DNS Zones
- Last UpdatedMar 27, 2025
- 3 minute read
DNS Zones are designed to provide trusted devices with "internal" DNS responses, even if those devices are physically outside the organization's network perimeter. By configuring custom DNS Zones, you define your organization's authoritative DNS name servers that should be used for the internal domains that you own. With this, each DNS request is sent to one of the defined name servers using a pseudo-random load balancing algorithm.
Each zone is comprised of:
A zone name
A set of domains that identify the zone. DNS queries matching these domains will be matched against this custom DNS Zone configuration. A given domain can only belong to a single Custom DNS Zone.
The IP addresses of your network's Authoritative Name Servers that are able to service DNS requests for the defined domains
The Interconnect Gateways used to reach the defined name server IP addresses to resolve client DNS requests
Custom DNS Zones are used to resolve hostnames belonging to a specific set of domains via one or more authoritative name servers within your network.
IP addresses of authoritative name servers
- Configured Interconnect Gateways through which those servers are availableImportant:
Misconfiguring a zone may result in lost connectivity to some or all of your private applications and workloads for your end users.
Make sure that all defined domains are resolvable by the authoritative name servers defined within each zone. Ensure that all authoritative name servers are available via the defined interconnect gateways.
Each DNS query matching the list of domains in the Custom DNS Zone will be routed to one of the configured Authoritative Name Servers using a pseudo-random load-balancing algorithm.
If your internal infrastructure changes, you must edit and reconfigure your Custom DNS Zones as well. Changes that may require you to reconfigure your zones include:
Adding a new Authoritative Name Server into your infrastructure
Changing the IP Address of the existing Authoritative DNS Server
Adding a new application with a domain name that doesn't match the domains of the Custom DNS Zone
Changing a domain name of one of your applications, if the new name doesn't match the domains of the Custom DNS Zone
You can now proceed to configure your access policy.
If you experience DNS lookup failures within a custom DNS zone, verify that DNS requests are being received by Jamf's servers and forwarded to the correct DNS resolver in your network.
- Ensure that the custom DNS zone is configured properly in Jamf Security Cloud. For DNS zones being forwarded to your network, edit the configuration to determine which IPsec gateway is being used to forward DNS requests to your network's authoritative name servers.
- Confirm that the IPsec gateway is active and connecting to Jamf Security Cloud by navigating to and reviewing the gateway's status.
- Review the Zero Trust Network Access (ZTNA) DNS logs in Jamf Security Cloud to determine whether requests are being forwarded correctly. You can access these logs by navigating to . To view the IP address of the DNS resolver that provided the response, click the three dots at the top right of the Event logs table and select the Resolver checkbox.