Re: [Add] WG Adoption Call draft-reddy-add-enterprise-split-dns

[Eliot Lear <[e-mail]>]

Hi,

On 05.05.22 21:57, Paul Wouters wrote:
> The only real solution I see is one similar to the IKEv2 split-DNS case,
> one where there is basically an authenticated and authorized
> provisioning step that enables the user to join an "enterprise network"
> wich can demand all or a subnet of DNS traffic which the user is required
> to opt-in to. And even that is tricky when a user is kinda forced to
> accept to get any connectivity, say in a hotel or coffeeshop (or
> repressive regime) 

I think you are aiming at the fundamental problem, Paul: is there a way 
for the user to decide who to trust.  Ben's pointed out the UX problems 
with answering that question.  For enterprise assets that clearly has to 
be the enterprise.  The only question really is how to bootstrap trust 
in the enterprise.  Any draft trying to address split DNS has to assume 
that has happened.  That part can't be in scope here.

What this or any draft has to do is be a bit clearer in stating that and 
then show how that bootstrapping of trust is leveraged to address split 
DNS, either via resolver selection at a gross or fine level, or through 
other means.  Right now I think it is trying to demonstrate that through 
multiple mechanisms, and that is what is making things rather hard to 
follow.  That's because there is no one-size-fits-all solution because 
enterprises come in many shapes and forms.  To some, leaking a modest 
amount of NS records is okay.  The pollution argument you raise is only 
relevant in as much as domains outside the enterprise control would be 
polluted.  If that's not the case, then it's a matter for an enterprise, 
and nobody else's business.

So I support adoption of this draft, but I do think it needs a lot more 
work to be clearer on the bootstrapping that is occurring.

Eliot