A split horizon DNS setup works on LAN and fails at the edge

A hybrid network uses different answers for internal and public clients and later some edge users resolve to the wrong target after an upstream cache change.