Externally applying internal network domain name system (DNS) policies

One or more non-transitory computer-readable storage media including instructions that, when executed by one or more processors, cause the one or more processors to apply internal network policies to domain name service (DNS) queries by performing steps of:

• receiving, by a first global recursive resolver included in an external network, a global DNS query that includes:
• (i) a client subnet that is derived from an internal Internet Protocol (IP) address representing a first internal device in an internal network, and
• (ii) a source Internet Protocol address representing a device that is transmitting the global DNS query,
• wherein the internal IP address is different from the source IP address;
• extracting, from the global DNS query by the first global recursive resolver, (i) the client subnet and (ii) the source IP address;
• selecting, by the first global recursive resolver and based on both (i) the client subnet and (ii) the source IP address, a first internal network policy from a plurality of internal network policies;
• and
• applying, by the first global recursive resolver, the first internal network policy when performing one or more DNS resolution operations to generate a response to the global DNS query.

A system comprising:

• a memory contained in a first global recursive resolver storing a policy engine, wherein the first global recursive resolver is included in an external network;
• and
• a processor contained in the first global recursive resolver that is coupled to the memory and, when executing the policy engine, is configured to:
• receive a global DNS query that includes:
• (i) a client subnet that is derived from an internal Internet Protocol (IP) address representing a first internal device in an internal network, and
• (ii) a source Internet Protocol address representing a device that is transmitting the global DNS query,
• wherein the internal IP address is different from the source IP address;
• extract, from the global DNS query, (i) the client subnet and (ii) the source IP address;
• select, based on both (i) the client subnet and (ii) the source IP address, a first internal network policy from a plurality of internal network policies;
• and
• apply the first internal network policy when performing one or more DNS resolution operations to generate a response to the global DNS query.