IETF Logo Mail Archive

Re: [Add] some background on split DNS with DNSSEC

Eliot Lear <lear@lear.ch> Tue, 09 November 2021 15:50 UTC

Return-Path: <lear@lear.ch>
X-Original-To: add@ietfa.amsl.com
Delivered-To: add@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 68C513A0888 for <add@ietfa.amsl.com>; Tue, 9 Nov 2021 07:50:42 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.42
X-Spam-Level:
X-Spam-Status: No, score=-5.42 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, NICE_REPLY_A=-3.33, SPF_PASS=-0.001, T_SPF_HELO_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=lear.ch
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XCkzKkgJBVX2 for <add@ietfa.amsl.com>; Tue, 9 Nov 2021 07:50:37 -0800 (PST)
Received: from upstairs.ofcourseimright.com (upstairs.ofcourseimright.com [185.32.222.29]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D4C103A086E for <add@ietf.org>; Tue, 9 Nov 2021 07:50:36 -0800 (PST)
Received: from [192.168.0.132] (77-58-147-26.dclient.hispeed.ch [77.58.147.26]) (authenticated bits=0) by upstairs.ofcourseimright.com (8.15.2/8.15.2/Debian-18) with ESMTPSA id 1A9FoX4Z2065671 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NO); Tue, 9 Nov 2021 16:50:33 +0100
Authentication-Results: upstairs.ofcourseimright.com; dmarc=none (p=none dis=none) header.from=lear.ch
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=lear.ch; s=upstairs; t=1636473033; bh=Myyx0rz1hWmALNwHqQe9epmysB0++n+zX6jkRXqRmB8=; h=Date:Subject:To:Cc:References:From:In-Reply-To:From; b=THz9enrY9Eqonz/mRHLcH3VRYHhw4frsCg3ZB8oAORt+Cizm2+ndrIWiYggdWKjHu FxumNO6bMBNPFs6lXf9MxRNHqEwTnpBxMHV88Q+HuByWFg1cZFVSEZ0Fp2+Kp2UFPI kFw4k44/zPMacr1cioSkkWRLoQfQJBNQfXXAWb9E=
Message-ID: <47958af2-8da7-1c71-bb94-28e4067d54c2@lear.ch>
Date: Tue, 09 Nov 2021 16:50:32 +0100
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:91.0) Gecko/20100101 Thunderbird/91.3.0
Content-Language: en-US
To: Bill Woodcock <woody@pch.net>
Cc: add@ietf.org, Ted Lemon <mellon@fugue.com>
References: <yblk0hio8pu.fsf@w7.hardakers.net> <28611.1636465525@localhost> <3692CFBF-4D06-4960-9F7C-347A58D2D0A0@apple.com> <aea95242-4e80-e4cb-b5bb-da34105e7ed1@lear.ch> <CAPt1N1kGs851Q_BMq1NDzm80xHbrKLJWwt1JzAmZAtafXeoqPg@mail.gmail.com> <BF4069C2-225D-4BA6-97FC-5CB6B09DA657@pch.net> <b0527e86-9636-1d80-c2cf-526c6b050b90@lear.ch> <418D9CE4-6134-447A-A863-F028C325E4FF@pch.net> <b49bbf0f-dd8f-5592-de8e-96ffd87127bb@lear.ch> <8315C730-CFC2-4BBA-8909-1DD4AEC97352@pch.net>
From: Eliot Lear <lear@lear.ch>
In-Reply-To: <8315C730-CFC2-4BBA-8909-1DD4AEC97352@pch.net>
Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="------------7HNK2H5obdvTFl0NjNllJTKQ"
Archived-At: <https://mailarchive.ietf.org/arch/msg/add/zi7lM1Uk_bP7RHUKLeImMP3ULgo>
Subject: Re: [Add] some background on split DNS with DNSSEC
X-BeenThere: add@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Applications Doing DNS <add.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/add>, <mailto:add-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/add/>
List-Post: <mailto:add@ietf.org>
List-Help: <mailto:add-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/add>, <mailto:add-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 09 Nov 2021 15:50:42 -0000

I don't disagree with your description when you say:

On 09.11.21 16:39, Bill Woodcock wrote:
>
> I think split-horizon is conceptually simple, but just creates an inherently fragile situation, in which it’s easy to have unintended consequences.

The very same is true with DNSSEC, especially at large institutions that 
do SLB, services in the cloud, shared (forwarded) services, etc.  It 
just gets fragile.  And we keep thinking the tools are going to help; 
but it's 2021, and the tools have had time to mature.  And so to me this 
ALSO devolves to "Doctor, it hurts..."

But it requires some amount of imagination to sort this.

Eliot

v2.23.0 | Report a Bug | By Email