Subject: Re: [homenet] Mixing DNS in with routing information

From: RJ Atkinson <[email-masked]>
Date: Fri, 26 Oct 2012 14:12:01 -0400

Earlier, Andrew Sullivan wrote:
> ...DNSSEC cannot be used for validation with mDNS because 
> the actual mDNS name is [some string].local., ...

mDNS can, and regularly is, also used to transport
DNS information outside the ".local" pseudo-TLD.
The mDNS specification explicitly says that mDNS
also can be used to carry foo.bar.<some-TLD> records.

Whether mDNS happens to be used in that way in a 
particular deployment appears to depend on local 
deployment considerations.

For example, I have heard about deployments where 
information about foo.bar.<particular-TLD> is carried 
by mDNS, for a variety of deployment-specific reasons.

When mDNS is being used to transport DNS information
that uses an official TLD (either ccTLD or gTLD),
rather than "foo.bar.local", then DNSsec can be used 
to protect that information.

My apologies for being insufficiently precise earlier.

Yours,

Ran

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 29 Oct 2012 11:14:28 -0400

> DNS information outside the ".local" pseudo-TLD.

Draft-cheshire-dnsext-multicastdns-15 notes that this is a contentious
issue.  (I also think it's a stupid idea, but I don't run the circus,
of course.)  But you're right: in that case, you probably can do
DNSSEC on it.  I'd be delighted to learn that there's a resolver out
there that knows how to do this.  Do you know of one?

Best,

A

-- 
Andrew Sullivan
[email-masked]