Re: Naked domain resolution with DNSSEC

Kumar Ashutosh writes:
> Coming back to the original question, the migration from contoso.com
> to new_contoso.com is a fairly common scenario. Are there any guidance
> on how to achieve such a migration. One argument can be that the
> authoritative server for contoso.com should not keep CNAME records at
> (.) zone apex. In that case how is the admin supposed to handle such
> migrations and still support Naked domain resolutions. 

Unfortunately the best practice answer here is still to maintain the
two zones in parallel.  "Use DNAME!" should be the answer, but
unfortunately there are a sufficient number of issues with operational
deployment of DNAME that it can't really be relied upon, at least not
during an active migration.  As Andrew Sullivan said, CNAME is right out.

Depending on the hosting server software, there are some easy ways to
keep both zones absolutely in sync.  I realize I'm replying to folks
@microsoft.com right now, and unfortunately my knowledge of MS's auth
DNS service is not current.  However, with other servers (BIND for
example) you can just point two different zone names at the same
master file.  Names in rdata that point within the zone can just be
made to be fully qualified by the destination zone name.

_______________________________________________
dnsext mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/dnsext