Re: [dnsext] draft-diao-aip-dns

[Mark Andrews <[e-mail]>]

In message <[e-mail]>, Ralph Droms writes:
> 
> On Jun 19, 2012, at 3:36 AM 6/19/12, Stephane Bortzmeyer wrote:
> 
> > On Mon, Jun 18, 2012 at 05:50:16PM -0600,
> > Ralph Droms <[e-mail]> wrote 
> > a message of 56 lines which said:
> > 
> >> I also think that if you query example.com (with no .* suffix) in
> >> realm A, you may get a different answer than if you query
> >> example.com in realm B.
> > 
> > It is the exact same thing as the "search" directive in
> > resolv.conf. When I type "ping www" at home or at work (or "ping
> > www.lab" if you want an example with multiple labels), I ping a
> > different machine.
> 
> Hm.  I guess the similarity extends to the observation that a user can reconfigure to avoid the serach directive issue, and can rec
> onfigure to use an RDNSS in the desired "realm" (rather than, e.g., the RDNSS provided through DHCP) to avoid the side effects of d
> raft-diao-aip-dns.
> 
> - Ralph

Pinging www.example.net doesn't touch the search list normally
unless there is nothing at www.example.net.  It really *is* a
security issue to append search list elements to qualified names.

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]