Re: Naked domain resolution with DNSSEC

Hey,

On Oct 23, 2013, at 10:55, Dave Lawrence <[email protected]> wrote:

> Kumar Ashutosh writes:
>> Coming back to the original question, the migration from contoso.com
>> to new_contoso.com is a fairly common scenario. Are there any guidance
>> on how to achieve such a migration. One argument can be that the
>> authoritative server for contoso.com should not keep CNAME records at
>> (.) zone apex. In that case how is the admin supposed to handle such
>> migrations and still support Naked domain resolutions. 
> 
> Unfortunately the best practice answer here is still to maintain the
> two zones in parallel.  "Use DNAME!" should be the answer, but
> unfortunately there are a sufficient number of issues with operational
> deployment of DNAME that it can't really be relied upon, at least not
> during an active migration.

Geoff Huston and George Michaelson did an experiment on this the other week, and their findings were that DNAME support is as near universal as they can measure.

A description of the experiment can be found in an appendix to draft-jabley-dnsop-as112-dname-01.


Joe

_______________________________________________
dnsext mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/dnsext