Re: DNS and ULA

[james woodyatt <jhw@apple.com>]

On May 23, 2007, at 13:42, Iljitsch van Beijnum wrote:
> And what about the situation where companies X and Y have a VPN  
> tunnel between them so their ULA networks are linked. Setting up  
> routing for this is trivial (unless you run out of RFC 1930 private  
> AS numbers) but how would this work DNS-wise? This gets real  
> complex real fast if you can't touch the root servers for ULA  
> addresses.

Obviously, I can't look up your name servers for  
$YOUR_ULA_PREFIX.ip6.arpa in the global DNS horizon.  You have to  
provide them to me when we merge our networks, and I have to  
configure my DNS resolving proxies to use them instead of the global  
DNS when looking up names for nodes in your prefix.  Furthermore, I  
already need to configure my resolving proxies to search your DNS  
horizon if I want to resolve names for the addresses in your ULA  
prefix, and I don't particularly want to disclose the names of  
addresses in my ULA prefixes on the global DNS horizon, so you're  
going to have to do the same as me.

This is just a fact of life with IPv6 VPN and ULA.  If I connect my  
home network up to the Apple network through a VPN tunnel, I expect  
all my lookups for Apple-internal DNS names to resolve properly, and  
they won't if I'm only searching the global DNS horizon.  This  
virtual private DNS horizoning already works fine with IPv4 VPN  
tunnels.  There's no reason to think it won't just carry forward  
naturally into IPv6 VPN tunneling, so I fail to see the big deal.

> What's the use of forbidding (prohibiting has the connotation of  
> implied successfulness) something that happens all the time and  
> isn't going to stop?

That which is not forbidden is easily made mandatory. <smiley/>

If recursive resolvers operating in the global DNS horizon are  
permitted to follow delegations to name servers on ULA prefixes, then  
those delegations cannot be guaranteed to resolve to the same name  
servers everywhere.  Is that something we think resolvers are now  
doing all the time?  ...that we believe isn't going to stop?  ...that  
we think isn't an abomination against all that is hallowed in the  
name of the Internet Society?

Why do resolvers need to do this, and why can't they be made to stop?

Look at it this way: a prohibition would serve to define the  
boundaries of the global DNS horizon better, making it the  
responsibility of the resolver to search only one horizon recursively  
at a time, i.e. a recursive search that begins at the global DNS root  
MUST NOT leave the global DNS horizon.


--
james woodyatt <jhw@apple.com>
member of technical staff, communications engineering