Re: [Add] add-enterprise-split-dns and split horizon DNS

[Paul Wouters <[e-mail]>]

On Dec 2, 2021, at 20:46, Dan Wing <[e-mail]> wrote:
> 
> Split-horizon DNS has the same name on the inside ("private") network as on the outside ("public"), but they resolve to different IP addresses.  

That is one form of split dns. Split simply means there is more than one view that is different.

>  If there is an internal delegation where "corp.example.com" is only resolvable from the inside that is not "split DNS" -- at least, not by my definition.

You seem to be trying to redefine the definition then.

> Such an internal-only delegation is a far easier problem because if the wrong DNS server is queried, it won't have any answer (ignoring data leakage issues of querying the wrong DNS, of course).

That it won’t resolve to anything won’t make the problem easier.

>  Split DNS is complicated because querying the wrong DNS returns the wrong answer and the wrong IP address is either not routable from the Internet or gives the public view of the resource when the "employee" view was desired.

I really would not use this definition of split dns. It will lead to confusion and solutions offered would be incomplete and not cover the actual issues this WG is trying to address.

> I agree the proposal in our document may not be ideal.  During the presentation and Q&A we discussed briefly another approach to test for a squatted domain by using DNSSEC rather than querying a public DNS server.

I don’t think typo squatting is a problem in scope for recursive resolver selection for specific domain names.

The problem remains how to securely receive, validate and authorize a list of domain names that should be resolved via the local network advertised nameserver.

The solution seems to steer towards “putting things in public dns”, which I do not think is the right solution. Defining “internal only domains” as “not split dns” is not a workable solution for this.


Paul