Split-horizon DNS across 3 sites over a Tailscale mesh

Three VPC + IDC site pairs, each owning a private Route 53 hosted zone for corp.internal; local Unbound resolvers forward the zone over Tailscale.

01 · Site topology

Tracing api.corp.internal from the selected origin site

One FQDN, three answers

Cache, forward — and a forwarder, not a proxy