Re: Naked domain resolution with DNSSEC

Hi 
Thanks for the quick responses.
The Microsoft authoritative DNS servers prevent adding CNAMEs at the zone apex. But there may be other DNS servers which may be allowing this and the validating resolvers are returning Serv_fail, As Andrew suggested.

I agree that CNAME should not be used for such migrations and DNAME may be used but *might* have deployment issues. But DNAME has a limitation that if you add DNAME at zone apex then you cannot have any other record in the zone, except at the zone apex (like NS records).

One more scenario where naked domain issue becomes evident is when the authoritative servers try to point a few of their records at some third party DNS hosting services

Contoso.com
{
www 	CNAME 	contoso.dnsprovider.com (owned by a third party)
internal A		1.1.1.1
}

How does it set out to achieve the naked domain resolution. It cannot add CNAME at the apex. Also it cannot add DNAME to the loadbalancer.net at the zone apex as then it can't host internal records and also resolution for www will point to www.dnsprovider.com

How will such a customer ensure that both www.contoso.com and contoso.com get pointed to contoso.provider.com.

Much appreciated!
Thanks
Ashu



-----Original Message-----
From: Dave Lawrence [mailto:[email protected]] 
Sent: Wednesday, October 23, 2013 8:25 PM
To: Kumar Ashutosh
Cc: Sourav Sain; [email protected] Group; Thirunadha Reddy
Subject: RE: [dnsext] Naked domain resolution with DNSSEC

Kumar Ashutosh writes:
> Coming back to the original question, the migration from contoso.com 
> to new_contoso.com is a fairly common scenario. Are there any guidance 
> on how to achieve such a migration. One argument can be that the 
> authoritative server for contoso.com should not keep CNAME records at
> (.) zone apex. In that case how is the admin supposed to handle such 
> migrations and still support Naked domain resolutions.

Unfortunately the best practice answer here is still to maintain the two zones in parallel.  "Use DNAME!" should be the answer, but unfortunately there are a sufficient number of issues with operational deployment of DNAME that it can't really be relied upon, at least not during an active migration.  As Andrew Sullivan said, CNAME is right out.

Depending on the hosting server software, there are some easy ways to keep both zones absolutely in sync.  I realize I'm replying to folks @microsoft.com right now, and unfortunately my knowledge of MS's auth DNS service is not current.  However, with other servers (BIND for
example) you can just point two different zone names at the same master file.  Names in rdata that point within the zone can just be made to be fully qualified by the destination zone name.

_______________________________________________
dnsext mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/dnsext