Subject: Re: What are valid reasons to have wildcards in DNS?

From: Nathan Jones <[email-masked]>
Date: Fri, 14 Nov 2003 09:07:28 +1100

>what are legal and valid reasons to have wildcards in domains?

Here is one example that springs to mind...

A company (Foo) provides web sites to real estate businesses. Each
business hosts its domain somewhere different and needs traffic to reach
the Foo web server. Foo tells its 400 customers to use CNAMEs, like this:

www.ocean-realty.example.  IN  CNAME  server.foo.example.

...so that if Foo's network must be renumbered, they don't have to make
400 real estate agents update DNS.

Of course, sometimes the customer wants "ocean-realty.example" to work in
a browser, so they break their DNS with:

@  IN  CNAME  server.foo.example.

>wouldn't it be much better to disable wildcards in DNS at all?

No. Only to educate DNS Admins about the possible problems.

-- 
Nathan Jones

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Kevin Darcy <[email-masked]>
Date: Thu, 13 Nov 2003 19:44:13 -0500

Matus UHLAR - fantomas wrote:

>[ post by non-subscriber.  with the massive amount of spam, it is easy to miss
>  and therefore delete posts by non-subscribers.  if you wish to regularly
>  post from an address that is not subscribed to this mailing list, send a
>  message to <listname>[email-masked] and ask to have the alternate
>  address added to the list of addresses from which submissions are
>  automatically accepted. ]
>
>Hello,
>
>for last two months there were many discussions and clarifications about
>wildcards in DNS. There is a question that seems to me still unanswered:
>
>>From my point of view, wildcards are used:
>1. by admins lazy to set up higher number of hostnames od MX records
>
Lazy? What if you have an internal-root architecture, sitting behind 
proxy-style firewalls for *all* protocols (including SMTP) and you want 
to control your outgoing mail routes centrally via MX records 
(controlling mail routing is, after all, what MX records are for)? Short 
of adding a duplicate entry for 
*every*possible*Internet*mail*destination* to your internal DNS, you're 
pretty much committed to using wildcard MXes. It's a little presumptuous 
IMO to call that "lazy".

Oh sure, I know that plenty of folks with such network architectures 
plug *static* mail routes into every one of their internal mail server's 
configurations. But, think about it, isn't that conceptually like 
inserting a huge *root* wildcard MX record into every one of those 
boxes' brains? Given a choice, I'd prefer to use real-life wildcard MXes 
in DNS centrally, than have to be responsible for maintaining static 
routing configs -- pseudo-wildcard-MXes, if you will -- on hundreds of 
servers. But then, that's just me.

>when we take into consideration all problems happening caused by using
>wildcard domain names - all of them were named in when verisgn introduced
>wildcards in .com and .net zones:
>
So, yet again we have a proposal to address an 
administrative/organizational/political/social problem with a 
technological quick-fix, i.e. disallow wildcards altogether. Wildcards 
are a tool; like most tools, they can be misused or abused. Don't blame 
the tool: blame the people who misuse or abuse it. Those of us who use 
the tool wisely and carefully and productively don't appreciate your 
attempts to take away our functionality.

- Kevin