[dnsop] some comments on draft-krishnaswamy-dnsop-dnssec-split-view-02

[Andrew Sullivan <[e-mail]>]

Colleagues,

In Dallas, I offered to review
draft-krishnaswamy-dnsop-dnssec-split-view.  I apologise to all of
you, and especially to the author, that I am as late as this in my
review; some other work interfered, but I do apologise that I should
have taken on a task that I then did not complete.  

In any case, I have read
draft-krishnaswamy-dnsop-dnssec-split-view-02.txt.  I have some
general comments.

Ed Lewis already observed that the document entails acceptance of
split-view DNS.  I know that several people have argued against that
in the past, but I think it is, at this stage, windmill-tilting to
try to suggest that split-view DNS is just a bad thing.  It's here,
at least for the forseeable future, and I think it is incumbent upon
an operations group to suggest how, if you're going to do something
distasteful, to do it correctly.  I think this document makes at
least a very good start at that.

I also applaud the author for what seems to me to be a careful and
well-thought-out discussion of the implications of DNSSEC in such an
environment.

I suspect, however, that the document needs to be broken into a pair,
because there are really two items here: how to do split-view DNS and
how to do it with DNSSEC.  It seems to me that one could support the
argument for the former without supporting the argument for the
latter (indeed, I can imagine purists holding their noses at the
first one, but saying that the second part is simply beyond the
pale).  I can think of practical reasons not to split them, though,
so if the author or others are strongly opposed to that, I won't
cleave too strongly to this position.

Irrespective of that, I think it would be very helpful to define
carefully the terms in section 4's sample rules (perhaps my addled
brain has missed these in one of the references, but I didn't spot
it).

I also think it would be terribly helpful to operators to have a
simple(ish) table with pros and cons of the various strategies listed
in section 3.  This is really just a summary of section 3, but I bet
it will be helpful to users.

In any case, I think that the document should be a WG item, even if
it is split in two.  If the WG consensus is that split-view DNS is
bad, evil, wrong, and Inquisition-worthy, then obviously the document
cannot become a WG item.  In that case, I urge the group to rethink
the position, because even if we don't like split views, they're a
reality.  We have an obligation, I think, to offer advice on the best
ways to do that which is possible.

Best regards,
A

-- 
----
Andrew Sullivan                         204-4141 Yonge Street
Afilias Canada                        Toronto, Ontario Canada
<[e-mail]>                              M2P 2A8
                                        [phone] x4110

.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html