Re: [Add] Proposed charter and BoF request for IETF 106

[Alissa Cooper <[e-mail]>]

Hi Rob,

When the IESG was discussing this, I wrote up the text below. The structure and some of the text made it into the version Barry shared.

—

Application Behavior Considering DNS (ABCD)

DNS over TLS (DoT) [RFC 7858], DNS over DTLS [RFC8094], and DNS over HTTPS (DoH) [RFC 8484] provide confidentiality and tamper-resistance to thwart on-path attacks against DNS queries flowing between clients and recursive resolvers. Along with the deployment of these new transports, various application providers have been exploring having the application configure its own DNS services rather than using DNS services configured by the network operator. (The working group considers a network operator to include Internet service providers, enterprises, and any businesses that provide network access.) Together, these developments may represent a set of shifts depending on how the new protocols are deployed: from cleartext to encrypted transports, from use of unique port numbers for DNS resolution to ports that support significant other traffic (e.g., HTTPS), and from network operator control of DNS configuration to control by clients, third-party resolvers, or others.

This potential set of shifts raises many questions given the long history and current status of DNS operational practices. Network operators have historically used DNS services for a variety of purposes beyond simple query resolution: to mitigate network and security threats, to enforce enterprise policy, to provide parental controls and other filters, and to comply with relevant laws and regulations, among others. To the extent that the presence of encrypted DNS transports or changes in DNS configuration control or both create barriers to achieving the objectives that underlie these practices, this working group is the venue within the IETF to work on engineering and operational solutions. 

This working group is focused on specifying protocols, guidance, and best practices to support the smooth operation of encrypted DNS transports across diverse networks with potentially diverse and changing arrangements concerning where the control of DNS service configuration is located. Specific initial areas of focus include but are not limited to:

- Resolver discovery and selection
- Expression of resolver policy
- Support for split-horizon DNS environments
- Mechanisms to facilitate testing of new configurations

This working group will coordinate with the DNSOP (OPS Area) and DPRIVE (INT Area) working groups, and all last-call announcements (including Working Group Last Calls issued by the chairs) will be copied to all three working groups to ensure thorough and careful review.  The working group will also coordinate with the Security Area, and will be assigned a security advisor.

—

Best,
Alissa


> On Oct 9, 2019, at 3:51 PM, Rob Sayre <[e-mail]> wrote:
> 
> 
> 
> On Wed, Oct 9, 2019 at 8:48 PM Joe Abley <[e-mail] <mailto:[e-mail]>> wrote:
> Hi Rob,
> 
> On 9 Oct 2019, at 09:40, Rob Sayre <[e-mail] <mailto:[e-mail]>> wrote:
> 
> >> So if it helps, consider "the IESG" as the charter proposal writers
> >> and "5 or 6 ADs" as the BoF proponents.
> > 
> > It does not help. Could those "5 or 6 ADs" put their names on the proposal?
> 
> Can you explain why this is important?
> 
> I don't mean to imply it's not; I'm just trying to understand your question.
> 
> You ask a totally fair question.
> 
> I think the charter is misguided and wrote that "a proposal that no one will put their name on doesn’t even deserve an argument." 
> 
> So, I just asked (again) whether someone would put their name on it.
> 
> thanks,
> Rob
> -- 
> Add mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/add