The first part of a targeted attack (i.e. to penetrate a network) is to find out as much as possible about the target. It is very common that a company uses the same domain name in the internal network as it does for public available sites. It is also very common that the name of host describes its purpose.
If you don't use Split DNS that would mean that you publish the information about all hosts inside a domain at a single public available place. These published information would reveal the names of the hosts and also the internally used IP addresses and could thus get an attacker lots of inside about the companies infrastructure.
DNS just maps text names to IP addresses.
Just a single example what an attacker could do when it knows these mappings for internal hosts:
- Access the public available DNS information and find out that there is a host named wiki.example.com with the IP address 10.1.2.3. Given the name of the hosts this could be an internal wiki which probably provides interesting information about the company. Lets try to get exfiltrate the company-intern information published there.
- To do this the attacker sets up its own website example.attacker. This server resolves initially to an external IP address controlled by the attacker. The DNS server for this domain is controlled by the attacker too. A link to this server will be included an interesting phishing mails or similar so that someone from inside the company will access the site.
- Once the site got accessed and some scripts got downloaded the attacker will change the IP address for this site as visible from the company to the IP address of the site it likes to attack: i.e. example.attacker will now resolve to the same IP address 10.1.2.3 as wiki.example.com. This trick is called DNS Rebinding.
- The script already downloaded from the attackers site then tries to access example.attacker. Since this site now resolves to 10.1.2.3 this request will access the internal server wiki.example.com, but with the name example.attacker. Servers used only for a single domain often ignore the Host header of the request so that the content of the site is accessible not only by using wiki.example.com but also example.attacker as long as both names resolve to the same IP address.
- Because the Same Origin Policy only restricts access by DNS name and not by IP address the already loaded scripts from the original example.attacker host can now interact with the new example.attacker host site (which is wiki.example.com) and thus grab the information from this site and forward these information to the attacker.
In summary: the more you know about your target the better you can compromise it. Split DNS is not the ultimate solution to protect against all the data leaks but it helps to protect at least part of the data. Thus it is part of defense in depth.
I've had many issues with split DNS in the past, with programs that don't properly respect ttls. They cache resolution for a long time, and since DNS is inconsistent (i.e. it depends on my source IP), they break.
It looks like you use the same system (notebook or mobile?) both within the protected company network and in the unprotected internet. This is a very bad idea since this provides an easy vector for malware to get moved into the company network, bypassing all protections they might have. The secure way would be instead to have the company notebook never connect directly to the internet but only use a VPN when outside which tunnels everything through the company network, including DNS lookups. And private hardware should never connect to the protected company network, but should be instead contained inside a separate network when used inside the company. If used this way you should also not see problems with Split DNS, since you never switch between external and internal DNS setups on the same system.
Get-DnsServerResourceRecord)