Re: [lamps] DNS DNAME pain.

Phillip Hallam-Baker <phill@hallambaker.com> Thu, 09 November 2017 18:46 UTC

MIME-Version: 1.0
Sender: hallam@gmail.com
In-Reply-To: <alpine.OSX.2.21.1711091315590.3847@ary.qy>
References: <CAMm+LwgMkSq7xVhVe_tYs7t46qmB9iVs92_SM3MOMeFCqWinbA@mail.gmail.com> <20171109162941.3670.qmail@ary.lan> <CAMm+LwhVPymZ3-3fmMY1onOFykfcVfy8rGxSPGB0FAddt2WTiQ@mail.gmail.com> <alpine.OSX.2.21.1711091150580.3682@ary.qy> <CAMm+Lwg4_0TS4b9DNV1K6OM7+26mYNCx9f2F=cMcQTJ8Ag7MsA@mail.gmail.com> <alpine.OSX.2.21.1711091315590.3847@ary.qy>
From: Phillip Hallam-Baker <phill@hallambaker.com>
Date: Thu, 09 Nov 2017 13:46:36 -0500
Message-ID: <CAMm+LwguSmESTieBYDYc4jDhD7S11W5ip1WsQtuLesDdZDg+Sw@mail.gmail.com>
To: John R Levine <johnl@taugh.com>
Cc: SPASM <spasm@ietf.org>
Content-Type: text/plain; charset="UTF-8"
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/VigT2cUaptQXrL9klxXjrH74tGA>
Subject: Re: [lamps] DNS DNAME pain.
Precedence: list

On Thu, Nov 9, 2017 at 1:18 PM, John R Levine <johnl@taugh.com> wrote:
>>> BNAME is going nowhere because it doesn't solve the problem it's supposed
>>> to
>>> solve, mapping variant names together.  If you want, say, a pair of
>>> traditional and simplified Chinese names to act the same, you have far
>>> more
>>> work provisioning web and mail servers than the DNS.
>>
>>
>> Like many other DNS proposals, the only way that can work is if the
>> services are getting their configuration data from the same source of
>> truth as the authoritative DNS server
>
>
> That helps, but the meaning of "the same" when applied to web servers is
> pretty vague.  If you have names in different character sets or different
> languages, should the web content match the character set or language of the
> name you use?  It's a swamp.

That is not what I am talking about.

I am talking about the source of truth for the machine configuration
being something like this [Note this is nothing to do with DNS configs
or aliases]

Global service file:

MyCompany Domain
    Canonical canonicalsite.com
    Alias: mysite.com
    Alias: xn--anothersite.com

I start a mail server container and tell it to register to service
MyCompany. It connects to the provisioning service

Host:
    "I support SMTP, POP3 and IMAP for MyCompany "
Provisioning to Host:
    "Your names are  canonicalsite.com, mysite.com, xn--anothersite.com"
    "Your priority is 10, you are 1 of 1 services"
Host:
    "Service is online and waiting"
Provisioning to DNS:
    <set of RRs for the config>
Provisioning to Host:
    "You are online"
Host:
    "CPU at 90%"

At this point the provisioning service can bring up another host to
service that domain.

The Web/mail/whatever service knows exactly what is being said on its
behalf and can react accordingly

In this model, DNS administration is strictly an output of the
provisioning service. It is not a thing in its own right. DNS records
can now be produced for whatever information clients might require
BEFORE they connect to the service.

This is the only model in which I see features like DANE or encryption
of the initial TLS negotiation being practical because it is the only
model in which the DNS information is likely to be useful.

Any system that relies on Bob to configure two separate systems
without inconsistency is broken. Bob will get them in sync the first
time at best. Then a change to the config will be made to one and not
the other.

[lamps] DNS DNAME pain. Phillip Hallam-Baker
Re: [lamps] DNS DNAME pain. John Levine
Re: [lamps] DNS DNAME pain. Phillip Hallam-Baker
Re: [lamps] DNS DNAME pain. John R Levine
Re: [lamps] DNS DNAME pain. Phillip Hallam-Baker
Re: [lamps] DNS DNAME pain. John R Levine
Re: [lamps] DNS DNAME pain. Phillip Hallam-Baker