Let's say I have a web-server on my internal network which is behind a NAT router. I have my external DNS for the “xyz.com” domain configured with an A record for “foo” that points to my router's public address.

I want my internal network clients to resolve foo.xyz.com to the internal address.

However, this is the only xyz.com record that should point to an internal address.

Do I need to create a primary zone for xyz.com and mirror all the records from my external zone with the exception of “foo” (this is what I am doing now), or is there a better way?