How is Google is resolving my intranet IP...?

[yaypingworks]

I have VLAN 2, with ACLs that first permit traffic to our intranet IP, then deny the rest of the LAN.

VLAN 2's DHCP server is set to Google.

I wasn't expecting this to work, but I am able to go to the intranet website via its FQDN, but how would that even be resolved?

I flushed DNS records, did an nslookup and its saying 8.8.8.8 is giving the response. 

Ultimately, we want VLAN 2 to be able to access the intranet but i would like to know how this is working currently... I was expecting to have to change VLAN 2 to use our local DNS server in order to resolve the intranet FQDN.

Edit: I cant resolve any other LAN devices, just the intranet

[cmr]

Is your DNS lookup using DNS over HTTPS?

[yaypingworks]

No, nothing I was testing has that feature enabled on the browser or OS

[DarrenOC]

Have you checked to see if you have any PAC/Hosts files configured on your machines that are performing the local DNS lookups?

Seems unlikely that Google would resolve your local hostnames.

[yaypingworks]

That shouldn't be the case as I tested on a fresh device yet still able to get to intranet.

[Brash · Accepted solution]

The only way Google would resolve you intranet is if you have a publicly registered DNS entry for it.

For example, if I register brash.com, I could have a DNS entry for intranet.brash.com and point it to my internet intranet IP (Eg. 192.168.1.100). It would mean nothing to anyone except those on my network.

Assuming you haven't done this, your hosts must be resolving it from somewhere else. Heck, you could verify this by using a non corporate computer and running an nslookup directly to the server 8.8.8.8 requesting your intranet FQDN to see if it resolves.

One other thing to note is that there are security applications and web browser settings that override a computer's configured DNS and use a different DNS instead.

[yaypingworks]

This was it, we found that we were publishing the record for some reason. Thanks for the pointer!

[PhilipDAth]

Have you got a 1:1 NAT configured to allow access from the outside in?  And is the FQDN you are using a public DNS name?

1:1 NAT also acts on traffic from the inside.