[Add] add-enterprise-split-dns and split horizon DNS

[Michael Richardson <[e-mail]>]

I have just watched the ADD-20211108-1600 session from IETF112.
I had a conflicting session.

What I took from the conversation is that many people would like to solve DDR
in a split-horizon situation, and that if we could find a solution that
solved typo-squatting by local resolvers that would also be very welcome.
(typo-squatting is of course trivially solved by DNSSEC, which I'm told
browsers refuse to implement because miliseconds...)

The document says:

   A typical use case is an Enterprise network that requires one or more
   DNS domains to be resolved via network-designated DNS servers.  This
   can be a special domain, such as "corp.example.com" for an enterprise
   that is publicly known to use "example.com".  In this case, the
   endpoint needs to be informed what the private domain names are and
   what the IP addresses of the network-designated DNS servers are.  An
   Enterprise can also run a different version of its global domain on
   its internal network.  In that case, the client is instructed to send
   DNS queries for the enterprise public domain (e.g., "example.com") to
   the network-designated DNS servers.  A configuration for this
   deployment scenario is referred to as a Split DNS configuration.
   Another use case for split-horizon DNS is Cellular and Fixed-access
   networks (ISPs) typically offer private domains, including account
   status/controls, and free education initiatives [INS].

and I'd like to strongly distinguish the case of "corp.example.com"
(I've also seen and used "intranet.example.com"...) from one where there are
different "authoritative" views of example.com.

In fact, I'd like the document to put these two into different sections.
I think that we need to write a BCP that strongly encourages corp.example.com
as the model for hiding names.
Dan and Wesley mentioned previous efforts that had failed.
I'd like to understand more about what was proposed and how/when/why they
failed.

Maybe the issues are different now and we could get consensys around something.
Yeah, maybe that does not fit into the ADD charter: but it seems that ADD
(DDR) might be a forcing function to finally do something here.

I don't like the solution in this document.
I am in favour of solving the problem though.
I don't like PvD at all.

But, the entire issue seems to fall into the "Doctor! Doctor! It hurts when I push
this knife into the electrical socket! What can you prescribe to deal with
the hurt?"


--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-