Re: [IPsec] Spencer Dawkins' No Objection on draft-ietf-ipsecme-split-dns-14: (with COMMENT)

[Paul Wouters <[e-mail]>]

On Tue, 20 Nov 2018, Spencer Dawkins wrote:

> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
>
> Perhaps it would be helpful to give an example of why
>
>  A client using these configuration payloads will be able to request
>   and receive Split DNS configurations using the INTERNAL_DNS_DOMAIN
>   and INTERNAL_DNSSEC_TA configuration attributes.  The client device
>   can use the internal DNS server(s) for any DNS queries within the
>   assigned domains.  DNS queries for other domains SHOULD be sent to
>   the regular external DNS server.
>
> DNS queries for other domains might not be sent to the regular external DNS
> server? I'm thinking of one, but I'm flat-out guessing.

I think you are right, and we are mixing up INTERNAL_IP4_DNS with
INTERNAL_DNS_DOMAIN.

the idea is that the client can decide to not only use some
authoritative internal servers, but also use some recursive internal
servers. But I think those should be specified in the exiting
INTERNAL_IP4_DNS / INTERNAL_IP6_DNS attributes.

I suggest we change the above to:

   A client using these configuration payloads will be able to request
    and receive Split DNS configurations using the INTERNAL_DNS_DOMAIN
    and INTERNAL_DNSSEC_TA configuration attributes.  The client device
    can use the internal DNS server(s) for any DNS queries within the
    assigned domains.  DNS queries for other domains MAY be sent to
    an internal recursive DNS server specified in an INTERNAL_IP4_DNS
    or INTERNAL_IP6_DNS Configuration Payload but MAY also be resolved
    using the client's regular DNS resolving mechanisms outside of the
    IPsec connection.

Tommy, let me know what you think about this change?

Paul