One client resolved the internal address, another returned the public record, and both insisted they were using the same resolver. They were—eventually.
The missing detail was a local cache plus a fallback resolver supplied by an old network profile. Checking the complete resolver order would have made the problem obvious in minutes.
The two checks
My new first two checks are boring and effective:
- Inspect the resolver configuration on the affected host.
- Query the intended server directly.
DNS rewards precision.