[DNSOP] I-D Announcement: draft-teppo-corporate-authenticate d-dns-02 - Authenticated DNS Resolution for Enterprise
Terry Teppo <[email protected]> Wed, 29 Jul 2026 18:09:18 +0000
| Newsgroups | gmane.ietf.dnsop |
|---|---|
| Message-ID | <PH7PR10MB5771CF4843F4A95046DD0E18C9CA2@PH7PR10MB5771.namprd10.prod.outlook.com> |
--===============8947802095984890529==
Content-Language: en-US
Content-Type: multipart/alternative;
boundary="_000_PH7PR10MB5771CF4843F4A95046DD0E18C9CA2PH7PR10MB5771namp_"
--_000_PH7PR10MB5771CF4843F4A95046DD0E18C9CA2PH7PR10MB5771namp_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
Hello DNSOP,
I have submitted an Internet-Draft titled "Authenticated DNS Resolution (AD=
R) for Enterprise DNS" as an independent submission:
https://datatracker.ietf.org/doc/draft-teppo-corporate-authenticated-dns-00=
/
ADR proposes query-plane RBAC for enterprise DNS resolvers =97 controlling =
who may resolve DNS records at query time, bound to authenticated machine a=
nd user identity via Kerberos, X.509 client certificates, or OAuth/OIDC tok=
ens.
The motivation is a gap that existing mechanisms do not address: enterprise=
s already authenticate DNS writes (RFC 2136, TSIG), restrict zone transfers=
, and block external queries, but reads remain open to any authenticated pr=
incipal with network access to a resolver. A domain-joined workstation oper=
ated by a helpdesk technician can resolve router, firewall, and WAN transit=
records with no credentials and no audit trail. ADR completes the access c=
ontrol model enterprises have already been building by applying RBAC at que=
ry time.
Key points:
- ADR carries identity in the transport layer (Kerberos, mTLS, DoH+OIDC) an=
d does not modify DNS message format, opcodes, EDNS options, or resource re=
cord types
- Scoped strictly to enterprise private namespaces; no impact on Internet D=
NS, DNSSEC, or public resolvers
- Introduces AUTH-NXDOMAIN to distinguish "record does not exist" from "rec=
ord exists but you lack permission"
- Fully compatible with DNSSEC; ADR resolvers validate before returning ans=
wers
- Supports incremental deployment alongside legacy unauthenticated DNS
I searched the datatracker and found no prior drafts addressing query-plane=
DNS authorization. The draft includes a prior art section covering DNSSEC,=
AD-integrated DNS, split-horizon, DoT/DoH, mDNS, RFC 2136, TSIG, SIG(0), D=
NS Cookies, RPZ, DNS ACLs, and 802.1X/NAC.
I would welcome feedback on technical gaps, pointers to related work I may =
have missed, or interoperability concerns. I am not requesting WG adoption =
at this stage but would welcome guidance if the WG has interest.
Thank you for your time.
--_000_PH7PR10MB5771CF4843F4A95046DD0E18C9CA2PH7PR10MB5771namp_
Content-Type: text/html; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1=
252">
<style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo=
ttom:0;} </style>
</head>
<body dir=3D"ltr">
<div class=3D"elementToProof" style=3D"font-family: Calibri, Helvetica, san=
s-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hello DNSOP,</div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
I have submitted an Internet-Draft titled "Authenticated DNS Resolutio=
n (ADR) for Enterprise DNS" as an independent submission:</div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
https://datatracker.ietf.org/doc/draft-teppo-corporate-authenticated-dns-00=
/</div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
ADR proposes query-plane RBAC for enterprise DNS resolvers =97 controlling =
who may resolve DNS records at query time, bound to authenticated machine a=
nd user identity via Kerberos, X.509 client certificates, or OAuth/OIDC tok=
ens.</div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
The motivation is a gap that existing mechanisms do not address: enterprise=
s already authenticate DNS writes (RFC 2136, TSIG), restrict zone transfers=
, and block external queries, but reads remain open to any authenticated pr=
incipal with network access to a
resolver. A domain-joined workstation operated by a helpdesk technician ca=
n resolve router, firewall, and WAN transit records with no credentials and=
no audit trail. ADR completes the access control model enterprises have al=
ready been building by applying
RBAC at query time.</div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
Key points:</div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
- ADR carries identity in the transport layer (Kerberos, mTLS, DoH+OIDC) an=
d does not modify DNS message format, opcodes, EDNS options, or resource re=
cord types</div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
- Scoped strictly to enterprise private namespaces; no impact on Internet D=
NS, DNSSEC, or public resolvers</div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
- Introduces AUTH-NXDOMAIN to distinguish "record does not exist"=
from "record exists but you lack permission"</div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
- Fully compatible with DNSSEC; ADR resolvers validate before returning ans=
wers</div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
- Supports incremental deployment alongside legacy unauthenticated DNS</div=
>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
I searched the datatracker and found no prior drafts addressing query-plane=
DNS authorization. The draft includes a prior art section covering DNSSEC,=
AD-integrated DNS, split-horizon, DoT/DoH, mDNS, RFC 2136, TSIG, SIG(0), D=
NS Cookies, RPZ, DNS ACLs, and 802.1X/NAC.</div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
I would welcome feedback on technical gaps, pointers to related work I may =
have missed, or interoperability concerns. I am not requesting WG adoption =
at this stage but would welcome guidance if the WG has interest.</div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
Thank you for your time.</div>
</body>
</html>
--_000_PH7PR10MB5771CF4843F4A95046DD0E18C9CA2PH7PR10MB5771namp_--
--===============8947802095984890529==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KRE5TT1AgbWFp
bGluZyBsaXN0IC0tIGRuc29wQGlldGYub3JnClRvIHVuc3Vic2NyaWJlIHNlbmQgYW4gZW1haWwg
dG8gZG5zb3AtbGVhdmVAaWV0Zi5vcmcK
--===============8947802095984890529==--