Re: Naked domain resolution with DNSSEC

>Coming back to the original question, the migration from contoso.com to
>new_contoso.com is a fairly common scenario. Are there any guidance on
>how to achieve such a migration.

I think _this_ question is the one that actually needs to be answered.

There are relatively simple ways, which might need a bit more work if
there is a need for DNSSEC signing of the zone in question.

There are actually possibly two elements - moving DNS provider, and
migrating from one domain to another.

If you ignore the moving DNS provider, there is a fairly simple way of
doing this.

First, let's be sure you actually want the result to be:

every query for something.old-name.com
	and for something.new-name.com

must always return the same results. (And at some point in future,
old-name will disappear.)

Here's how you can achieve the desired result:
Run old-name and new-name on the same set of DNS authority servers.
Have the same zone file imported for both zones, with all names relative
to the parent zone name.
In BIND syntax, it would look something like:
zone "new-name.com" {
  type master;
  file "master/db.old-name-new-name.com";
  }
zone "old-name.com" {
  type master;
  file "master/db.old-name-new-name.com";
  }

If you need to do signed zones, it becomes a bit more tricky, in that the
name of the signer (in the RRSIG) would be different, and would also
impact DS and RRSIG(DNSKEY) records.
In this case, you could either have a "merged" zone file (one set of
names, two sets of signatures, with the names in "relative" format), or
you could have two signed zone files.

Automating the signing of the zone files, via some kind of script, would
make it automatic, whenever changes are made to the zone (e.g. it could
also ensure the SOA serial number gets updated, among other things.)

On the other hand, if you also need to move DNS providers, you would need
to augment this with something like:
- set up the above, on both the old DNS provider, and the new DNS provider
- swing things from the old provider to the new provider (by doing changes
on the registrar to update the delegation NS set).
- keep things running in parallel for at least 2 x max-TTL
- shut down the old DNS provider's stuff (and be SURE they remove all
remnants, or anyone using them for resolution might get stale data).

I think this is likely good enough for anyone doing what you are trying to
do, and avoids messing with CNAME or DNAME or anything similar.

Brian

_______________________________________________
dnsext mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/dnsext