Re: [Add] some background on split DNS with DNSSEC

[Michael Richardson <[e-mail]>]

Tommy Pauly <[e-mail]> wrote:
    > Having a specific zone / subdomain that’s used for non-public hosts is
    > certainly a clean way to handle split-DNS cases. This allows for simple
    > techniques like failing back to some internal resolver when you don’t
    > have an a priori mapping of which names should use the internal
    > resolver, and it makes cases where you have a trusted list of internal
    > domains (like VPN) very simple.

If the VPN has to be up to reach that internal resolver, then the act of
looking for the name brings up the VPN.  This is a major win over the case
where the VPN is down, and the user types in some internal name and is told
it does not exist.

    > Sadly the reality of so many deployments is that there isn’t a clean
    > cut for “internal” or “private” names. Maybe we can hope that
    > deployments that use dual-facing or dual-resolving hosts will
    > eventually stop, but I don’t see that happening any time soon.

CNAME can pave over may failures where a previously public (or privately
private) service can be moved.   This isn't possible if there are two views
of the same example.com.

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-