Re: [Add] add-enterprise-split-dns and split horizon DNS

[Michael Richardson <[e-mail]>]

Dan Wing <[e-mail]> wrote:
    > Split-horizon DNS has the same name on the inside ("private") network
    > as on the outside ("public"), but they resolve to different IP
    > addresses.  So, www.example.com on the inside resolving to, say,
    > 192.168.1.1 (an RFC1918 address to make it clear it is not Internet
    > routed) and www.example.com on the outside resolving to 1.1.1.9 (I
    > would have used 1.1.1.1, but, alas, that's used by a Real Server
    > now-a-days).  If there is an internal delegation where
    > "corp.example.com" is only resolvable from the inside that is not
    > "split DNS" -- at least, not by my definition.  Such an internal-only

Sure, I'd love to give it a clear name to distinguish it.
The document in question attempts to address both situations, however, and
that's the document that we are discussing adopting.

If the document wants to restrict itself to what you think of "real" split-DNS
then that might be easier to decide.

    > delegation is a far easier problem because if the wrong DNS server is
    > queried, it won't have any answer (ignoring data leakage issues of
    > querying the wrong DNS, of course).  Split DNS is complicated because
    > querying the wrong DNS returns the wrong answer and the wrong IP
    > address is either not routable from the Internet or gives the public
    > view of the resource when the "employee" view was desired.

Yeah. It totally sucks.  I think we should tell people to stop doing it.
I think that securing DNS lookups (whether by doing DNSSEC locally, or
speaking to a recursive DNSSEC validator securely), and providing privacy is
a sufficient hammer to get people to change.

    > I agree the proposal in our document may not be ideal.  During the
    > presentation and Q&A we discussed briefly another approach to test for
    > a squatted domain by using DNSSEC rather than querying a public DNS
    > server.  We intend to add that to the document, but, more importantly,
    > intend to compare/contrast the approaches.  I hope to get to those
    > edits with my co-authors before Christmas and back in front of the
    > working group.

Awesome.
Can you also give us a name/handle to talk about the corp.example.com
"private" delegation.   I wrote a document about this a few years ago.
I called them secret gardens, rather than walled gardens.
(I always wanted to read _Secret Gardens_ as a kid. I could never steal the
book from my sister though)



--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide