Re: [dnsext] Autoconfiguration of variants

[Doug Barton <[e-mail]>]

On 3/8/2011 2:58 PM, George Barwood wrote:
> I have not yet properly understood the CLONE draft, for which I
> apologise, but it seems to suffer from some technical issues.

Questions and/or suggestions for clarification are welcome of course. I
tried to keep the explanation of the concept simple, but strike a
balance on explaining the protocol elements with sufficient detail to
make my meaning clear. I'm certain that improvement is possible in both
areas.

OTOH, I think one of the nice thing about the CLONE approach is that it 
*is* simple. Either in the sense that it is too simple-minded to work, 
or so simply elegant that it is confounding. :)

> How about this approach:
>
> (1) A new RRTYPE that defines the aliases for a given domain.
>
> www.mybigbank.com. VARIANTS www.my-big-bank.com. |
> www.my-bigbank.com. | www.mybig-bank.com.
>
> (2) An application ( say a web server ) that is configured to handle
> www.mybigbank.com will on initialisation check the DNS for variants,
> and if they are defined, will automatically configure them.

So far you have not described anything that cannot be accomplished with 
the CLONES RR I'm proposing.

> (3) Authoritative DNS servers when they see a VARIANTS record will
> auto-configure the appropriate copy zones. For DNSSEC this needs to
> be handled during zone signing.

This sounds sort of like Paul's SHADOW idea. I have expressed 2 
reservations about this concept in the past. First I would prefer that 
we not limit a possible solution to the zone level. Second, how do you 
handle DNSKEYs for the variant zones?

> (4) Possibly for concise expression, instead of a simple list of
> domain names, some limited pattern matching might be allowed in the
> RDATA of the VARIANTS record, e.g.
>
> www.mybigbank.com. VARIANTS www.my[-]big[-]bank.com.

Potentially dangerous, but interesting. :)

> (5) Resolvers do not need updating.

I think your idea is interesting, but perhaps we would both benefit from 
a more thorough critique of the CLONE idea. I think we're both talking 
about similar things.


Doug

-- 

	Nothin' ever doesn't change, but nothin' changes much.
			-- OK Go

	Breadth of IT experience, and depth of knowledge in the DNS.
	Yours for the right price.  :)  http://SupersetSolutions.com/