Re: [Add] add-enterprise-split-dns and split horizon DNS

On Thu, Dec 2, 2021 at 11:27 AM Michael Richardson <mcr+ietf@sandelman.ca>
wrote:

>
> I have just watched the ADD-20211108-1600 session from IETF112.
> I had a conflicting session.
>
> What I took from the conversation is that many people would like to solve
> DDR
> in a split-horizon situation, and that if we could find a solution that
> solved typo-squatting by local resolvers that would also be very welcome.
> (typo-squatting is of course trivially solved by DNSSEC, which I'm told
> browsers refuse to implement because miliseconds...)
>

I don't know who told you this, but that's not the reason that browsers do
not
implement DNSSEC. The primary reason that browsers do not implement DNSSEC
is
because of concerns that otherwise valid resolutions will fail due to
recursive
resolvers/middleboxes incorrectly handling DNSSEC records, thus resulting
in increased user-visible error rates.

-Ekr

> The document says:
>
>    A typical use case is an Enterprise network that requires one or more
>    DNS domains to be resolved via network-designated DNS servers.  This
>    can be a special domain, such as "corp.example.com" for an enterprise
>    that is publicly known to use "example.com".  In this case, the
>    endpoint needs to be informed what the private domain names are and
>    what the IP addresses of the network-designated DNS servers are.  An
>    Enterprise can also run a different version of its global domain on
>    its internal network.  In that case, the client is instructed to send
>    DNS queries for the enterprise public domain (e.g., "example.com") to
>    the network-designated DNS servers.  A configuration for this
>    deployment scenario is referred to as a Split DNS configuration.
>    Another use case for split-horizon DNS is Cellular and Fixed-access
>    networks (ISPs) typically offer private domains, including account
>    status/controls, and free education initiatives [INS].
>
> and I'd like to strongly distinguish the case of "corp.example.com"
> (I've also seen and used "intranet.example.com"...) from one where there
> are
> different "authoritative" views of example.com.
>
> In fact, I'd like the document to put these two into different sections.
> I think that we need to write a BCP that strongly encourages
> corp.example.com
> as the model for hiding names.
> Dan and Wesley mentioned previous efforts that had failed.
> I'd like to understand more about what was proposed and how/when/why they
> failed.
>
> Maybe the issues are different now and we could get consensys around
> something.
> Yeah, maybe that does not fit into the ADD charter: but it seems that ADD
> (DDR) might be a forcing function to finally do something here.
>
> I don't like the solution in this document.
> I am in favour of solving the problem though.
> I don't like PvD at all.
>
> But, the entire issue seems to fall into the "Doctor! Doctor! It hurts
> when I push
> this knife into the electrical socket! What can you prescribe to deal with
> the hurt?"
>
>
> --
> Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
>  -= IPv6 IoT consulting =-
>
>
>
> --
> Add mailing list
> Add@ietf.org
> https://www.ietf.org/mailman/listinfo/add
>