased reliance on SSL/TLS for securing communications, managing certificates based on IP addresses can be cumbersome and less secure than using domain-based certificates. FQDNs align with the structure of the public internet and how certificates are verified and issued.

Split DNS in 3CX V20

Implementing Split DNS in an on-premise 3CX V20 installation involves configuring your DNS settings so that a Fully Qualified Domain Name (FQDN) resolves to your internal 3CX server's IP address when accessed from within your network. This is most often done at the Firewall if your Firewall does not support Split DNS. Set up an internal DNS server (if you don't already have one) that will resolve the FQDN to the internal IP address of the 3CX server. 3CX will still manage the external access via Cloudflare's API for all public IP addresses.

When upgrading from 3CX version 18 to version 20, pre-existing IP phones within your network will transition to utilizing Split DNS, adopting the Fully Qualified Domain Name (FQDN) for system-wide communication rather than relying on local IP addresses within your LAN.

---

Sources:

• https://www.3cx.com/docs/creating-fqdn-split-dns/
• https://www.3cx.com/blog/releases/split-dns-on-prem/