A service name example.internal must resolve to a private IP inside the VPC but to a public IP for internet clients. What Cloud DNS pattern achieves this split-horizon behavior?

The correct solution leverages Cloud DNS's split-horizon functionality. By creating both a public and a private managed zone for the same DNS name (e.g., example.internal), and attaching the private zone to your VPC network, internal queries will resolve using the private zone's records, returning private IPs. External queries will resolve using the public zone, returning public IPs. This provides the desired behavior where the same hostname resolves differently based on the client's origin. The other options are incorrect: Relying on firewall tags to change DNS responses is not a standard or supported Cloud DNS feature. Firewalls control traffic, not DNS resolution logic. A forwarding zone is used to forward queries to another DNS server, not to provide split-horizon resolution for the same domain. DNSSEC is for securing DNS responses against tampering, not for altering resolution based on client location or providing private IPs to internal clients.