So much rep to be had. Come to me precious.
Ok, so c'est pretty well documented by Microsoft that you ne devrait pas use split-horizon, ou a made up TLD as you've linked to beaucoup de times (shout out to mon blog!). Il y a a peu de reasons for this.
-
The www problem that you've pointed out above. Annoying, mais pas a deal breaker.
-
It forces you to maintain duplicate records for all public-facing servers that are aussi accessible internally, pas juste www. mail.hopelessnoob.com is a common example. In an ideal scenario, you'd have a separate perimeter network for things like mail.hopelessnoob.com ou publicwebservice.hopelessnoob.com. With certains configurations, like an ASA with Internal and External interfaces, you soit need inside-inside NAT ou split-horizon DNS anyway mais for larger organizations avec a legitimate perimeter network où votre web-facing resources ne sont pas behind a hairpin NAT boundary - this causes unnecessary work.
-
Imagine this scenario - You're hopelessnoob.com internally et externally. Vous avez a corporation that you're partnering avec called example.com et they do le même thing - split horizon internally avec leur AD et avec leur publicly accessible DNS namespace. Now, you configure a site-to-site VPN et want internal authentication for le trust to traverse le tunnel tandis que having access to leur external public resources to go out over le Internet. C'est suivant to impossible sans unbelievably complicated policy routing ou holding votre own copy of leur internal DNS zone - now you've juste created an additional set of DNS records to maintain. So you have to deal avec hairpinning at votre end and leur end, policy routing/NAT, et tous kinds of autre trickery. (J'étais actually in this situation avec an AD that I inherited).
-
If you ever deploy DirectAccess, it drastically simplifies votre name resolution policies - this is likely aussi true for autre split-tunnel VPN technologies as well.
Some of these are edge cases, certains are not, mais they're tous easily avoided. If you have le ability to do this depuis le beginning, might as well do it le right way so that you ne run into one of these in a decade.
