Skip to main content
VPNnet

Private DNS

Find your servers by name.

An enrolled server can have a private name such as server01.admin42.vpnnet.net. Your engineers can use that name from permitted enrolled devices, wherever they work.

A private name, resolved on your device.

Example: an engineer enters server01.admin42.vpnnet.net. On a phone, swipe across the diagram to follow the whole path.

Private DNS resolves locally before an allowed server connectionThe controller distributes peer records and DNS configuration to the client resolver, shown as gray dashed arrows. The engineer application queries that local resolver and receives the server overlay IP, shown as amber arrows. A separate green encrypted data path reaches server01 only when access policy permits it. Optional split DNS forwards matching company-domain queries to a reachable company resolver. The controller is not the runtime DNS query server or the data forwarder.Company controllerPeer records + configurationDistribute, not queryEngineer applicationOn an enrolled laptop1. Ask for server01’s full nameClient’s local DNS resolverDistributed private records2. Answer with VPN IPLookupVPN IPserver01Enrolled serverPrivate overlay address3. Policy allows the application portEncrypted application trafficOptional company resolverSplit DNS matches onlyMust be reachableOther configured company domainscan use a separate upstream resolver
Dashed gray: configuration distribution. Amber arrows: local lookup and answer. Green: permitted encrypted application traffic. Dotted gray: optional split DNS for a different company namespace. The controller is neither the runtime DNS query server nor the ordinary data forwarder.

These private records are not public Cloudflare records. Public DNS still locates your controller and other public services. A private peer name does not make a server publicly reachable, and resolving its name does not grant access.

Set up your company namespace.

  1. Choose a dedicated suffix. An administrator can set the peer DNS domain in Settings → Network → DNS Domain. For example, use admin42.vpnnet.net only for this private namespace. Do not reuse a domain whose existing answers you need to preserve: the local zone can shadow them.
  2. Enroll and check the peer label. Check the server’s name and assigned DNS label in Peers. A duplicate hostname may receive a suffix. Use the displayed full name rather than assuming enrollment reserves a particular name.
  3. Enable DNS management for the intended groups. Review DNS → Settings and nameserver distribution groups. DNS management must also be enabled on the client. Preserve existing enterprise resolvers and test a limited group before wider rollout.
  4. Configure platform integration. Linux can integrate peer DNS without a custom upstream nameserver. Windows, macOS and mobile clients may need a distributed nameserver configuration for managed DNS to activate. Split-domain support depends on the OS resolver: macOS, Windows 10+ and Linux with systemd-resolved support it. Android Private DNS can bypass VPN DNS and must be reviewed.
  5. Test names and access separately. From a second enrolled device, resolve server01.admin42.vpnnet.net, then test the specific permitted application port. Confirm ordinary internet and company DNS still work. Test again after reconnect and reboot.

Setup labels and capability checked against dashboard 2.95.0 and server/client 0.81.4 source. Platform behavior needs validation on your actual clients. No DNS settings are changed by this page.

Keep your existing company DNS.

Split DNS

Under DNS → Nameservers, assign reachable company resolvers to the intended groups and specify match domains. Queries for those domains go to the company resolver; other names keep their intended resolution path. Resolver reachability, routing and DNS ports must be allowed.

Short names are optional

server01 works only when the appropriate search suffix is configured. Without it, use the full name. A search suffix is not an additional “mesh” label and does not replace a DNS record.

Names and addresses work together

A stable overlay address can complement a readable name for firewall rules or applications. This does not promise pre-enrollment address reservations or that reinstalling preserves a peer’s IP or identity.

For Active Directory, direct queries for the AD namespace to your reachable AD DNS servers. Network connectivity does not replace domain authentication, application permissions or the required AD service configuration.

Use the name. Keep the permission explicit.

An engineer may be allowed HTTPS to one application and SSH to selected servers. DNS resolution alone does not allow either. Broad allow-all rules can defeat intended restrictions; narrow rules do not override a broader allow rule.

Explore server connectivity across clouds → · How connections and relays work →

Technical references: underlying NetBird DNS documentation. Newer documentation may describe behavior beyond the pinned Alpha versions.

Discuss your company DNS

Lobby onboarding: review new devices before granting service access →