Re: [Add] Fwd: New Version Notification for draft-reddy-add-enterprise-split-dns-01.txt

Hi Ben,

Please see inline

On Fri, 12 Mar 2021 at 00:32, Ben Schwartz <bemasc@google.com> wrote:

> Thanks for the updates.  Some comments
>
> Section 6:
>
>>    If an Enterprise network restricts all the DNS queries to be sent to
>>    the network-provided DNS server, SplitDNSAllowed will be set to
>>    false.
>
>
> This is clearly a policy prescription, and is out of scope.  I think this
> key should be removed from the draft.
>

It is only a policy expression and definitely not a policy prescription.
Updated the draft to clarify.

>
> > [RFC7149] recommends validation of responses using NSEC3.
>
> Nit: RFC 7129.
>

> Broader note: I think it would be better to drop the "private-only" flag,
> as well as the NSEC test and top-domains list.
>

Yes, removed all of the above in 02 revision.

> While this arrangement of claiming domain names that are known not to
> exist globally is possibly allowed by RFC 2826, I don't think it's a good
> practice.  For example, there is no such domain as "login.citibank.com",
> but I think it would be bad security practice (and also a bad architecture)
> to allow networks to claim that name.
>
> Note that private-only names are still supported.  If the local resolver
> is authoritative for corp.example.com, it can serve queries for
> login.corp.example.com, even if login.corp.example.com is NXDOMAIN when
> queried externally.
>

Agreed, please see
https://tools.ietf.org/html/draft-reddy-add-enterprise-split-dns-02#section-10
.

Cheers,
-Tiru

>
> On Thu, Mar 11, 2021 at 1:26 AM tirumal reddy <kondtir@gmail.com> wrote:
>
>> The revised draft
>> https://datatracker.ietf.org/doc/html/draft-reddy-add-enterprise-split-dns-01
>> addresses
>> comments from Ben. Further comments and suggestions are welcome.
>>
>> Cheers,
>> -Tiru
>>
>> ---------- Forwarded message ---------
>> From: <internet-drafts@ietf.org>
>> Date: Thu, 11 Mar 2021 at 11:54
>> Subject: New Version Notification for
>> draft-reddy-add-enterprise-split-dns-01.txt
>> To: Tirumaleswar Reddy.K <kondtir@gmail.com>, Dan Wing <danwing@gmail.com
>> >
>>
>>
>>
>> A new version of I-D, draft-reddy-add-enterprise-split-dns-01.txt
>> has been successfully submitted by Tirumaleswar Reddy and posted to the
>> IETF repository.
>>
>> Name:           draft-reddy-add-enterprise-split-dns
>> Revision:       01
>> Title:          Split-Horizon DNS Configuration in Enterprise Networks
>> Document date:  2021-03-10
>> Group:          Individual Submission
>> Pages:          12
>> URL:
>> https://www.ietf.org/archive/id/draft-reddy-add-enterprise-split-dns-01.txt
>> Status:
>> https://datatracker.ietf.org/doc/draft-reddy-add-enterprise-split-dns/
>> Htmlized:
>> https://datatracker.ietf.org/doc/html/draft-reddy-add-enterprise-split-dns
>> Htmlized:
>> https://tools.ietf.org/html/draft-reddy-add-enterprise-split-dns-01
>> Diff:
>> https://www.ietf.org/rfcdiff?url2=draft-reddy-add-enterprise-split-dns-01
>>
>> Abstract:
>>    When split-horizon DNS is deployed by an enterprise, certain
>>    enterprise domains are only resolvable by querying the network-
>>    provided DNS server.  DNS clients which use DNS servers not provided
>>    by the network need to route those DNS domain queries to the network-
>>    provided DNS server.  This document informs DNS clients of split-
>>    horizon DNS, their DNS domains, and is compatible with encrypted DNS.
>>
>>
>>
>>
>> Please note that it may take a couple of minutes from the time of
>> submission
>> until the htmlized version and diff are available at tools.ietf.org.
>>
>> The IETF Secretariat
>>
>>
>> --
>> Add mailing list
>> Add@ietf.org
>> https://www.ietf.org/mailman/listinfo/add
>>
>