📘
Organizations Only
A business account is required to use this feature.

What is Network Settings

Network Settings controls network-wide DNS resolution for Endpoints that run managed ctrld. You will find it in the Organization section of the sidebar, alongside Data & Retention and Identity & Access.

The page currently has one section: Internal Domains.

Internal Domains

Internal Domains are private domain suffixes that must not be resolved by Control D. Examples are an Active Directory domain (ad.example.com), an intranet zone (corp.example.com), or a cloud-private zone. Queries for these domains go to your own DNS instead:

Default network DNS (automatic) - the query goes to the DNS of the Endpoint's current network or VPN. Use this when the right resolver changes with location, for example a VPN that pushes its own DNS server.
Explicit resolver IPs - the query goes to the resolver addresses you enter, in the order you enter them. Private addresses are allowed.

Each entry is a domain suffix: it matches the domain itself and all of its subdomains. An entry for corp.example.com also matches files.corp.example.com and dc1.ad.corp.example.com.

Internal Domain queries never reach Control D. Because of this, Control D does not filter them and does not record them in Analytics.

Requirements

Internal Domains are delivered to Endpoints that run ctrld 1.5.8 or later, started with a Control D Resolver ID. ctrld fetches the list from Control D with the rest of its managed configuration, so changes reach Endpoints without a reinstall.

Add an Internal Domain

Go to Network Settings in the Organization section of the sidebar.
In the Internal Domains card, click +. If the list is empty, you can also click Add Internal Domain.
In Domain suffix, enter the bare domain, for example corp.example.com. Do not include a scheme, path, port or wildcard. Internationalized names must use their punycode (xn--) form.
In Resolution, select one:
- Default network DNS (automatic)
- Explicit resolver IPs, then enter up to 4 IPv4 or IPv6 addresses in Resolver IPs, separated by commas or spaces.
Optionally, enter a Description so other admins know what the entry is for.
Click Save.

🚧
Bare top-level domains
A single-label suffix such as local or internal matches every domain that ends in it. The Dashboard asks you to confirm before it saves one. Add one only if all of those domains really are on your private DNS.

Edit or remove an Internal Domain

Click Edit on an entry to change its domain, resolution or description.
Click Remove, then Remove again to confirm.

To change an entry from explicit resolver IPs back to the network's DNS, edit it and select Default network DNS (automatic).

Explicit resolvers and fallback

With Explicit resolver IPs, ctrld sends the query to your resolvers first. If none of them answers, or they answer with SERVFAIL or NXDOMAIN, ctrld tries the DNS of the Endpoint's active network and VPN. The query does not go to Control D.

Limits

Up to 4 resolver addresses per domain.
A domain suffix can be at most 253 characters, and a description at most 255 characters.
Each domain can be added only once per Organization.

Sub-Organizations

A parent Organization can share its Internal Domains with all of its Sub-Organizations. Turn on Apply to sub-organizations at the top of the Network Settings page.

When sharing is on:

Each Sub-Organization sees the parent's entries under Inherited from the parent Organization's name. These entries have an Inherited badge and are read-only in the Sub-Organization.
A Sub-Organization can add its own local entries next to the inherited ones.
If a local entry names the same domain as an inherited entry, the local entry wins for that Sub-Organization. The inherited entry shows an override icon.

The Apply to sub-organizations toggle is only shown to parent Organizations.

Permissions

Owners and Admins can add, edit and remove Internal Domains, and change Apply to sub-organizations.
Viewers see the page in view-only mode.

See Members and Permissions for what each permission level can do.

Internal Domains and the Control D Bypass Magic Folder

Before Internal Domains, the Control D Bypass Magic Folder was the way to keep private domains away from Control D. For managed Organizations, Internal Domains replace it. They are configured once per Organization instead of in each Profile, they can use explicit resolver IPs, and they can be shared with Sub-Organizations.

Existing Control D Bypass folders keep working and are not migrated. If a domain is in both places, the Control D Bypass rule takes precedence.

Manage Internal Domains with the API

Internal Domains are also available in the API. See the Internal Domains endpoints in the API Reference. To manage a Sub-Organization's entries with a parent Organization's token, send the X-Force-Org-Id header with the Sub-Organization's ID.