[dnssd] DNS UPDATE access control in DNS-SD

[Matthias-Christian Ott <[e-mail]>]

Using DNS UPDATE for updating DNS-SD and SRV RRs in general requires
multiple hosts to be able to update a shared domain name. If you want to
limit the damage of a single host to itself, a DNS server that handles
updates for the domain name would have to examine the RDATA section in
order to decide whether to allow an update or not.

Assume for example that there a two hosts a.example.com. and
b.example.com. Both hosts provide IMAP services and therefore would need
to be able to update RRs _imap._tcp.example.com. (either PTR RRs or SRV
RRs depening on whether you use DNS-SD or plain SRV RRs). If you grant
both hosts access to update _imap._tcp.example.com. and the update
credentials (TSIG or SIG(0) key) of one of the hosts is compromised, it
would be possible to remove the other host from _imap._tcp.example.com.
and therefore to deny service for that host.

Besides that I'm not aware of any DNS server that would support
examining the DNS RDATA section (not even even the "external" access
control mechanism of BIND does).

Was that a scenario that was considered in the architecture of DNS-SD?
Is there a way to handle this scenario without examining the RDATA section?

- Matthias-Christian