Subject: Re: Zone cut

From: Edward Lewis <[email-masked]>
Date: Thu, 13 Jan 2005 15:20:58 -0500

At 14:28 -0500 1/13/05, Greg Hudson wrote:
>I'm also concerned that if applications start paying attention to zone
>cuts, DNS administrators will become more constrained in what they do.

That's a good point - operations ought to push the protocol, but 
never impinge it.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

"A noble spirit embiggens the smallest man." - Jebediah Springfield

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Edward Lewis <[email-masked]>
Date: Thu, 13 Jan 2005 15:19:44 -0500

At 17:47 +0000 1/13/05, John Levine wrote:
>>Well, zone cuts are manifestations of administrative boundaries
>>within the data model of DNS.
>
>Sometimes.  Sometimes they are merely an implementation detail.  For
>example, there is a zone cut at korea.services.net even though all
>of services.net belongs to me and is hosted on my servers.  The
>services.net zone is served through tinydns, while korea.services.net
>is served through rbldbsd because it's a DNSBL.

That's an example of an administrative boundary. ;)  At least to the 
DNS.  The DNS (if it were a sentient being) wouldn't know that you 
are the holder of the privileged user account password that allows 
you to manage the two zones.

(If you did DNSSEC, you'd have to have a key for each administration. 
However, you could be the exclusive user of both keys, and the key 
material could even be the same.  But to DNS, they are different 
keys.)

Even if you used BIND (let's just say) and had two zones, example.net 
and example.example.net and ran them both on the same machines 
everywhere, there is an administrative boundary present to the DNS. 
This is manifested in having separate zone clauses in the named.conf 
file.

The point you make highlights why zones cuts aren't intended to be 
seen outside the DNS.  They mean little in other planes of thought, 
even if all zone cuts are equal to the protocol.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

---

From: Greg Hudson <[email-masked]>
Date: Thu, 13 Jan 2005 14:28:11 -0500

On Thu, 2005-01-13 at 12:47, John Levine wrote:
> You really can't assume anything about a zone cut except that it's a
> zone cut.  You can't even assume it's all under a common
> administration since there are servers that serve out of databases, so
> the rules about who manages what are in the database schema which we
> can't see.

I'm also concerned that if applications start paying attention to zone
cuts, DNS administrators will become more constrained in what they do. 
I'd hate to start hearing about conversations like: "Why don't we just
start delegating the foo subdomain?"  "We're not sure what impact that
would have on SPF clients."