Re: [dnsext] Some thoughts on the updated aliasing draft

[Douglas Otis <[e-mail]>]

On 3/26/11 10:51 AM, Ted Hardie wrote:
> The draft under discussion  was updated just before the meeting, and 
> it has some useful updates.  I think, however, it is anxious to scope 
> the problem in ways that leave out what I believe is a well-recognized 
> aspect of the basic desire of those who brought the work forward.  The 
> draft says:
>
>
>   To some extent, the desired behavior can be described: "identical DNS
>   resolution" means that the process of resolving two domain names will
>   end with the same result, in most cases the same IP address.  In the
>   history of DNS protocol development, there have been two attempts to
>   specify such "identical resolution" behavior:CNAME[RFC1034] which
>   maps or redirects itself, and DNAME[RFC2672] which maps or redirects
>   its descendants.  In the case of bundles or groups of names, however,
>   some operators have asserted they need identical DNS resolution at
>   all levels' domain names, including the domain name itself and its
>   descendants.
>
> But the reality is that the operators actually want the applications 
> to treat two domain names as the same.  That's a lot harder than 
> simply having the same IP returned when looking up an A record at each 
> one.  Especially in the case of secured zones, it involves issuing 
> multiple certificates or certs that cover both, and otherwise ensuring 
> that whatever services are present at that IP can effectively handle 
> either name. It's moderately obvious that this is a tougher job than 
> putting in a CNAME or DNAME.
DNAME does not offer a practical solution when implemented at the roots, 
since it lacks the meta information that would be needed to synchronize 
different zones.  It seems possible to use this scheme to construct the 
resources to convey which domains are replicated, such as as placing 
this under some label, like "xn--lba" or "._®--".

Any alias scheme will cause unwanted delays.  With two different 
encoding for A-labels, 2003 or 2008, dropping A-labels and using 
U-labels  reduces the number of domains to be replicated. See
http://tools.ietf.org/html/rfc6055

While it is clear A-labels are needed by e-mail applications, the 
wording about what is legal is less clear when aliased resources are 
employed.  Are A-labels really needed and would
http://tools.ietf.org/id/draft-vixie-dnsext-dnsshadow-00.txt
provide a means to register domain name-sets?

-Doug