Subject: [Add] split-DNS --- Re: Control

From: Michael Richardson <[email-masked]>
Date: Fri, 09 Aug 2019 16:25:49 -0400

Ted Lemon <[email-masked]> wrote:
    >> Split DNS is a critical use case.  It is not just development systems
    >> that are not addressable on the outside, but nearly all HR and financial
    >> systems as well

I sold firewalls for most of a decade (25 years ago) that did split-DNS.
(I didn't invent it, but I feel that I invested a lot of time into it)

    > Yes, indeed, this has to work. Would be nice if it could be trusted
    > based on authenticity rather than a leap of faith.

I think that Split-DNS is dumb, and it violates so many DNSSEC
things, and it fails when you have multiple VPNs up because you are a
consultant who works in many places.

The right answer is to have internal names be an (sub-)zone that on a server
that only answers when you are inside. Then chain via NS/DS to it.
So example.com has it's internal servers at mail.internal.example.com,
and unless you query from within (or via VPN), then you don't get an
answer.

I wrote a document on this for MIF which is expired, search for "walled
gardens"
But, this method depends upon IPv6 to be use correctly, and marketing people
don't understand that, so we have brittle provisioning domains.

Internal-only DNS as I described still breaks if you do DoT/DoH to
the cloud rather than locally.  It also works best if you do recursive
DNS resolving locally... which also means you can DNSSEC and DNS64, so that
all seems like a win to me.   This is my biggest problem.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Ted Lemon <[email-masked]>
Date: Fri, 9 Aug 2019 13:35:15 -0700

On Aug 9, 2019, at 1:25 PM, Michael Richardson <[email-masked]> wrote:
> So example.com <http://example.com/> has it's internal servers at mail.internal.example.com <http://mail.internal.example.com/>,

Not answering means that there is no source quench.   What you want is to give a different, validatable answer depending on whether you are inside or outside.   This is doable.   But it is essentially split DNS.   This is why I’m pointing to “authenticity” versus “leap of faith.”   It is possible to do split DNS securely, and that’s the way we should do recommend that it be done.

---

From: Paul Wouters <[email-masked]>
Date: Fri, 9 Aug 2019 16:54:48 -0400

> On Aug 9, 2019, at 16:25, Michael Richardson <[email-masked]> wrote:
> 
> 
> 

This is not true, unless the different VPNs use the same namespace.

See https://tools.ietf.org/html/draft-ietf-ipsecme-split-dns-16

> that only answers when you are inside. Then chain via NS/DS to it.

Yes that is what the draft supports.

> the cloud rather than locally.

Not if you properly reconfigure DNS when the VPN goes up or down.

Paul