5 ms·

I think the hard part about DNS is not the public facing resolution of addresses, but rather how to understand it in enterprise environments. A junior tasked w

I think the hard part about DNS is not the public facing resolution of addresses, but rather how to understand it in enterprise environments. A junior tasked with creating a DNS record in an enterprises servers will have to go through a wild ride to just get that record created and set in a correct manner. Even worse, if a service has to be reachable through an internal DNS entry and external DNS entry. Not only is it stressful to find the IT deities to grant the junior their wish, it can be a monetary issue as well if the company needs to re-order public certs in case of mistakes.

radiowave 3y ago
The absurdity is striking when you see all this process around DNS in a large org, and then you remember that DNS was invented as a way of permitting delegation of authority, away from the centre.
- icedchai 3y ago
  I've seen it takes weeks to get a DNS record configured in a large org. I'm talking something that should be simple, like adding a CNAME or A record for a new site.
Helmut10001 3y ago
Humble question: Why not use Let's encrypt via DNS API? Works both internally & on public networks.
- wasmitnetzen 3y ago
  Let's Encrypt is only 8 years old, that's not enough time for a lot of corporate IT policies to allow its usage.
- bityard 3y ago
  In an "Enterprise" setting, the dev or ops team that needs certificates for internal services often has no direct access to the company's external web site or DNS, which may be owned by some other team like marketing or IT. So the options can boil down to jumping through bureaucratic hoops (if they even exist) for every request, or kludge together some other half-baked system that sorta gets the job done. Ask me how I know.
  - Helmut10001 3y ago
    Makes sense. I mean, in case of wildcard certificates, number of requests/access could be reduced to 1x per subdomain, but still. I have the same problem at my university.
wildpeaks 3y ago
Bonus points when it's spread across a bunch of different registrars and they refuse to delegate nameservers because of office politics, making things way more complicated to deploy and maintain.

radiowave 3y ago

The absurdity is striking when you see all this process around DNS in a large org, and then you remember that DNS was invented as a way of permitting delegation of authority, away from the centre.

icedchai 3y ago
I've seen it takes weeks to get a DNS record configured in a large org. I'm talking something that should be simple, like adding a CNAME or A record for a new site.

Helmut10001 3y ago

Humble question: Why not use Let's encrypt via DNS API? Works both internally & on public networks.

wasmitnetzen 3y ago
Let's Encrypt is only 8 years old, that's not enough time for a lot of corporate IT policies to allow its usage.
bityard 3y ago
In an "Enterprise" setting, the dev or ops team that needs certificates for internal services often has no direct access to the company's external web site or DNS, which may be owned by some other team like marketing or IT. So the options can boil down to jumping through bureaucratic hoops (if they even exist) for every request, or kludge together some other half-baked system that sorta gets the job done. Ask me how I know.
- Helmut10001 3y ago
  Makes sense. I mean, in case of wildcard certificates, number of requests/access could be reduced to 1x per subdomain, but still. I have the same problem at my university.

wildpeaks 3y ago

Bonus points when it's spread across a bunch of different registrars and they refuse to delegate nameservers because of office politics, making things way more complicated to deploy and maintain.