Subject: [dnsop] Comments on draft-krishnaswamy-dnsop-split-view-01.txt

From: "Scott Rose" <[email-masked]>
Date: Wed, 5 Jul 2006 12:29:13 -0400

Looking back at the work I volunteered to do, and Suresh's Split-View DNS
draft was one of the possible WG drafts I promised to review.  I think that
some sort of draft about split view operations should be written since it is
becoming a more common practice for most enterprises.

Anyway, I read through the latest version I have (-05) and comments are
below:

Section 2.4 - It would be easier for readers to understand if the roles and
the labels in the diagram were the same.

Section 2.4 - also, would another good recommendation be to only allow
queries from a select set of IP addresses?  Not as good as TSIG restricted
queries, but another option, especially if the LAN was secure.

Section 3.1, last sentence - "The internal recursive forwarder does not have
any trusted key configured and does not perform an validation."  Should
probably be "..not perform any DNSSEC validation.", since it could still be
using TSIG?

Section 3.2 - Is this setup using the same zonefile at the parent zone?

Section 3.3 and 3.4 - would it really be that much trouble to reconfigure
trust anchors?  Most devices can have multiple trust anchors, and keytag
would be used to select the correct one during validation.  However, I
realize local policy tools would have to be able to decide when to use
either key for the correct zone view.

Scott

****************************************
Scott Rose
Adv. Network Tech. Div., NIST
+1 301-975-8439

https://www-x.antd.nist.gov/dnssec/
http://www.dnssec-deployment.org/
****************************************

.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html