search

DNSSEC-Provisioning / music

Multi-Signer Controller (MuSiC)
6 stars 5 forks source link

zone nameserver needs improvement if the Signer infrastructure shares a NS between them. #213

Open romu42 opened 1 year ago

romu42 commented 1 year ago

Signer1 nameservers: ns1, ns3 Signer2 nameservers: ns2, ns3

When adding the Signers to the Signer group the shared nameserver (ns3) will be assigned to the signer that is added first. If this signer then leaves the signer group the shared nameserver (ns3) will be removed from the NS RRset.

peterthomassen commented 1 year ago

For the sake of argument, let's remove DNSSEC from the picture. We have zone example.com, and it is hosted at Operator A and Operator B. Both Operators A and B use Operator C as a secondary, with NS hostname ns.provider-c.net (this is "ns3" in the initial post).

Now, the zone owner provisions the zone records with with Operator A through A's API, and with Operator B through some other API of B.

A and B then provision copies of the customer zone to Operator C.

How can C keep two copies of the zone? Which copy will C answer from when C receives a query?

I think once this get clarified, I perhaps understand better what the problem would be in the context of MuSiC.