Re: [Add] ADD WGLC for Establishing Local DNS Authority in Split-Horizon Environments draft-ietf-add-split-horizon-authority-03

[Dan Wing <[e-mail]>]

Same with my current employer's roadmap. The draft improves security for some of our VPN use-cases.  Fortunately for IT staff once DDR/DNR are available the rest of the requirements for them to enable draft are not onerous or scary.

-d


> On Feb 2, 2023, at 5:02 AM, tirumal reddy <[e-mail]> wrote:
> 
> It is in our roadmap (at my previous firm) to support this specification but we first need deployment of DDR/DNR. The mechanisms discussed in the draft are to give flexibility to the DNS client to pick one of them that is suitable to it. However, the network has just one way to prove authority over the domains.
> 
> -Tiru
> 
> On Thu, 12 Jan 2023 at 04:12, Tommy Pauly <tpauly=[e-mail] <mailto:[e-mail]>> wrote:
>> As the high-level bit, I’d like to understand what networks that use and rely on split DNS are going to deploy this, and which parts of the document are being deployed. I’d like to see some presentation and discussion of running code on both network and client sides.
>> 
>> The document describes many mechanisms, and I think we should have some experience with some or all of them before we try to publish the document, and use implementation and early deployment experience to influence the document and where it focuses.
>> 
>> To Paul’s points about realistic split DNS deployments, trying to use the mechanisms in this document in practice should help validate what is actually practical and effective in real networks.
>> 
>> I’d like to see more done in this regard before we progress the document beyond the WG.
>> 
>> Tommy
>> 
>> > On Jan 11, 2023, at 12:07 PM, Paul Wouters <[e-mail] <mailto:[e-mail]>> wrote:
>> > 
>> > On Wed, 11 Jan 2023, Deen, Glenn wrote:
>> > 
>> >> The editors of the ADD Document: Establishing Local DNS Authority in Split-Horizon Environments
>> >> draft-ietf-add-split-horizon-authority-03 believe the document is ready for working last call.  
>> >> This then is the formal WGLC for comments on this document.  This WGLC will run for 2 weeks until January 26th
>> >> 2023.
>> > 
>> > I still do not think this document is ready for the previously mentioned
>> > reasons:
>> > 
>> > - It redefines split-dns to a very specific case that is not the common case.
>> > - It requires split-dns to be centrally operated as the form of
>> >  authorization for "taking over" that domain. This does not work for the
>> >  common case of split-dns where the local branches run their own
>> >  independent DNS from the public global view. It calls this "Validated
>> >  Split-Horizon" and the solution only works for this subset of
>> >  split-dns.
>> > - split-dns where some domains only exist locally and not in the public
>> >  view requires that those local zones run on the same nameservers as
>> >  the public zone they fall under. This is not a common or realistic
>> >  kind of deployment.
>> > - The authorization for "Validated Split-Horizon" does not require DNSSEC,
>> >  so there is no authoritative proof. The draft introduces a term "tamperproof
>> >  resolution" that reduces DNSSEC's data protection with transport
>> >  security, meaning that any user configured world wide trusted resolver can
>> >  disable the split-dns configuration.
>> > 
>> > While I appreciate the Acknowledgement section that lists my
>> > name to thank me for the "discussion", I do feel that this can be
>> > misunderstood as me agreeing with the draft. I am requesting that
>> > the authors to remove my name from this section.
>> > 
>> > Thanks,
>> > 
>> > Paul
>> > 
>> > -- 
>> > Add mailing list
>> > [e-mail] <mailto:[e-mail]>
>> > https://www.ietf.org/mailman/listinfo/add
>> 
>> -- 
>> Add mailing list
>> [e-mail] <mailto:[e-mail]>
>> https://www.ietf.org/mailman/listinfo/add
> -- 
> Add mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/add