Re: [Add] some background on split DNS with DNSSEC

[Bill Woodcock <[e-mail]>]

> On Nov 9, 2021, at 3:47 PM, Tommy Pauly <tpauly=[e-mail]> wrote:
> Having a specific zone / subdomain that’s used for non-public hosts is certainly a clean way to handle split-DNS cases. This allows for simple techniques like failing back to some internal resolver when you don’t have an a priori mapping of which names should use the internal resolver, and it makes cases where you have a trusted list of internal domains (like VPN) very simple.
> 
> Sadly the reality of so many deployments is that there isn’t a clean cut for “internal” or “private” names. Maybe we can hope that deployments that use dual-facing or dual-resolving hosts will eventually stop, but I don’t see that happening any time soon.

Heh, Tommy just saved me a bunch of typing.  :-)

My observation is exactly the same.  The problem isn’t so much that new organizations will decide split-horizon is a good idea, as that old organizations have grown very large while doing it, and have decades of momentum.

                                -Bill