Split DNS means one domain asks a different server than everything else. Typically after a VPN comes up: company.internal should be answered by the resolver behind the tunnel, example.org by the public one.
How systemd-resolved does it
systemd-resolved keeps resolvers per interface and picks between them using a routing domain. A domain written with a tilde (~company.internal) does not mean “search this domain” – it means “send queries for this domain here”.
Setting it on one interface
resolvectl dns tun0 10.10.0.53 resolvectl domain tun0 '~company.internal'
Checking where a query will go:
resolvectl query nas.company.internal resolvectl status tun0
Making it stick
A manual resolvectl call dies with the interface. Persistent configuration belongs to whoever creates the interface – for systemd-networkd, the [Network] section of the matching .network file:
[Network] DNS=10.10.0.53 Domains=~company.internal
In NetworkManager the same thing lives in ipv4.dns-search with a tilde.
What is still missing
Unfinished. Still to cover: behaviour under DNSSEC=allow-downgrade when the internal zone is unsigned, and what happens when the tunnel drops – whether queries fall through to the public resolver or fail.