Re: [Add] some background on split DNS with DNSSEC

[Bill Woodcock <[e-mail]>]

> On Nov 9, 2021, at 4:29 PM, Eliot Lear <[e-mail]> wrote:
> On 09.11.21 16:23, Bill Woodcock wrote:
>> If you’re operating a split view, there’s a degree of complexity involved in managing the separation after the split (or, more likely, you just have two different sources of authority, but it comes to the same thing).  If you’re DNSSEC signing, you’ve got a process for that, and you’re running zones through it.  Both are complex processes, but neither makes the other more complex than it would have been otherwise, that I can see...
> 
> But Bill, you have to decide in your mind if that complexity is additive or worse.  My own experience is worse because the tools integration is SOMETIMES lacking.  We can say that this is a point of differentiation for vendors, but I think any time we say that what we've just said is that it's a hard problem.

The split-view problem is in the doctor-it-hurts-when-I-do-this category.  The DNSSEC problem is in the “damn, I sure wish this were all a little simpler and more obvious/self-explanatory and the tools were a little better” category.  I don’t (intentionally, anyway) do the former.  I cope with the latter.  So I can’t personally say that it’s worse than additive, but my intuition said just additive.  Which isn’t a strong argument, obviously.

I think there’s a very good argument in favor of better tools and better education around DNSSEC.  I think the train has pretty well left the station in terms of redesigning it to be simpler.  But, anyway, I think there’s definitely room for improvement with DNSSEC.

I think split-horizon is conceptually simple, but just creates an inherently fragile situation, in which it’s easy to have unintended consequences.

While I’d like DNSSEC to be ubiquitous, and I recognize that split-horizon isn’t going away any time soon, I’m not sure that it’s worth putting effort into making that particular combination easier, when effort could be applied to making DNSSEC easier, and it would benefit both the people who are doing split horizon, and everyone else.

                                -Bill