Homelab DNS, Split Horizon, Filtering, and Light Segmentation
Published 2026-06-24 · Updated 2026-08-21 · 22 min read · By Ben Liu
One network naming pillar: public vs private DNS answers, Pi-hole vs AdGuard Home, ACME DNS-01 hygiene, and VLAN segmentation without overengineering.
One naming scheme
Pick a domain pattern like `service.home.example.com`. Mixing `.local`, random `.lan`, and raw IPs multiplies client bugs. Document internal vs public answers in one table.
Split horizon
LAN resolvers can return private IPs while public DNS points at the gateway. Certificate names must still match. Test both paths — hairpin NAT failures hide on home Wi-Fi.
# LAN vs outside
dig +short photos.home.example.com @192.168.10.2
dig +short photos.home.example.com @1.1.1.1Pi-hole vs AdGuard Home
Both are LAN DNS filters + optional local records — not VPNs.
| Axis | Notes |
|---|---|
| Day-2 UI | Pick the workflow you will actually use |
| Lists | Aggressive lists break banks/TVs; keep allowlist habit |
| Local rewrites | One source of truth for lab hostnames |
| Failure mode | Filter box down ⇒ house looks offline — have bypass DNS |
Freeze one filter for a year. Dual-filtering experiments confuse more than they help. Back up config exports monthly.
Light segmentation (VLANs without a second career)
Flat LANs let compromised IoT talk to the NAS. Common pattern: management / servers / trusted users / IoT (internet-only) / guest. Default deny between VLANs except explicit allows (users→servers:443).
Move servers first, IoT second, users last. VPN should land on servers VLAN, not IoT. mDNS does not cross VLANs — plan casting deliberately.
Lab notes pending — replace with measured values before publishing claims.
[Add real environment data here]
Primary domain pattern:
Internal resolver:
Public DNS provider:
Filter (Pi-hole/AdGuard/none) + version:
VLAN sketch (if any):ACME DNS-01 tokens
Scope API tokens to the minimum zone. Treat them like root credentials. Rotate if leaked. Lower TTL before migrations; raise after.
Related reading
See Automatic SSL certificates, Secure remote access, Lightweight monitoring, and What is self-hosting.
Explore more
Related guides
- Reverse Proxy and Automatic TLS for Homelabs
One ops guide for reverse proxy + ACME: what a proxy solves, Caddy/Traefik/Nginx fit, certificate renewal, Docker wiring, failure modes, and troubleshooting — without three overlapping primers.
- Media Server Bandwidth, Clients, and Stack Choices
Plan household video and audio streaming without melting upload: measure uplink, Jellyfin/Plex/Emby fit, audio library notes, remote caps, storage, and edge hardening.
- Secure Remote Access: VPN, SSH, and Zero-Trust Options
Compare common remote-access patterns for home servers without defaulting to open ports everywhere — with lab notes.