Re: [Add] Fwd: New Version Notification for draft-reddy-add-enterprise-split-dns-01.txt

[Ben Schwartz <[e-mail]>]

Thanks for the updates.  Some comments

Section 6:

>    If an Enterprise network restricts all the DNS queries to be sent to
>    the network-provided DNS server, SplitDNSAllowed will be set to
>    false.


This is clearly a policy prescription, and is out of scope.  I think this
key should be removed from the draft.

> [RFC7149] recommends validation of responses using NSEC3.

Nit: RFC 7129.

Broader note: I think it would be better to drop the "private-only" flag,
as well as the NSEC test and top-domains list.  While this arrangement of
claiming domain names that are known not to exist globally is possibly
allowed by RFC 2826, I don't think it's a good practice.  For example,
there is no such domain as "login.citibank.com", but I think it would be
bad security practice (and also a bad architecture) to allow networks to
claim that name.

Note that private-only names are still supported.  If the local resolver is
authoritative for corp.example.com, it can serve queries for
login.corp.example.com, even if login.corp.example.com is NXDOMAIN when
queried externally.

On Thu, Mar 11, 2021 at 1:26 AM tirumal reddy <[e-mail]> wrote:

> The revised draft
> https://datatracker.ietf.org/doc/html/draft-reddy-add-enterprise-split-dns-01
> addresses
> comments from Ben. Further comments and suggestions are welcome.
>
> Cheers,
> -Tiru
>
> ---------- Forwarded message ---------
> From: <[e-mail]>
> Date: Thu, 11 Mar 2021 at 11:54
> Subject: New Version Notification for
> draft-reddy-add-enterprise-split-dns-01.txt
> To: Tirumaleswar Reddy.K <[e-mail]>, Dan Wing <[e-mail]>
>
>
>
> A new version of I-D, draft-reddy-add-enterprise-split-dns-01.txt
> has been successfully submitted by Tirumaleswar Reddy and posted to the
> IETF repository.
>
> Name:           draft-reddy-add-enterprise-split-dns
> Revision:       01
> Title:          Split-Horizon DNS Configuration in Enterprise Networks
> Document date:  2021-03-10
> Group:          Individual Submission
> Pages:          12
> URL:
> https://www.ietf.org/archive/id/draft-reddy-add-enterprise-split-dns-01.txt
> Status:
> https://datatracker.ietf.org/doc/draft-reddy-add-enterprise-split-dns/
> Htmlized:
> https://datatracker.ietf.org/doc/html/draft-reddy-add-enterprise-split-dns
> Htmlized:
> https://tools.ietf.org/html/draft-reddy-add-enterprise-split-dns-01
> Diff:
> https://www.ietf.org/rfcdiff?url2=draft-reddy-add-enterprise-split-dns-01
>
> Abstract:
>    When split-horizon DNS is deployed by an enterprise, certain
>    enterprise domains are only resolvable by querying the network-
>    provided DNS server.  DNS clients which use DNS servers not provided
>    by the network need to route those DNS domain queries to the network-
>    provided DNS server.  This document informs DNS clients of split-
>    horizon DNS, their DNS domains, and is compatible with encrypted DNS.
>
>
>
>
> Please note that it may take a couple of minutes from the time of
> submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> The IETF Secretariat
>
>
> --
> Add mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/add
>