Re: [Add] New Version Notification for draft-reddy-add-enterprise-split-dns-01.txt

> On Mar 11, 2021, at 11:02 AM, Ben Schwartz <bemasc=40google.com@dmarc.ietf.org> wrote:
> 
> Thanks for the updates.  Some comments
> 
> Section 6:
>    If an Enterprise network restricts all the DNS queries to be sent to
>    the network-provided DNS server, SplitDNSAllowed will be set to
>    false.
> 
> This is clearly a policy prescription, and is out of scope.  I think this key should be removed from the draft.

Agreed. I think the main issue is that this ends up being an “evil bit”. There’s no reason for a client to trust or respect this value, unless they already have a strong MDM-style relationship, in which case this wouldn’t be needed.

I am in favor of letting the network prove authority for private domains, or even present an identity for itself as the network operator. It’s up to the client to use those or ignore those.

The one thing the network could do that might be useful is provide a flag that it will be actively hostile to any DNS traffic it detects that does not go to itself, with some reason text. The (minimal) value there is to allow a client to present a reason for things being broken if the user of the client device also has a strict policy to not trust this network.

Tommy
> 
> > [RFC7149] recommends validation of responses using NSEC3.
> 
> Nit: RFC 7129.
> 
> Broader note: I think it would be better to drop the "private-only" flag, as well as the NSEC test and top-domains list.  While this arrangement of claiming domain names that are known not to exist globally is possibly allowed by RFC 2826, I don't think it's a good practice.  For example, there is no such domain as "login.citibank.com <http://login.citibank.com/>", but I think it would be bad security practice (and also a bad architecture) to allow networks to claim that name.
> 
> Note that private-only names are still supported.  If the local resolver is authoritative for corp.example.com <http://corp.example.com/>, it can serve queries for login.corp.example.com <http://login.corp.example.com/>, even if login.corp.example.com <http://login.corp.example.com/> is NXDOMAIN when queried externally.
> 
> On Thu, Mar 11, 2021 at 1:26 AM tirumal reddy <kondtir@gmail.com <mailto:kondtir@gmail.com>> wrote:
> The revised draft https://datatracker.ietf.org/doc/html/draft-reddy-add-enterprise-split-dns-01 <https://datatracker.ietf.org/doc/html/draft-reddy-add-enterprise-split-dns-01> addresses
> comments from Ben. Further comments and suggestions are welcome.
> 
> Cheers,
> -Tiru
> 
> ---------- Forwarded message ---------
> From: <internet-drafts@ietf.org <mailto:internet-drafts@ietf.org>>
> Date: Thu, 11 Mar 2021 at 11:54
> Subject: New Version Notification for draft-reddy-add-enterprise-split-dns-01.txt
> To: Tirumaleswar Reddy.K <kondtir@gmail.com <mailto:kondtir@gmail.com>>, Dan Wing <danwing@gmail.com <mailto:danwing@gmail.com>>
> 
> 
> 
> A new version of I-D, draft-reddy-add-enterprise-split-dns-01.txt
> has been successfully submitted by Tirumaleswar Reddy and posted to the
> IETF repository.
> 
> Name:           draft-reddy-add-enterprise-split-dns
> Revision:       01
> Title:          Split-Horizon DNS Configuration in Enterprise Networks
> Document date:  2021-03-10
> Group:          Individual Submission
> Pages:          12
> URL:            https://www.ietf.org/archive/id/draft-reddy-add-enterprise-split-dns-01.txt <https://www.ietf.org/archive/id/draft-reddy-add-enterprise-split-dns-01.txt>
> Status:         https://datatracker.ietf.org/doc/draft-reddy-add-enterprise-split-dns/ <https://datatracker.ietf.org/doc/draft-reddy-add-enterprise-split-dns/>
> Htmlized:       https://datatracker.ietf.org/doc/html/draft-reddy-add-enterprise-split-dns <https://datatracker.ietf.org/doc/html/draft-reddy-add-enterprise-split-dns>
> Htmlized:       https://tools.ietf.org/html/draft-reddy-add-enterprise-split-dns-01 <https://tools.ietf.org/html/draft-reddy-add-enterprise-split-dns-01>
> Diff:           https://www.ietf.org/rfcdiff?url2=draft-reddy-add-enterprise-split-dns-01 <https://www.ietf.org/rfcdiff?url2=draft-reddy-add-enterprise-split-dns-01>
> 
> Abstract:
>    When split-horizon DNS is deployed by an enterprise, certain
>    enterprise domains are only resolvable by querying the network-
>    provided DNS server.  DNS clients which use DNS servers not provided
>    by the network need to route those DNS domain queries to the network-
>    provided DNS server.  This document informs DNS clients of split-
>    horizon DNS, their DNS domains, and is compatible with encrypted DNS.
> 
> 
> 
> 
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org <http://tools.ietf.org/>.
> 
> The IETF Secretariat
> 
> 
> -- 
> Add mailing list
> Add@ietf.org <mailto:Add@ietf.org>
> https://www.ietf.org/mailman/listinfo/add <https://www.ietf.org/mailman/listinfo/add>
> -- 
> Add mailing list
> Add@ietf.org
> https://www.ietf.org/mailman/listinfo/add