[dns-wg] TLD delegation trade-offs

At 11:00 +0100 6/10/05, Niall O'Reilly wrote:

>Spreading name servers among domains _may_ give resiliency; it _certainly_
>adds complexity and expands the repertoire of potential failure modes.
>There are more places where things can go wrong.  If there are (perhaps
>hidden) interdependencies between these places, the overall impact of one
>particular thing going wrong may be far greater than expected.  It all
>depends on having a strategy for placing your servers in well-managed parts
>both of the DNS tree and of the network topology.
>
>Of course, we all take care to have a strategy we can stand over,
>and to review it regularly! 8-)

Yeah, there are more places for potential failures, but it's not like 
the extra failures that are realized will harm because, well, it's 
like a parallel circuit and not a serial circuit.  You only need to 
find one (working) name server's address to get the data you need, 
you don't need to find all of them.

As far as complexity - is it all that more complex than the 
alternative of "placing your servers in well-managed parts?"  You do 
have more places to register host information (glue) and that is more 
complex.  But what is the complexity of determining the "well-managed 
parts?" ;)

I think this is coming down to a realization of "fate sharing."  If 
all of a domain's name servers share the same fate - like all being 
on the same physical subnet or maybe tied to the same security 
association (like VPN) - than naming them consistently is no loss. 
OTOH, if the fates are diverse, like choosing two unrelated 
organizations to run slave servers for you, then tying the names 
together is the "fate-sharing" element that reduces the benefit of 
the diversity in slave servers.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

If you knew what I was thinking, you'd understand what I was saying.