Re: [Add] WG Adoption Call draft-reddy-add-enterprise-split-dns

[Andrew Campling <[e-mail]>]

I also agree that this is a valuable problem to solve and support adoption by the working group.

Andrew 

-----Original Message-----
From: Tommy Pauly <[e-mail]> 
Sent: 14 May 2022 00:25
To: Eliot Lear <[e-mail]>
Cc: Paul Wouters <[e-mail]>; [e-mail]; ADD Mailing list <[e-mail]>
Subject: Re: [Add] WG Adoption Call draft-reddy-add-enterprise-split-dns

I generally agree with this sentiment. I think this document needs refinement and a lot of discussion of the mechanisms, but this is a valuable problem to solve. I think this document represents one starting point, and as long as we’re willing to evolve the mechanisms based on the working group discussion, I support adoption.

Thanks,
Tommy

> On May 13, 2022, at 1:19 AM, Eliot Lear <[e-mail]> wrote:
> 
> Hi,
> 
> On 05.05.22 21:57, Paul Wouters wrote:
>> The only real solution I see is one similar to the IKEv2 split-DNS 
>> case, one where there is basically an authenticated and authorized 
>> provisioning step that enables the user to join an "enterprise network"
>> wich can demand all or a subnet of DNS traffic which the user is 
>> required to opt-in to. And even that is tricky when a user is kinda 
>> forced to accept to get any connectivity, say in a hotel or 
>> coffeeshop (or repressive regime)
> 
> I think you are aiming at the fundamental problem, Paul: is there a way for the user to decide who to trust.  Ben's pointed out the UX problems with answering that question.  For enterprise assets that clearly has to be the enterprise.  The only question really is how to bootstrap trust in the enterprise.  Any draft trying to address split DNS has to assume that has happened.  That part can't be in scope here.
> 
> What this or any draft has to do is be a bit clearer in stating that and then show how that bootstrapping of trust is leveraged to address split DNS, either via resolver selection at a gross or fine level, or through other means.  Right now I think it is trying to demonstrate that through multiple mechanisms, and that is what is making things rather hard to follow.  That's because there is no one-size-fits-all solution because enterprises come in many shapes and forms.  To some, leaking a modest amount of NS records is okay.  The pollution argument you raise is only relevant in as much as domains outside the enterprise control would be polluted.  If that's not the case, then it's a matter for an enterprise, and nobody else's business.
> 
> So I support adoption of this draft, but I do think it needs a lot more work to be clearer on the bootstrapping that is occurring.
> 
> Eliot
> 
> 
> <OpenPGP_0x87B66B46D9D27A33.asc>--
> Add mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/add