Re: [dnsext] DNAME with exceptions - work-around found

[Brian Dickson <[e-mail]>]

On Mon, Sep 13, 2010 at 12:58 PM, Andrew Sullivan <[e-mail]> wrote:

> No hat.
>
> On Sun, Sep 12, 2010 at 07:24:20PM -0300, Brian Dickson wrote:
> > Set the DNAME TTL to 0.
>
> I don't believe that this WG is going to standardize anything that
> requires TTLs = 0.  It's particularly not the sort of advice we can
> offer operators of TLDs and so on.  Nifty hacks are fun to think
> about, but I don't think this is a proposal that is really going to go
> anywhere.
>
>
Actually, I concur.

I am using the properties needed in achieving the hack, to show that I
believe some work is probably needed, to avoid unpleasant choices by users
of the DNS, i.e. registrants.

It's traditional logic, "reduction to absurdity". If you start with a set of
axioms, and reach an absurd conclusion, it means one of those axioms is a
bad choice.

The axioms here were:
DNS protocol as is
Make multiple domains "the same"
Allow exceptions (to handle things which cannot be the same)
Make it scale (i.e. something other than brute force provisioning -> dname)

Registrants are likely to not have choice over the "allow exceptions", or
"Make multiple domains the same", as requirements imposed on them.

This suggests either provisioning-only as a solution, or a requirement to
make some sort of change to the existing DNS RFCs to improve things where
those requirements are taken as axiomatic.

Brian

P.S. I'm pretty sure that hierarchical SHADOW, without support for
exceptions, can work, based on the hackery I did.