Re: [Add] [EXTERNAL] Re: add-enterprise-split-dns and split horizon DNS

[Joe Abley <[e-mail]>]

On Dec 8, 2021, at 08:31, Michael Richardson <[e-mail]> wrote:

> That's why it would be nice if the draft explained this and gave it a name.

You're saying "this" like it's one thing that is unambiguously achieved in a single way. It's not. 

> Yes, "corp.example.com" has an NS record in example.com which points to an IP
> address/DNS-server that does not answer queries if you aren't within the
> domain.

Making a public lame delegation to a private set of servers is one way to do this. 

Hosting an internal zone on servers that sit in the resolver graph for the desired set of clients is another. 

Forking the example.com zone into multiple namespaces served by different servers is another. There is more than one mechanism by which those servers receive particular queries. 

> I have seen it in use at multiple places over multiple decades.
> It works far better than having two authorities for the same name,
> particularly for entities that have multiple points of presence with VPNs
> connecting them.

"Authorities," "name" and "points of presence" are all ambiguous here. 

I point these things out just to illustrate that there are many ways to peel the covering fabric from these multiple rhetorical animals. Clear communication around these issues really needs some work towards a usefully-complete taxonomy. Without a clear description of the deployment scenarios to be covered it's really premature to claim any particular solution is complete. 

As a rule, the DNS in practice is messier than DNS in theory, and DNS in theory is already pretty messy. 

> {IPv6 makes this trivial, but it can also be done with less elegance using
> RFC1918, if the enterprise has no public IPv4 and can't hire any. }

The address family used to reach particular nameservers implicated in the above seems like the most superficial of details to me. 


Joe