Re: [Add] some background on split DNS with DNSSEC

[Ted Lemon <[e-mail]>]

It might indeed be nice to consider a way to make DNSSEC work that
acknowledges the existence of a shared public/private namespace. But it
would have to be easier to operate than just operating two namespaces that
both validate from the same delegation, which is what we can do today.

On Tue, Nov 9, 2021 at 10:10 AM Eliot Lear <[e-mail]> wrote:

> Or... maybe it's time for a new trust model with regard to name
> ownership, to account for reality on the ground.  This might also permit
> us to admit that DNSSEC itself has serious deployment problems.
>
> On 09.11.21 15:47, Tommy Pauly wrote:
> >
> >> On Nov 9, 2021, at 5:45 AM, Michael Richardson <[e-mail]>
> wrote:
> >>
> >>
> >> Wes Hardaker <[e-mail]> wrote:
> >>
> >>> A past draft was written about how to handle split DNS within DNSSEC.
> >>>
> https://datatracker.ietf.org/doc/html/draft-krishnaswamy-dnsop-dnssec-split-view
> >>> This may be useful information for the
> >>> draft-reddy-add-enterprise-split-dns draft
> >> Yes, I agree that it's useful.
> >> I continue to suggest that split-view is silly (and I sold devices that
> >> promoted this in the mid-1990s)
> >>
> >> A private delegation of "internal.example.com" works much better,
> >> particularly in the modern world of IPv6, VPNs, and Remote Access.
> > Having a specific zone / subdomain that’s used for non-public hosts is
> certainly a clean way to handle split-DNS cases. This allows for simple
> techniques like failing back to some internal resolver when you don’t have
> an a priori mapping of which names should use the internal resolver, and it
> makes cases where you have a trusted list of internal domains (like VPN)
> very simple.
> >
> > Sadly the reality of so many deployments is that there isn’t a clean cut
> for “internal” or “private” names. Maybe we can hope that deployments that
> use dual-facing or dual-resolving hosts will eventually stop, but I don’t
> see that happening any time soon.
> >
> >>> Also of interest is what problems exist with doing private name spaces
> >>> and how hard this problem is and why DNSOP has never managed to publish
> >>> something about it:
> >>> https://www.rfc-editor.org/rfc/rfc8244.html
> >>> And if you back search DNSOP mailing list, this has a huge history
> >>> behind it.
> >> yup.
> >> I wrote:
> >>
> https://datatracker.ietf.org/doc/draft-richardson-homenet-secret-gardens/
> a
> >> long time ago, but never pursued it because Provider Domains was too far
> >> along.
> >>
> >> --
> >> Michael Richardson <[e-mail]>   . o O ( IPv6 IøT
> consulting )
> >>            Sandelman Software Works Inc, Ottawa and Worldwide
> >> --
> >> Add mailing list
> >> [e-mail]
> >> https://www.ietf.org/mailman/listinfo/add
> --
> Add mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/add
>