Public CNAMEs with private A/AAAAs in Split Horizon Setup

[eopo]

Imagine the following

Public DNS:
whateverservice                 IN  CNAME         server
server                          IN  A             123.456.789.1

Technitium
$ORIGIN example.test.
@                     0         IN  SOA           ns-h.dns invalid. 12 900 300 604800 900
@                     0         IN  FWD           Udp "this-server" True DefaultProxy 0
server                3600      IN  A             10.11.12.13

server is both an VPN endpoint as well as web and mails server as well as reverse proxy.

Technitium has recursion enabled and no forwarders set.

I would want a local client, that queries for whateverservice to receive 10.11.12.1 for an answer as to use the VPN connection instead routing over the internet. Currently, I do get the public IP of server though.

I know there are plugins that would be able to override all answers containing the public IP with the private IP, which would break the VPN connection though, as the VPN devices would try to keep the VPN connection using the VPN tunnel IP of server instead of the public one.

The other option would be to duplicate all of the CNAMEs that are defined in the authoritative name server to my private one, but I'm sure as hell I'd forget that sometimes and wonder why stuff doesn't work.

Is there a way to use the "upstream" CNAMEs but resolve the IP locally (if entries exist for that)?

[ShreyasZare]

Thanks for asking. You can do that by creating a Conditional Forwarding zone for the domain name and select "This Server" as the forwarder. You can then add the required A record which will override the public record while the rest of the records will get resolved internally via This Server.

[eopo]

Unfortunately, it doesn't seem to work. I created the Conditional Forwarder Zone from scratch and chose "This Server" as forwarder. I have the overriding A and AAAA records and flushed the cache. I do get the public IP though.
Local overriding CNAMEs work fine and directly querying the A record, where the CNAME leads to, does work fine as well.
Is there a way to have more detailed Logs so I can provide you with them?

Or did I get you wrong and I have to create a new zone for the FQDN the CNAME leads to?

I've replaced my example with the actual zone file, maybe that helps a bit.

[ShreyasZare]

From your example, you have A record for server.example.test. which is not what the CNAME points to. You need to create a forwarder zone for server. and add @ A record in there for this to work.

[eopo]

Oh, I'm sorry, I didn't change that with the rest. Of course the CNAME in public is to server.example.test.
So: I do need a separate zone just for server.example.test, an server IN A ... within the conditional forwarder zone example.test won't work?

[ShreyasZare]

Both the zones (server.example.test and example.test) would work since the A record is mapped to the correct domain name server.example.com in both the cases.

If you still have issues with the setup, please share a screenshot of your forwarder zone and the output you see when you test the domain name using the DNS Client tab on the admin panel. You can share it here or send it via email to support@technitium.com.