Re: [DNSOP] DNSSEC in local networks

[Mark Andrews <[e-mail]>]

In message <[e-mail]>, "Walter H." writes:
> > Except you misses the entire point of getting a registered name,
> > that is to be able to use it safely without anyone trampling on its
> > use.
> 
> where there anyone who said: "don't use it", 15 years ago?

Yes.  There were lots that discourage the use of .local, lan,
.corp etc.  Just becaue you didn't hear from them doesn't mean
they weren't out there.

> > 'home.arpa' is in the process of being registered so that it
> > can be used safely in the environment it is designed to be used in.
> 
> yes, but commonly for residental networks, not company/enterprise networks,
> they want/need something shorter like ".corp", ".lan", ".local", ...

Want maybe, need absolutely not.
 
> > Yes, 'home.arpa' will be registered.  It's a different type of
> > registration to the one that is normally done by talking to your
> > friendly DNS registrar but it is a registration.
> 
> exact such a name but a TLD is needed for companies/enterprises in order
> to prevent new ones doing the mistakes of old ones ..., and having the
> safety not having a conflict in the future ...
> 
> > Names are not addresses.  They have different properties.
> 
> that is not the point,
> the point is, that in those days where these companies decided to use
> .local, .corp, ... such a paper prevented these decisions and now it could
> have been expanded with DNSSEC features ...

Everyone was told to register the domain you want to use, there was
no exception for active directory.

> just guess what would have happened when there was no RFC1918; by the way,
> I would not have any problem changing my internal IPv4 addresses from e.g.
> 10.x.x.x to let's say 52.x.x.x - it is only a thought;

IPv6 would have been deployed a lot sooner. :-)
 
> companies that use .local as their internal domain name and/or Active
> Directory have no problem as long as there is no system that insists on
> using mDNS for .local as specified in RFC6762

Except such systems exist.  Go look at what a Mac does.  ping for
test.local and look and port 5353 traffic and compare it to port 53
traffic.

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]