[Add] Why so complex? (was Re: some background on split DNS with DNSSEC)

[Martin Thomson <[e-mail]>]

On Wed, Nov 10, 2021, at 01:58, Bill Woodcock wrote:
> My observation is exactly the same.  The problem isn’t so much that new 
> organizations will decide split-horizon is a good idea, as that old 
> organizations have grown very large while doing it, and have decades of 
> momentum.

My concern is not whether split DNS exists (it does) and whether it will continue to exist (it will), but what the security goals of our work in that area might be and how those might be achieved.

We know that under some conditions (to be determined), some clients (to be determined) might wish to use a particular DNS resolver (varying) for some - but not all - names.

We have already determined that this is not something that is exclusive to Enterprise, as much as the practice is widespread in that sort of setting.  We might also want to consider whether the goal is to use a network-provided resolver as opposed to a VPN-associated resolver or a company-policy mandated resolver.  The split-dns draft proposes that we address the network-provided case, but it proceeds on the basis that the policy that causes this proposal to be used is limited in terms of what is configured and then also very specific about the security posture the client adopts as a result of that.

The whole thing with checking a public resolver is all in aid of something about ensuring that the network resolver is authoritative in some way for the names that the PvD claims should point to it.  But this all assumes greater and greater trust in the PvD and - by extension - the network.  And I'm not even sure that it is operationally feasible.

If this were a company-mandated policy, why could that policy take the form of a resolver identity and a list of names for which that resolver is used over all others?  For simplicity, this could be just be a URL for a policy if updating is important or the number of things to configure is unwieldy.

The advantages of that approach are many. For example, when some software pings the internal host accidentally, that name doesn't leak if the host happens to be somewhere other than the office.

If this were a VPN, the same could be used.