[DNSOP] Re: I-D Announcement: draft-teppo-corporate-authenticated-dns-02 - Authenticated DNS Resolution for Enterprise

[Ben Schwartz <[e-mail]>]

This sounds like it's essentially a repeat of draft-tjjk-cared.  I
recommend starting by talking to the authors of that draft and
reviewing some of the discussions about it.

--Ben Schwartz

On Thu, Jul 30, 2026 at 6:11 AM Ondřej Surý <[e-mail]> wrote:
>
> >
> Hi,
>
> the correct URL is: https://urldefense.com/v3/__https://datatracker.ietf.org/doc/draft-teppo-corporate-authenticated-dns/__;!!Bt8RZUm9aw!5bBdWkr4CjGLqRpUT-ZTxlNe8pZk-dM65JQChqp3IPUlO2tLnFyHopDs9SBgGVmkFby90O81gA$
>
> But I am going to ask a different question: How much of the draft has been generated using
> tools and not written by yourself?
>
> IETF and dnsop WG is now in process of drafting a policy, but I am 100% sure that we will
> require a full transparency about the tools used to generate the draft (similar to what other
> publishers currently have).
>
> Ondrej
> --
> Ondřej Surý (He/Him)
> [e-mail]
>
> A gentle nudge is always appreciated if I take a little longer to reply.
>
> > On 29. 7. 2026, at 20:09, Terry Teppo <[e-mail]> wrote:
> >
> > Hello DNSOP,
> >
> > I have submitted an Internet-Draft titled "Authenticated DNS Resolution (ADR) for Enterprise DNS" as an independent submission:
> >
> > https://urldefense.com/v3/__https://datatracker.ietf.org/doc/draft-teppo-corporate-authenticated-dns-00/__;!!Bt8RZUm9aw!5bBdWkr4CjGLqRpUT-ZTxlNe8pZk-dM65JQChqp3IPUlO2tLnFyHopDs9SBgGVmkFbzxUj7wYA$
> >
> > ADR proposes query-plane RBAC for enterprise DNS resolvers — controlling who may resolve DNS records at query time, bound to authenticated machine and user identity via Kerberos, X.509 client certificates, or OAuth/OIDC tokens.
> >
> > The motivation is a gap that existing mechanisms do not address: enterprises already authenticate DNS writes (RFC 2136, TSIG), restrict zone transfers, and block external queries, but reads remain open to any authenticated principal with network access to a resolver. A domain-joined workstation operated by a helpdesk technician can resolve router, firewall, and WAN transit records with no credentials and no audit trail. ADR completes the access control model enterprises have already been building by applying RBAC at query time.
> >
> > Key points:
> > - ADR carries identity in the transport layer (Kerberos, mTLS, DoH+OIDC) and does not modify DNS message format, opcodes, EDNS options, or resource record types
> > - Scoped strictly to enterprise private namespaces; no impact on Internet DNS, DNSSEC, or public resolvers
> > - Introduces AUTH-NXDOMAIN to distinguish "record does not exist" from "record exists but you lack permission"
> > - Fully compatible with DNSSEC; ADR resolvers validate before returning answers
> > - Supports incremental deployment alongside legacy unauthenticated DNS
> >
> > I searched the datatracker and found no prior drafts addressing query-plane DNS authorization. The draft includes a prior art section covering DNSSEC, AD-integrated DNS, split-horizon, DoT/DoH, mDNS, RFC 2136, TSIG, SIG(0), DNS Cookies, RPZ, DNS ACLs, and 802.1X/NAC.
> >
> > I would welcome feedback on technical gaps, pointers to related work I may have missed, or interoperability concerns. I am not requesting WG adoption at this stage but would welcome guidance if the WG has interest.
> >
> > Thank you for your time.
> > _______________________________________________
> > DNSOP mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
>
>
> _______________________________________________
> DNSOP mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]