Re: [IPsec] Spencer Dawkins' No Objection on draft-ietf-ipsecme-split-dns-14: (with COMMENT)

[Paul Wouters <[e-mail]>]

On Wed, 21 Nov 2018, Paul Wouters wrote:

> I think you are right, and we are mixing up INTERNAL_IP4_DNS with
> INTERNAL_DNS_DOMAIN.
>
> the idea is that the client can decide to not only use some
> authoritative internal servers, but also use some recursive internal
> servers. But I think those should be specified in the exiting
> INTERNAL_IP4_DNS / INTERNAL_IP6_DNS attributes.

Actually, that does not work. The current specification does not allow
a INTERNAL_IP4_DNS or INTERNAL_IP6_DNS to be associated with only some
(or none) of the INTERNAL_DNS_DOMAINS.

> I suggest we change the above to:
>
>   A client using these configuration payloads will be able to request
>    and receive Split DNS configurations using the INTERNAL_DNS_DOMAIN
>    and INTERNAL_DNSSEC_TA configuration attributes.  The client device
>    can use the internal DNS server(s) for any DNS queries within the
>    assigned domains.  DNS queries for other domains MAY be sent to
>    an internal recursive DNS server specified in an INTERNAL_IP4_DNS
>    or INTERNAL_IP6_DNS Configuration Payload but MAY also be resolved
>    using the client's regular DNS resolving mechanisms outside of the
>    IPsec connection.

So I suggest instead:

    A client using these configuration payloads will be able to request
    and receive Split DNS configurations using the INTERNAL_DNS_DOMAIN
    and INTERNAL_DNSSEC_TA configuration attributes.  These attributes
    MUST be accompanied by one or more INTERNAL_IP4_DNS or
    INTERNAL_IP6_DNS configuration attributes.  The client device can
    then use the internal DNS server(s) for any DNS queries within the
    assigned domains.  DNS queries for other domains MUST be sent to the
    regular DNS service of the client.

Paul