DNS guidance update #1006
Open
DNS guidance update #1006
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jonodrew
reviewed
Feb 25, 2025
|
|
||
| Your non-production domains should be subdomains of your production domain. | ||
|
|
||
| For example, if you service can be found at `myservice.service.gov.uk`, then you might also have Route 53 records for your other environments, such as: |
There was a problem hiding this comment.
This point's under discussion at the moment. I agree with it, but I don't think it's been properly agreed
There was a problem hiding this comment.
Happy to leave this open assuming the discussion isn't gonna take forever, LMK :)
galund
commented
Feb 25, 2025
sihugh
reviewed
Feb 25, 2025
galund
commented
Feb 25, 2025
galund
commented
Feb 26, 2025
- not all teams do this, but it's an option - we might also want some advice about marking non-prod sites clearly to avoid end-user confusion - also security considerations are missing here
- first draft based on current practice
- even GOV.UK do not do this, see https://github.com/alphagov/govuk-dns-tf/tree/main?tab=readme-ov-file#amazon-route53-vs-google-cloud - cannot link this reference from the body text as it's a private repo - the Service Manual says "Consider using multiple suppliers" so arguably if we aren't doing this we should propose an update to that
- in practice GOV.UK do dual host a lot of their stuff - best to avoid 'should' or 'must' language in a callout, anyway
- easiest thing for most cases is to *not* set Domain per OWASP guidance - some folks prefer to have `www.` as a belt-and-braces approach to full domain separation, and there isn't consensus right now to take a hard line either way
- annoyingly the tech docs template doesn't support this (GitHub) feature
galund
force-pushed
the
dns-for-internal-services
branch
from
2946ec0 to
a46f911
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fairly radical rewrite including