Re: [Add] I-D Action: draft-reddy-add-enterprise-split-dns-08.txt

[Paul Wouters <[e-mail]>]

On Fri, 21 Jan 2022, tirumal reddy wrote:

> We published -08 version of Split-Horizon DNS Configuration draft
> https://datatracker.ietf.org/doc/html/draft-reddy-add-enterprise-split-dns-08
> based on WG feedback from IETF 112.
> 
> Key changes are:
> 
>    *  Restricted the scope of the document to split-horizon DNS names that are properly rooted in the global DNS.
>    *  Added new terminology of hybrid resolver/client, authorised split horizon and domain camping
>    *  Added DNSSEC to confirm authority over the split-horizon domains

I am not sure if reducing the scope of split-dns is the way forward. A
lot of split DNS is specifically for internal only domains, so I feel
this document is now going to be very confusing for offering a split-dns
solution without actually offering a split-dns solution.

I had never heard of "domain camping" before, and I wonder what is wrong
with "domain hijacking " and "NXDOMAIN hijacking" as terms ?

If DNSSEC is required for split-dns, then it is also very conceivable
that DNSSEC is used for the internal domains. For IKEv2 split-dns we
offered the option to signal DS/DNSKEY's for the internal view. I don't
think any of the add related drafts offers this option? If I missed it,
please let me know how a client that decides to pick "example.com"
resolving via the internal view of the split, can obtain the required
DS/DNSKEY's of those internal zones ?

Paul