Re: [DNSOP] DNSSEC in local networks

[Petr Špaček <[e-mail]>]

On 4.9.2017 11:50, Walter H. wrote:
>> Except you misses the entire point of getting a registered name,
>> that is to be able to use it safely without anyone trampling on its
>> use.
> 
> where there anyone who said: "don't use it", 15 years ago?
> 
>> 'home.arpa' is in the process of being registered so that it
>> can be used safely in the environment it is designed to be used in.
> 
> yes, but commonly for residental networks, not company/enterprise networks,
> they want/need something shorter like ".corp", ".lan", ".local", ...

I would like to comment on
'vendor told us and we followed his instructions'.
Maybe it is time to follow the new docs, e.g.:

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Networking_Guide/ch-Configure_Host_Names.html#sec-Recommended_Naming_Practices

Software and its docs have bugs which get fixed over time and there is
not way around it. Configuration has to follow the suit.


Please keep in mind that reserving a new name will not magically solve
the issue.

1. Existing systems will stay broken *unless* the reservation is for the
same string as used by particular network. Certainly this will not be
the case for all the broken installations.

In other words, some networks will stay non-complaint whatever dnsop
will do, which means that the broken networks will either get fixed over
time or stay broken. I do not see dnsop having real influence over this
aspect of network operation, sorry.


2. Also, reserving a random string does not solve problem of VPNs
between companies (customer using VPN to supplier's network, for
example), company mergers, etc.

If we reserved string 'example.', how it helped to solve the problem
when your company X needs to establish VPN tunnel to company Y internal
network to access its systems? How does it help if company X merges with
company Y?

Really, unique strings are the way to go.

Petr Špaček  @  CZ.NIC


> 
>> Yes, 'home.arpa' will be registered.  It's a different type of
>> registration to the one that is normally done by talking to your
>> friendly DNS registrar but it is a registration.
> 
> exact such a name but a TLD is needed for companies/enterprises in order
> to prevent new ones doing the mistakes of old ones ..., and having the
> safety not having a conflict in the future ...
> 
>> Names are not addresses.  They have different properties.
> 
> that is not the point,
> the point is, that in those days where these companies decided to use
> .local, .corp, ... such a paper prevented these decisions and now it could
> have been expanded with DNSSEC features ...
> 
> just guess what would have happened when there was no RFC1918; by the way,
> I would not have any problem changing my internal IPv4 addresses from e.g.
> 10.x.x.x to let's say 52.x.x.x - it is only a thought;
> 
> companies that use .local as their internal domain name and/or Active
> Directory have no problem as long as there is no system that insists on
> using mDNS for .local as specified in RFC6762