Subject: Re: [Add] Fwd: New Version Notification for draft-reddy-add-enterprise-split-dns-00.txt

From: "Deen, Glenn (NBCUniversal)" <[email-masked]>
Date: Wed, 3 Mar 2021 19:33:32 +0000

On 3/3/21, 10:07 AM, "Add on behalf of Tim Wicinski" <[email-masked]<mailto:[email-masked]> on behalf of [email-masked]<mailto:[email-masked]>> wrote:

On Wed, Mar 3, 2021 at 10:30 AM Paul Wouters <[email-masked]<mailto:[email-masked]>> wrote:

Furhtermore, making assumptions on how people serve zones within the
enterprise seems a shaky basis for a protocol as well.

This right here what Mr Wouters says.

It's 2021 (I had to double check) and I strongly feel that most enterprises
operations have moved away from split-view DNS.

It maybe 2021 but this is still very much used by some enterprises and likely will be for quite a while.  It’s relatively easy to introduce a practice in enterprises, but it’s near impossible to take them away once the cyber security department has bought into it.

-glenn

---

From: Joe Abley <[email-masked]>
Date: Wed, 3 Mar 2021 14:41:31 -0500

> It maybe 2021 but this is still very much used by some enterprises and likely will be for quite a while.  It’s relatively easy to introduce a practice in enterprises, but it’s near impossible to ta…

For what it's worth, this matches my thinking, too.

In fact the phenomenon seems likely to be broader than that, since many home gateways instantiate their own namespace for the purposes of (e.g.) device configuration, and popular products in that space potentially represent a far broader set of sites than there are IT departments. The frequency with which queries with QNAME ~ /.belkin$/ land so frequently at root servers is perhaps informative, for example.

I would love to see some better data about this, though.

Joe

---

From: Victor Kuarsingh <[email-masked]>
Date: Wed, 3 Mar 2021 16:10:33 -0500

On Wed, Mar 3, 2021 at 2:33 PM Deen, Glenn (NBCUniversal) <
[email-masked]> wrote:

>
>
>
>
> On 3/3/21, 10:07 AM, "Add on behalf of Tim Wicinski" <[email-masked]
> on behalf of [email-masked]> wrote:
>
>
>
> On Wed, Mar 3, 2021 at 10:30 AM Paul Wouters <[email-masked]> wrote:
>
>
>
> It maybe 2021 but this is still very much used by some enterprises and
> likely will be for quite a while.  It’s relatively easy to introduce a
> practice in enterprises, but it’s near impossible to take them away once
> the cyber security department has bought into it.
>

My understanding is that there is a long tail of split DNS in the wild.
Many Enterprises I have come in contact with over the past few years seem
to have had it in place.  I think assuming that it is not a reality of
production would be an oversight.

Victor K

>
>
> -glenn
>
>
>
>
> --
> Add mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/add
>

---

From: Paul Vixie <[email-masked]>
Date: Thu, 4 Mar 2021 04:35:49 +0000

> production would be an oversight.

split-view DNS simplifies NAT and VPN, and is still very much in use, even
in a work-from-home pandemic economy. the ietf will never be asked to opine
as to whether any of this is a good idea or not.

-- 
Paul Vixie

---

From: Bill Woodcock <[email-masked]>
Date: Thu, 4 Mar 2021 09:22:13 +0100

> production would be an oversight.

That is very much my observation as well.

I predict that split-horizon DNS and NAT will somehow find a way to outlast the IP protocol itself.

                                -Bill