> If, on the other hand, your internal DNS is screwed up and beyond your
> control (managed by another group or something), you can use split DNS to
> provide "good" data to the world and just ignore the internal mess. This
> is basicly just sweeping the problem under the rug; it would be better to
> really fix the problem, but sometimes the real world doesn't cooperate.
This is not to say that a screwed up internal DNS is a requirement :-)
Some folk just have _very_ large internal networks that use rfc1597 or
heaven forbid, stolen network numbers, or have many machines runing
old versions of named - which choke when root servers are unavailable.
For these and many other valid reasons, keeping the inside separate
from the outside is a good idea.
--sjg
References:
|
|
