Some names should resolve only inside the cluster or over a private link, never on the public internet. On Syself Autopilot, CoreDNS is managed by the platform, so you shape private resolution with the cluster's upstream resolver and with internal-only Services, rather than by editing CoreDNS.

## Resolve private names through the cluster's upstream

CoreDNS answers cluster names itself and forwards everything else to the node's upstream resolver. That upstream is the `dnsServers` cluster variable. Point it at a resolver that serves your private zones, such as an on-prem DNS server reached over your [VPN](/docs/hetzner/apalla/network/egress/connect-to-on-prem-or-vpc), and pods resolve those names while it forwards public queries onward.

```yaml vars title="cluster.yaml"
spec:
  topology:
    variables:
      - name: dnsServers
        value: ["10.100.0.53"]
```

This is cluster-wide, not per-zone. Every non-cluster lookup goes to that resolver, so it must answer your private zones and forward all other queries to the internet. Managed CoreDNS provides no per-zone stub-forward that you can add, so a single resolver that knows both your private names and the public internet is how you split the two views.

## Internal-only Services

A Service without `type: LoadBalancer` is already private. A `ClusterIP` Service is reachable only inside the cluster, and a headless Service (`clusterIP: None`) resolves to the pod IPs behind it for stable per-pod names. Neither has a public address, so nothing here exposes them. Use them for any service that other pods must reach but the internet should not.

## The API endpoint must resolve publicly

The cluster's API endpoint name is where split DNS matters most. That name must resolve to the control-plane load balancer from **Syself's side**, not only from your own machine, because the controllers that manage your cluster connect through the same name.

> [!WARNING]
> Never give the API endpoint a name that only you can resolve, an `/etc/hosts` entry, or a split-horizon view that answers differently inside your own network. If the name does not resolve to the load balancer from the management side, the cluster never finishes provisioning and the control plane remains unavailable. Publish real, public `A` and `AAAA` records for the endpoint name. See [Serve IPv6 clients](/docs/hetzner/apalla/network/load-balancing/serve-ipv6) for the endpoint DNS setup.

Restricting who may reach the API is a separate concern from resolving its name; that is the allowlist's responsibility, not DNS's. See [Restrict API server access](/docs/hetzner/apalla/security/restrict-api-server-access).

## Where to go next

- [Understand in-cluster DNS (CoreDNS)](/docs/hetzner/apalla/network/dns-certs/coredns-behavior-and-tuning)
- [Automate DNS records with external-dns](/docs/hetzner/apalla/network/dns-certs/automatic-dns-with-external-dns)
- [Diagnose pod DNS resolution](/docs/hetzner/apalla/network/debug/diagnose-pod-dns-resolution)