3 ms·

Chris Siebenmann has written extensively and early on what this means for organizations: https://utcc.utoronto.ca/~cks/space/blog/web/FirefoxDNSOverHTTPSAndUs

Chris Siebenmann has written extensively and early on what this means for organizations: https://utcc.utoronto.ca/~cks/space/blog/web/FirefoxDNSOverHTTPSAndUs https://utcc.utoronto.ca/~cks/space/blog/web/FirefoxDNSOverH...

fulafel 5y ago
I wonder what's the attraction of split horizon dns especially at an academic institution. It seems it will obviously break stuff since all kinds of things rely on dns working as it was designed to, providing a global namespace.
- ryan29 5y ago
  I personally use split horizon DNS for my home lab. I have several things that I put behind Cloudflare, but I don't want my local access to go me > cloudflare > me, so I use split horizon DNS. If you're not behind something like Cloudflare you can use NAT reflection (hairpin NAT), but those are a bit of a hack. Canada also has some large, private networks used by provincial governments that use split horizon DNS and DoH is going to be a huge pain for them. One specific example would be libraries that are on a private network and have access to resources handled differently depending on how you connect; via the private network = no auth, but via the internet = auth required. Split horizon DNS is a simple, practical way of affecting how traffic is routed in a lot of cases.
  - josephcsible 5y ago
    > you can use NAT reflection (hairpin NAT), but those are a bit of a hack. You think that hairpin NAT is a hack, but that split-horizon DNS isn't?
- uniqueuid 5y ago
  > Fortunately we already have a split-horizon DNS setup, because we long ago made the decision to have a private top level domain for all of our sandbox networks, so we use our existing DNS infrastructure to give BINAT'd machines different IP addresses in the internal and external views. https://utcc.utoronto.ca/~cks/space/blog/sysadmin/BinatAndSplitHorizonDNS https://utcc.utoronto.ca/~cks/space/blog/sysadmin/BinatAndSp...
  - fulafel 5y ago
    Thanks. It's interesting that after this account the characterisation "fortunately" is still used. But the motivations still give good perspective though i would have done things differently.
- seanhunter 5y ago
  There are definitely large organizations who run split horizon DNS because back in the mists of time they made poor choices and assigned IP addresses that were in the public address namespace (ie not a 10. or 192.168.1. etc) that they didn't own randomly to a large number of legacy subnets within their network. It's now too painful to migrate them, so they are a wart that has to be lived with until they eventually retire. In the meantime they have to use split dns so they are able to keep things kinda working. I have personally worked at least a couple of large orgs that have this setup (ie 100s or 1000s of ancient devices on internal networks squatting on what are actually public IPs).

fulafel 5y ago

I wonder what's the attraction of split horizon dns especially at an academic institution. It seems it will obviously break stuff since all kinds of things rely on dns working as it was designed to, providing a global namespace.

ryan29 5y ago
I personally use split horizon DNS for my home lab. I have several things that I put behind Cloudflare, but I don't want my local access to go me > cloudflare > me, so I use split horizon DNS. If you're not behind something like Cloudflare you can use NAT reflection (hairpin NAT), but those are a bit of a hack. Canada also has some large, private networks used by provincial governments that use split horizon DNS and DoH is going to be a huge pain for them. One specific example would be libraries that are on a private network and have access to resources handled differently depending on how you connect; via the private network = no auth, but via the internet = auth required. Split horizon DNS is a simple, practical way of affecting how traffic is routed in a lot of cases.
- josephcsible 5y ago
  > you can use NAT reflection (hairpin NAT), but those are a bit of a hack. You think that hairpin NAT is a hack, but that split-horizon DNS isn't?
uniqueuid 5y ago
> Fortunately we already have a split-horizon DNS setup, because we long ago made the decision to have a private top level domain for all of our sandbox networks, so we use our existing DNS infrastructure to give BINAT'd machines different IP addresses in the internal and external views. https://utcc.utoronto.ca/~cks/space/blog/sysadmin/BinatAndSplitHorizonDNS https://utcc.utoronto.ca/~cks/space/blog/sysadmin/BinatAndSp...
- fulafel 5y ago
  Thanks. It's interesting that after this account the characterisation "fortunately" is still used. But the motivations still give good perspective though i would have done things differently.
seanhunter 5y ago
There are definitely large organizations who run split horizon DNS because back in the mists of time they made poor choices and assigned IP addresses that were in the public address namespace (ie not a 10. or 192.168.1. etc) that they didn't own randomly to a large number of legacy subnets within their network. It's now too painful to migrate them, so they are a wart that has to be lived with until they eventually retire. In the meantime they have to use split dns so they are able to keep things kinda working. I have personally worked at least a couple of large orgs that have this setup (ie 100s or 1000s of ancient devices on internal networks squatting on what are actually public IPs).