Subject: [DNSOP] Terminology question: split DNS

From: "Paul Hoffman" <[email-masked]>
Date: Mon, 19 Mar 2018 17:47:32 +0000

Some folks had reservations about the current definition of "split DNS":
    "Where a corporate network serves up partly or completely different 
DNS inside and outside
    its firewall. There are many possible variants on this; the basic 
point is that the
    correspondence between a given FQDN (fully qualified domain name) 
and a given IPv4 address
    is no longer universal and stable over long periods."
    (Quoted from <xref target="RFC2775"/>, Section 3.8)

What would the WG like for this definition?

--Paul Hoffman

---

From: Paul Vixie <[email-masked]>
Date: Mon, 19 Mar 2018 10:54:48 -0700

Paul Hoffman wrote:
> Some folks had reservations about the current definition of "split
> DNS": "Where a corporate network serves up partly or completely
> different DNS inside and outside its firewall. There are many
> possible variants on this; the basic point is that the correspondence
> between a given FQDN (fully qualified domain name) and a given IPv4
> address is no longer universal and stable over long periods." (Quoted
> from <xref target="RFC2775"/>, Section 3.8)
>

my only qualm is that A and AAAA RR's are not the only things that are 
usually not the same when DNS is split in this way. MX, NS, SRV, and 
likely a dozen others, and DNSSEC signatures and keys, can also differ.

it should be called split-horizon DNS not split-DNS, to highlight the 
fact that it's the same zone name in an entirely separate DNS namespace.

-- 
P Vixie

---

From: Ted Lemon <[email-masked]>
Date: Mon, 19 Mar 2018 17:58:08 +0000

On Mar 19, 2018, at 5:47 PM, Paul Hoffman <[email-masked]> wrote:
>   "Where a corporate network serves up partly or completely different DNS inside and outside
>   its firewall. There are many possible variants on this; the basic point is that the
>   correspondence between a given FQDN (fully qualified domain name) and a given IPv4 address

Yeah, that's a bit iffy.   Homenet is another example of the same thing.   I would make it more generic, something like this:

  Where DNS servers that are authoritative for a particular set of domains
  provide partly or completely different answers in those domains depending
  on the source of the query.   The effect of this is that a domain name that
  is notionally globally unique nevertheless has different meanings for
  different network users.

This is probably not exactly right, but it gets rid of several problems with the old text.   I think the reference to "corporate" is bogus, and the reference to "IPv4" is also bogus, and also incomplete, since split horizon can affect any record, not just address records.

It could be usefully clarified by adding something along the lines of, "for example, RFC2775 mentions ..." and then include some or all of the old text.

---

From: Jim Reid <[email-masked]>
Date: Mon, 19 Mar 2018 17:58:48 +0000

> On 19 Mar 2018, at 17:47, Paul Hoffman <[email-masked]> wrote:
> 

The quoted definition seems wrong: the binding of a name to address isn't necessarily unstable in split DNS setups. And that's not the only game in town either: for instance MX and NS records.

How about the following:

Where a corporate network serves up partly or completely different DNS data inside and outside its network. There are many possible variants on this; the basic point is that the
correspondence between a given QNAME/QTYPE/CLASS tuple and the data for that tuple is no longer universal and can depend on where the query is made from or which DNS server(s) are queried.

---

From: Artyom Gavrichenkov <[email-masked]>
Date: Mon, 19 Mar 2018 18:00:54 +0000

On Mon, Mar 19, 2018 at 5:47 PM, Paul Hoffman <[email-masked]> wrote:
> [..] the basic point is that the
>    correspondence between a given FQDN (fully qualified domain name) and a
>    given IPv4 address is no longer universal and stable over long periods."

IP v. being whatever, 4 or 6, there's a bunch of reasons there's
virtually no correspondence between a given FQDN and a given IP
address nowadays. E.g. CDNs.

| Artyom Gavrichenkov
| gpg: 2deb 97b1 0a3c 151d b67f 1ee5 00e7 94bc 4d08 9191
| mailto: [email-masked]
| fb: ximaera
| telegram: xima_era
| skype: xima_era
| tel. no: +7 916 515 49 58

---

From: Bob Harold <[email-masked]>
Date: Mon, 19 Mar 2018 14:05:45 -0400

> address nowadays. E.g. CDNs.
I think the key part is:
   "different answers depending on the source of the query."

In practice this is done by using either different DNS servers (or
processes), or multiple "views" in a DNS configuration.
(Is "view" in BIND called something else in other software?)

-- 
Bob Harold

---

From: Artyom Gavrichenkov <[email-masked]>
Date: Mon, 19 Mar 2018 18:09:54 +0000

> processes), or multiple "views" in a DNS configuration.

Another issue here is that, for some enterprises at least, there's no
single "internal network" anymore. There are different network scopes
(_sometimes_ nested) ranging from "formally internal but treated as
almost external" to "air gap-separated DMZ", with different policies,
including different DNS policies.

My second thought (personally) is that there might be a reason to just
bury the "split DNS" definition whatsoever and to just define a
"multi-horizon DNS", where a "horizon" is defined by a company's
policy and _usually_ depends on the source IP address of a query
(there may be exceptions).

| Artyom Gavrichenkov

---

From: George Michaelson <[email-masked]>
Date: Mon, 19 Mar 2018 18:10:15 +0000

"A DNS resolver which looks at the client requesting address, and uses
this to serve different versions of information about a zone based on
which client address or prefix requests it."

the concept of "side" is rather limited. split DNS can encompass more
than two sides can't it?

-George

On Mon, Mar 19, 2018 at 5:47 PM, Paul Hoffman <[email-masked]> wrote:
> given IPv4 address
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop

---

From: Artyom Gavrichenkov <[email-masked]>
Date: Mon, 19 Mar 2018 18:13:02 +0000

...yeah, a simple example of such an exception is an anycast DNS
network which doesn't even look at the source IP address, but just has
completely different zones deployed in different points of presence.
When a PoP goes down, the same IP address will be directed to another
PoP and will start receiving data from a different "horizon" (there
might be a better metaphor for this concept).

| Artyom Gavrichenkov

---

From: Paul Vixie <[email-masked]>
Date: Mon, 19 Mar 2018 11:14:05 -0700

> (Is "view" in BIND called something else in other software?)

bob halley and i put "views" into the BIND9 architecture because 
previously, people were running separate BIND8 server instances on 
different computers or on different listener-IP addresses, and we wanted 
to make this easier.

i suggest not mentioning views, because the concept predates them.

-- 
P Vixie

---

From: Jim Reid <[email-masked]>
Date: Mon, 19 Mar 2018 18:14:39 +0000

> On 19 Mar 2018, at 18:09, Artyom Gavrichenkov <[email-masked]> wrote:
> 
> single "internal network" anymore.

We don't need to enumerate every potential split DNS scenario (or how it's implemented). The original text says "there are many potential variants". That should be enough for this document. The simple example of one internal and one external net will do for illustrative purposes.

---

From: Ted Lemon <[email-masked]>
Date: Mon, 19 Mar 2018 18:24:25 +0000

> "A DNS resolver which looks at the client requesting address, and uses

That's a different thing.  There's a distinction between a resolver that gives different answers, and a set of authoritative servers that give different answers.   I believe split horizon is referring to the latter, not the former.

---

From: Robert Edmonds <[email-masked]>
Date: Mon, 19 Mar 2018 14:26:49 -0400

> address nowadays. E.g. CDNs.

There are many reasons that globally inconsistent DNS RRsets exist, e.g.
load balancers, CDNs, split [horizon] DNS, etc. I think split horizon is
a specific type of global inconsistency that doesn't necessarily
encompass the other types.

-- 
Robert Edmonds

---

From: Paul Vixie <[email-masked]>
Date: Mon, 19 Mar 2018 11:33:12 -0700

Ted Lemon wrote:
> On Mar 19, 2018, at 6:10 PM, George Michaelson <[email-masked]
> <mailto:[email-masked]>> wrote:
> That's a different thing. There's a distinction between a resolver that
> gives different answers, and a set of authoritative servers that give
> different answers. I believe split horizon is referring to the latter,
> not the former.

i've done both and referred to both as "split-horizon dns".

bind9 views does both.

-- 
P Vixie

---

From: George Michaelson <[email-masked]>
Date: Mon, 19 Mar 2018 18:37:24 +0000

The quality to me, which was there in abstract, is a port-53 bound
daemon, which uses the client IP network or /32 to specify how it
answers.

Server, Resolver, these are distinct classes. I felt split-horizon was
the moment of decision logic from "who asked"

If anyone has actually bound it to "which interface did I get the
question on" thats subtly different, and more side-like.

-G

---

From: "Darcy Kevin (FCA)" <[email-masked]>
Date: Mon, 19 Mar 2018 19:26:42 +0000

The trouble with "split horizon" is that it is a term of inter-network routing of much older and more-established provenance, and thus to use it for DNS can be viewed as a usurpation, and ultimately, confusing. (I know Cricket had the same observation, circa 2000).

I occasionally use "schizophrenic DNS" when I want to disparage the practice, but I realize that is both a) inaccurate, from a clinical standpoint, and b) politically incorrect, in some circles.

How about just "disjoint DNS" or "non-synchronized DNS"? Or, to hijack the Perl motto, TMTOWTRI (There's More Than One Way To Resolve It :-)

														- Kevin

-----Original Message-----
From: DNSOP [mailto:[email-masked]] On Behalf Of Paul Vixie
Sent: Monday, March 19, 2018 1:55 PM
To: Paul Hoffman <[email-masked]>
Cc: dnsop <[email-masked]>
Subject: Re: [DNSOP] Terminology question: split DNS

Paul Hoffman wrote:
> different DNS inside and outside its firewall. There are many possible 
> variants on this; the basic point is that the correspondence between a 
> given FQDN (fully qualified domain name) and a given IPv4 address is 
> no longer universal and stable over long periods." (Quoted from <xref 
> target="RFC2775"/>, Section 3.8)
>

my only qualm is that A and AAAA RR's are not the only things that are usually not the same when DNS is split in this way. MX, NS, SRV, and likely a dozen others, and DNSSEC signatures and keys, can also differ.

it should be called split-horizon DNS not split-DNS, to highlight the fact that it's the same zone name in an entirely separate DNS namespace.

--
P Vixie

---

From: John Kristoff <[email-masked]>
Date: Mon, 19 Mar 2018 14:54:32 -0500

On Mon, 19 Mar 2018 19:26:42 +0000
"Darcy Kevin (FCA)" <[email-masked]> wrote:

> How about just "disjoint DNS" or "non-synchronized DNS"? Or, to
> hijack the Perl motto, TMTOWTRI (There's More Than One Way To Resolve
> It :-)

Coming up with new names though is less than ideal.  The Microsoft
community has used split-brain, which might be an option, but might
not get a lot of support from this community (including me). RFC 7719
seems to prefer the term "view" for better or worse.  I kind like that.
Paul's comment doesn't convince me it shouldn't be apportioned for this.

John

---

From: John Heidemann <[email-masked]>
Date: Mon, 19 Mar 2018 13:56:36 -0700

>i've done both and referred to both as "split-horizon dns".

+1 on "split-horizon dns" as the term, over "split dns" and some other
neologism, on the basis of running code and existing documentation and
existing wide use.

As another demonstration of wide use of this term, see
https://en.wikipedia.org/wiki/Split-horizon_DNS

It is not, to me, too great an overlap with split-horizon routing.

   -John Heidemann

---

From: Paul Wouters <[email-masked]>
Date: Mon, 19 Mar 2018 17:14:46 -0400 (EDT)

> neologism, on the basis of running code and existing documentation and

I and google disagree:

"split dns":  72900 hits
"split horizon dns": 5640 hits

If the document is about explaining terminology, it must explain "split
dns" and can say another term for it is "split horizon dns", but not the
other way around.

I personally don't hear (or use) "split horizon dns"

Paul

---

From: Michael Sinatra <[email-masked]>
Date: Mon, 19 Mar 2018 14:24:01 -0700

> We don't need to enumerate every potential split DNS scenario (or how it's implemented). The original text says "there are many potential variants". That should be enough for this document. The sim…

Rather than try for some physical demarcation like "firewall" or 
"network," why don't we simply say "organizationally-defined perimeter" 
or "perimeter defined by the organization," which leaves it vague enough 
to support the "many potential variants"?

E.g. in Paul H.'s original text

Instead of: "Where a corporate network serves up partly or completely 
different DNS inside and outside its firewall."

Use: "Where a corporate [enterprise?] network serves partly or 
completely different DNS based on a client's location inside or outside 
of a perimeter defined by that organization."

This also gives the enterprise organization both the authority (and 
onus) to define its perimeter in a reasonable logical way.

michael

---

From: Steve Crocker <[email-masked]>
Date: Mon, 19 Mar 2018 17:30:55 -0400

I haven't been following the current thread but I have encountered this
topic before and I have thought about the implications for DNSSEC.

The terminology of "split DNS" -- and equivalently "split horizon DNS" --
is, in my opinion, a bit limited.  It's not too hard to imagine further
carve outs.  For me, the general case is at every point in the network,
there is an external world and an internal world.  Let's say I am in charge
of the systems that support a department within a division of a very large
company.  I could imagine a department DNS that resolves names within the
department but forwards other queries to the division DNS resolvers.  They
resolve names within the division and forward other queries to the
company's resolvers.  The company's resolvers handle queries for names
defined by the company and forward other queries to the outside.

If we're going to tackle this problem, let's do it cleanly and completely.

Steve

---

From: Paul Vixie <[email-masked]>
Date: Mon, 19 Mar 2018 15:08:26 -0700

Steve Crocker wrote:
> The terminology of "split DNS" -- and equivalently "split horizon DNS"
> -- is, in my opinion, a bit limited.  It's not too hard to imagine
> further carve outs.  For me, the general case is at every point in the
> network, there is an external world and an internal world.  ...

i think two things. probably more, but two that occur upon the above.

first, that general case is not described in detail in the documentation 
of the Internet System. a brief overview is given in RFC 1918 (BCP 5), 
in the last paragraph of section 5, but more is needed.

second, more specific cases exist, where configuration cognizance is 
given to *several* external worlds AND *several* internal worlds. 
bind9's "view" feature accounts for this, but the resulting capabilities 
are very hard to describe in a general way.

see also: <http://family.redbarn.org/~vixie/proxynet.pdf>.

-- 
P Vixie

---

From: Dick Franks <[email-masked]>
Date: Mon, 19 Mar 2018 23:28:44 +0000

On 19 March 2018 at 21:30, Steve Crocker <[email-masked]> wrote:

> department but forwards other queries to the division DNS resolvers.
>

The simple distinction between "internal" and "external" does not begin to
describe the situation on the ground in the multi-national company that
used to employ me.

The only real "external" is the global internet.

Obviously, the local network, at subsidiary company, or in some cases
departmental level, is unambiguously "internal"

The operating subsidiaries were connected to a (corporate) national
network, and thence the international and global networks.

The DNS naming regime represented all these levels, including specifically,
a "view" of a subsidiary's (locally) maintained namespace visible from
other parts of the organisation.

The key ingredient that need to be captured in the description, is that
these are multiple "views" of a single database.  The view is a corporate
policy animal, and usually changes at a much lower rate than routine DNS
database maintenance.  This is a different proposition from selective
forwarding.

  They resolve names within the division and forward other queries to the
> defined by the company and forward other queries to the outside.

To make this manageable, the corporate nameservers also need to delegate
parts of the namespace to the operating subsidiaries.

The concept of "horizon" seems (at least to me) to imply some limit beyond
which there is no visibility.

IMHO, the neutral concept of "view" describes the situation well enough to
be useful.

---

From: Evan Hunt <[email-masked]>
Date: Tue, 20 Mar 2018 08:15:01 +0000

On Mon, Mar 19, 2018 at 05:58:08PM +0000, Ted Lemon wrote:
> Yeah, that's a bit iffy.   Homenet is another example of the same thing.
> I would make it more generic, something like this:
> 

This might be a little *too* generic: it appears to cover things like
geographically tailored responses and EDNS Client-Subnet, as well as
the internal and external views that are more typically what
"split[-horizon] DNS" refers to.

At a technical level there may not be much difference, but I've always
thought of "split DNS" as being specific to the boundary point between an
organizational intranet and the global internet. It's my impression that
historically most people who've used the term meant it in that sense, and
it might be confusing to broaden the definition retroactively.

I do think the text above is useful, though. I would suggest that, as there
are now several situations in which DNS responses may differ depending on
the client, would could define a generic term for that ("multi-horizon DNS"
or similar?), and then define "split DNS" as a specific case in which the
answer depends on whether the originating client is inside or outside of a
network controlled by the server's operator.

-- 
Evan Hunt -- [email-masked]
Internet Systems Consortium, Inc.

---

From: Ted Lemon <[email-masked]>
Date: Tue, 20 Mar 2018 09:04:45 +0000

Yes, split horizon is the original term, which has experienced linguistic
drift and is now just split DNS.

I think there is a useful distinction to be made between the various
different ways that global names may have different meanings in different
contexts.

RFC 2826 talks about this a bit, and RFC 8244 comments further in section
4.1.1. Neither document attempts to enumerate the use cases, however.

I think that split DNS is a specific use case, and does not encompass the
whole phenomenon. If we want to talk about the whole phenomenon, this may
not be the place to do it—I don't actually know of a term for the general
idea. But I'm pretty sure that "split DNS" is not that term.

---

From: Andrew Sullivan <[email-masked]>
Date: Tue, 20 Mar 2018 09:51:26 -0400

>   is notionally globally unique nevertheless has different meanings for

I mostly like that, but I quibble with "source of the query".  It's
really "depending on some factor apart from the name, class, and type
of the query.  For instance, the answers might differ according to the
source of the query."  EDNS client subnet is another example, but I've
also seen things based on authentication (SIG(0) or TSIG).
Effectively, every "DNS tricks" service on the public Internet is also
a kind of split horizon.

I think we should include all of "split DNS", "split horizon", and
"split brain": they're all terms I've heard and so we ought to make
sure they're both included.

A

-- 
Andrew Sullivan
[email-masked]

---

From: Ted Lemon <[email-masked]>
Date: Tue, 20 Mar 2018 13:57:04 +0000

I think split horizon is really specific to source address, but I agree
with your clarification as it applies to views. Also agree that we should
mention all variants.

---

From: Matt Larson <[email-masked]>
Date: Tue, 20 Mar 2018 11:05:13 -0400

> On Mar 19, 2018, at 3:26 PM, Darcy Kevin (FCA) <[email-masked]> wrote:
> 

+1 to "split DNS", which has always been the term I've used and heard. I completely agree that "split horizon" muddies the water by referring to a routing concept that probably pre-dates widespread use of split DNS.

Matt

---

From: Ted Lemon <[email-masked]>
Date: Tue, 20 Mar 2018 15:10:26 +0000

> +1 to "split DNS", which has always been the term I've used and heard. I completely agree that "split horizon" muddies the water by referring to a routing concept that probably pre-dates widespread…

The term "split horizon" was common at one time, and I think we need to say what it means in this context.   I think it makes sense to point out that it is not the currently preferred term, and that people shouldn't use it anymore, but it's useful to clue people in as to what it means.

---

From: "Darcy Kevin (FCA)" <[email-masked]>
Date: Tue, 20 Mar 2018 16:07:10 +0000

The whole phenomenon is what I would call “context-sensitive resolution” (although we don’t like neologisms, so I’m not proposing that). Context-sensitive resolution encompasses “split DNS”, “views”, policy-based resolution (blacklists, etc.), GSLB algorithms, geolocation, even plain old round-robin. The abstract, overarching concept is for the resolver to make a decision on how to answer a particular query, based on one or more attributes of the query transaction, including the “existential” attribute of what resolver was asked the question in the first place (aka “splitting”).

                                                                                                                                                                                                                        - Kevin

From: DNSOP [mailto:[email-masked]] On Behalf Of Ted Lemon
Sent: Tuesday, March 20, 2018 5:05 AM
To: Paul Wouters <[email-masked]>
Cc: dnsop WG <[email-masked]>
Subject: Re: [DNSOP] Terminology question: split DNS

Yes, split horizon is the original term, which has experienced linguistic drift and is now just split DNS.

I think there is a useful distinction to be made between the various different ways that global names may have different meanings in different contexts.

RFC 2826 talks about this a bit, and RFC 8244 comments further in section 4.1.1. Neither document attempts to enumerate the use cases, however.

I think that split DNS is a specific use case, and does not encompass the whole phenomenon. If we want to talk about the whole phenomenon, this may not be the place to do it—I don't actually know of a term for the general idea.. But I'm pretty sure that "split DNS" is not that term.

On Mar 19, 2018 21:15, "Paul Wouters" <[email-masked]<mailto:[email-masked]>> wrote:
On Mon, 19 Mar 2018, John Heidemann wrote:
+1 on "split-horizon dns" as the term, over "split dns" and some other
neologism, on the basis of running code and existing documentation and
existing wide use.

I and google disagree:

"split dns":  72900 hits

Paul

_______________________________________________
DNSOP mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/dnsop

---

From: Matthew Pounsett <[email-masked]>
Date: Tue, 20 Mar 2018 21:44:37 -0400

On 19 March 2018 at 17:24, Michael Sinatra <[email-masked]> wrote:

> "network," why don't we simply say "organizationally-defined perimeter" or
> "perimeter defined by the organization," which leaves it vague enough to
> support the "many potential variants"?
>
> Use: "Where a corporate [enterprise?] network serves partly or completely
> different DNS based on a client's location inside or outside of a perimeter
> defined by that organization."
>
> This also gives the enterprise organization both the authority (and onus)
> to define its perimeter in a reasonable logical way.

And I would leave off "corporate", "enterprise" and any other qualification
of who's using the technology.  If there's no reason to specify the type of
network it might get used on, then we shouldn't.

---

From: Matthew Pounsett <[email-masked]>
Date: Wed, 21 Mar 2018 14:15:03 -0400

On 20 March 2018 at 11:10, Ted Lemon <[email-masked]> wrote:

> +1 to "split DNS", which has always been the term I've used and heard. I
> completely agree that "split horizon" muddies the water by referring to a
> routing concept that probably pre-dates widespread use of split DNS.
>
>
> The term "split horizon" was common at one time, and I think we need to
> say what it means in this context.   I think it makes sense to point out
> that it is not the currently preferred term, and that people shouldn't use
> it anymore, but it's useful to clue people in as to what it means.
>
> +1.  I've heard split-horizon and views used more than just "split DNS" in
my career to refer to answering differently based on source address,
destination address (where the server has more than one), and/or
authentication (TSIG, SIG(0)).  It makes sense that split-horizon should be
noted as not being the preferred term, but it should be there since it does
get used to describe the same thing.

I think I've seen in other places in this thread an implication that we
should incorporate broader uses of providing alternate responses, and I
don't agree with that.  GSLB, geolocation, and other types of alternate
responses may be cousins to views, but they have their own definitions.

---

From: Artyom Gavrichenkov <[email-masked]>
Date: Wed, 21 Mar 2018 18:44:05 +0000

On Mon, Mar 19, 2018 at 9:24 PM, Michael Sinatra <[email-masked]> wrote:
> Rather than try for some physical demarcation like "firewall" or "network,"
> why don't we simply say "organizationally-defined perimeter" or "perimeter
> defined by the organization," which leaves it vague enough to support the
> "many potential variants"?
>
> This also gives the enterprise organization both the authority (and onus) to
> define its perimeter in a reasonable logical way.

+1
A good idea actually.

| Artyom Gavrichenkov