Re: [DNSOP] DNSSEC in local networks

[Mark Andrews <[e-mail]>]

In message <[e-mail]>, "Walter
 H." writes:
> On Mon, September 4, 2017 14:22, Mark Andrews wrote:
> >
> > In message <[e-mail]>,
> > "Walter H." writes:
> >> where there anyone who said: "don't use it", 15 years ago?
> >
> > Yes.  There were lots that discourage the use of .local, lan,
> > .corp etc.  Just becaue you didn't hear from them doesn't mean
> > they weren't out there.
> 
> a discourage is not a "don't use" :-)

We gave them fair warning that and domain they choose could be
allocated in the future.  We told them to the advice you have been
getting today.  Use a zone registered to them.  They, like you are
today, are ignoring the advice.

> >> > 'home.arpa' is in the process of being registered so that it
> >> > can be used safely in the environment it is designed to be used in.
> >>
> >> yes, but commonly for residental networks, not company/enterprise
> >> networks,
> >> they want/need something shorter like ".corp", ".lan", ".local", ...
> >
> > Want maybe, need absolutely not.
> question: why isn't this the answer of a car dealer?

Because the car dealer is trying to take as much money off you as
they can.  We on the other hand are trying to save you money by
stopping you and everyone else getting into situations that will
cost you/them thousands of dollars to rectify in the future.

> > Everyone was told to register the domain you want to use, there was
> > no exception for active directory.
> 
> not really, at those days only a few TLDs where possible, the many TLDs
> came some years later ...

People were wanting to deploy more TLDs from the moment the Internet
was opened up to the public.

> by the way: where is the problem with .home or .corp?
> I ask this, because at my hoster I pre-reserved my "local domain" - a
> .home, that I have used for many years several zears ago and nothing
> happened ...
> 
> > IPv6 would have been deployed a lot sooner. :-)
> 
> not really, my ISP is still IPv4 only ..., my IPv6 connectivity is a
> HE-tunnel ...
> and the brand new OS from Microsoft still has the bugs inside: TEREDO, ...
> which I had to deactivate first, before it is usable with IPv6 at all ...

If you didn't have the relief valve of RFC 1918 addresses then yes
IPv6 would have come a lot quicker and stuff like TEREDO wouldn't
exist.

> > Except such systems exist.  Go look at what a Mac does.  ping for
> > test.local and look and port 5353 traffic and compare it to port 53
> > traffic.
> 
> I know, this RFC was written by Apple;
> 
> no Apple no problem, I would say :-)
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]