[DNSOP] Re: I-D Announcement: draft-teppo-corporate-authen ticated-dns-02 - Authenticated DNS Resolution for Enterprise
Ted Lemon <[email protected]> Thu, 30 Jul 2026 18:19:36 +0200
| Newsgroups | gmane.ietf.dnsop |
|---|---|
| Message-ID | <[email protected]> |
--===============3535127311109424019== Content-Type: multipart/alternative; boundary="Apple-Mail=_0D095B86-3E07-484B-874D-FD1DB6F2BBDF" --Apple-Mail=_0D095B86-3E07-484B-874D-FD1DB6F2BBDF Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Terry, I'm just a random participant here, so take this with a grain of = salt, but I'm not going to read the giant pile of slop you just dumped = on us. If you want people to pay attention to what you have to say, be = brief and succinct. Don't send us the output of an LLM=E2=80=94even if = you use the LLM, read its output yourself and send us the points you = consider important, in your own words. If these feels like not a good = use of your time, that's fine, but that should tell you something = important. Say there are 100 people reading this mailing list (a made up = number). If it's 1x not a good use of time for you to read and = summarize, it's 100x not a good use of time for us to read and try to = glean from the slop what is actually useful, because you have context we = don't have, so it's even harder for us than it is for you. > On Jul 30, 2026, at 18:00, Terry Teppo <[email protected]> = wrote: >=20 > Hi Ondrej, >=20 > Thanks for the question. >=20 > Short answer: Yes. The core concept, problem statement, architecture, = and all technical decisions in the draft are my work and reflect my = hands=E2=80=91on experience. I began diagramming and developing this = idea in 2023 after repeatedly observing DNS not being used because of = topology exposure issues during penetration tests and security reasons; = my first notable encounter with this issue was during a penetration test = in the early 2000's. I was talking with a network admin at a community = event last Friday; wherein, they confirmed the same reality: internal = DNS naming is avoided for fear of exposing network topology, and teams = use alternative tooling for operational needs like ITIL inventory = reporting and spreadsheets. These are the types of findings over decades = directly informed the problem framing and proposed design. >=20 > I used many AI=E2=80=91assisted tools during drafting for several = purposes, I did not track what AI did what sentence as it aways a cross = multiples, yet I want to be transparent about what they did and what I = did: >=20 > 1) **Prior=E2=80=91art discovery and literature search** =20 > - I used AI=E2=80=91assisted literature search to surface prior art = and RFC references. The tool(s) surfaced the vast majority of items in = the prior=E2=80=91art list (roughly 99%); I reviewed, curated, and = edited that list and added or removed items based on my domain = knowledge. Without that assistance the prior=E2=80=91art list would not = be as complete as it is today. >=20 > 2) **Reference verification and RFC validation support** =20 > - I used multiple AI tools to help assemble references and = citations, 99% these would not exist without them, > - I also used IETF authoring/validation tooling (including the = authoring tools and the validator checks). I iterated the draft until = it passed validation, spending several days (almost a month in total) = addressing validator flags and ensuring the draft met RFC formatting and = reference requirements. I sure there are typos there has to be. >=20 > 3) **Wording, structure, and editorial assistance** =20 > - I provided the technical narrative, diagrams, and architecture. = AI assistance helped translate that narrative into RFC structure and = concise wording flagging when I was not precise enough. Every AI = suggestion was reviewed; I removed or modified suggestions as I felt = appropriate to ensured technical accuracy. >=20 > 4) **Sanity checks / reality checks** =20 > - I used multiple AI=E2=80=91assisted tools as independent sanity = checks to confirm references, surface missing items, and flag potential = overlaps with existing work. These tools acted as fast search and = verification aids; the final decisions about inclusion, exclusion, and = interpretation were made by me. >=20 > 5) **Fundamental use of AI** > - No one AI in particular created entire sections alone. I always = feed everything an AI said to the other AI's and asked if it with was = truthful and correct multiple times. They do not agree all time. Thus, = I had to figure out what to actually say in the end; I may have made = mistakes in doing this but it is what it is. I may have taken the final = sentence from an AI but everything went through multiples. They helped = me with grammar, sentence structure, spelling and what does my sentence = actually say or mean. They helped organize to make sure I did not miss = sections. If all 3 tools said I need a section, I would debate with = myself should it be there. Example all three AI's want multiple = sections on audit logs, but I considered that operational not protocol. = I left some mentions of the audit logging in, so people understand it = should exist, but removed all the sections that describe it in detail. = I could remove all mention of audit logging. There are some MUST I not = 100% sure about, and very open to debate on them. Example: See this is = what it looks like if I not have help grammar. =20 >=20 > One more note on tooling: To reiterate, I used several different AI = tools and did not keep a per=E2=80=91suggestion audit mapping each = output to a specific tool, so I cannot precisely attribute every = suggested edit or reference to a particular tool after the fact. All = surfaced items were reviewed and curated by the me. If the WG requires a = precise mapping or the names of the specific tools used, I will provide = that in the disclosure. >=20 > **Technical scope note (brief):** this design enforces authentication = at the DNS query level within a managed trust domain by binding client = identity to queries and operating resolvers under enterprise control. = Because it requires per=E2=80=91client credentials, a managed identity = fabric, and tight operational control over caching and recursion, it is = intended for enterprise/internal deployments and not for the public = Internet. >=20 > If the WG prefers a formal disclosure, I will add a =E2=80=9CTools and = Contributions=E2=80=9D section to the draft that includes: > - a per=E2=80=91section provenance table indicating where AI = assistance was used and who reviewed each section, and =20 > - an annotated list of references showing which items were surfaced by = the AI's and which were added or removed by the author. >=20 > I can post an updated draft with that disclosure by **EOD Tuesday, = 2026=E2=80=9108=E2=80=9114** (or sooner if the WG prefers). If the WG = requires the names of the specific tools used, I will provide them in = the disclosure; otherwise I=E2=80=99ve described the role the tools = played and the human review process. >=20 > If you or the WG would like the detailed list of references the AI = surfaced (or a section=E2=80=91by=E2=80=91section breakdown), I can = provide that as well. >=20 > Regards, =20 > Terry Teppo =20 >=20 > IT is what we do because IT is fun. >=20 >=20 > From: Ond=C5=99ej Sur=C3=BD <[email protected] <mailto:[email protected]>> > Sent: Thursday, July 30, 2026 5:09 AM > To: Terry Teppo <[email protected] = <mailto:[email protected]>> > Cc: [email protected] <mailto:[email protected]> <[email protected] = <mailto:[email protected]>> > Subject: Re: [DNSOP] I-D Announcement: = draft-teppo-corporate-authenticated-dns-02 - Authenticated DNS = Resolution for Enterprise >=20 > Hi, >=20 > the correct URL is: = https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fdatatra= cker.ietf.org%2Fdoc%2Fdraft-teppo-corporate-authenticated-dns%2F&data=3D05= %7C02%7C%7Cdcee0ed3424844e0f7e808deee22bb15%7C84df9e7fe9f640afb435aaaaaaaa= aaaa%7C1%7C0%7C639210030101080871%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGki= OnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%= 3D%7C0%7C%7C%7C&sdata=3DnMJqZv5QHducGv8%2Bcya%2FkgLXywRDNdlFyS%2FUhf%2FKcE= Q%3D&reserved=3D0 = <https://datatracker.ietf.org/doc/draft-teppo-corporate-authenticated-dns/= > >=20 > But I am going to ask a different question: How much of the draft has = been generated using > tools and not written by yourself? >=20 > IETF and dnsop WG is now in process of drafting a policy, but I am = 100% sure that we will > require a full transparency about the tools used to generate the draft = (similar to what other > publishers currently have). >=20 > Ondrej > -- > Ond=C5=99ej Sur=C3=BD (He/Him) > [email protected] <mailto:[email protected]> >=20 > A gentle nudge is always appreciated if I take a little longer to = reply. >=20 > > On 29. 7. 2026, at 20:09, Terry Teppo <[email protected] = <mailto:[email protected]>> wrote: > > > > Hello DNSOP, > > > > I have submitted an Internet-Draft titled "Authenticated DNS = Resolution (ADR) for Enterprise DNS" as an independent submission: > > > > = https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fdatatra= cker.ietf.org%2Fdoc%2Fdraft-teppo-corporate-authenticated-dns-00%2F&data=3D= 05%7C02%7C%7Cdcee0ed3424844e0f7e808deee22bb15%7C84df9e7fe9f640afb435aaaaaa= aaaaaa%7C1%7C0%7C639210030101124525%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcG= kiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3= D%3D%7C0%7C%7C%7C&sdata=3DhChttlSz6ojuMGwxscENG8Y3B1R08AtLywccSTwwC5o%3D&r= eserved=3D0 = <https://datatracker.ietf.org/doc/draft-teppo-corporate-authenticated-dns-= 00/> > > > > ADR proposes query-plane RBAC for enterprise DNS resolvers =E2=80=94 = controlling who may resolve DNS records at query time, bound to = authenticated machine and user identity via Kerberos, X.509 client = certificates, or OAuth/OIDC tokens. > > > > The motivation is a gap that existing mechanisms do not address: = enterprises already authenticate DNS writes (RFC 2136, TSIG), restrict = zone transfers, and block external queries, but reads remain open to any = authenticated principal with network access to a resolver. A = domain-joined workstation operated by a helpdesk technician can resolve = router, firewall, and WAN transit records with no credentials and no = audit trail. ADR completes the access control model enterprises have = already been building by applying RBAC at query time. > > > > Key points: > > - ADR carries identity in the transport layer (Kerberos, mTLS, = DoH+OIDC) and does not modify DNS message format, opcodes, EDNS options, = or resource record types > > - Scoped strictly to enterprise private namespaces; no impact on = Internet DNS, DNSSEC, or public resolvers > > - Introduces AUTH-NXDOMAIN to distinguish "record does not exist" = from "record exists but you lack permission" > > - Fully compatible with DNSSEC; ADR resolvers validate before = returning answers > > - Supports incremental deployment alongside legacy unauthenticated = DNS > > > > I searched the datatracker and found no prior drafts addressing = query-plane DNS authorization. The draft includes a prior art section = covering DNSSEC, AD-integrated DNS, split-horizon, DoT/DoH, mDNS, RFC = 2136, TSIG, SIG(0), DNS Cookies, RPZ, DNS ACLs, and 802.1X/NAC. > > > > I would welcome feedback on technical gaps, pointers to related work = I may have missed, or interoperability concerns. I am not requesting WG = adoption at this stage but would welcome guidance if the WG has = interest. > > > > Thank you for your time. > > _______________________________________________ > > DNSOP mailing list -- [email protected] <mailto:[email protected]> > > To unsubscribe send an email to [email protected] = <mailto:[email protected]> >=20 >=20 > _______________________________________________ > DNSOP mailing list -- [email protected] <mailto:[email protected]> > To unsubscribe send an email to [email protected] = <mailto:[email protected]> --Apple-Mail=_0D095B86-3E07-484B-874D-FD1DB6F2BBDF Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html aria-label=3D"message body"><head><meta http-equiv=3D"content-type" = content=3D"text/html; charset=3Dutf-8"></head><body = style=3D"overflow-wrap: break-word; -webkit-nbsp-mode: space; = line-break: after-white-space;">Terry, I'm just a random participant = here, so take this with a grain of salt, but I'm not going to read the = giant pile of slop you just dumped on us. If you want people to pay = attention to what you have to say, be brief and succinct. Don't send us = the output of an LLM=E2=80=94even if you use the LLM, read its output = yourself and send us the points you consider important, in your own = words. If these feels like not a good use of your time, that's fine, but = that should tell you something important. Say there are 100 people = reading this mailing list (a made up number). If it's 1x not a good use = of time for you to read and summarize, it's 100x not a good use of time = for us to read and try to glean from the slop what is actually useful, = because you have context we don't have, so it's even harder for us than = it is for you.<br = id=3D"lineBreakAtBeginningOfMessage"><div><br><blockquote = type=3D"cite"><div>On Jul 30, 2026, at 18:00, Terry Teppo = <[email protected]> wrote:</div><br = class=3D"Apple-interchange-newline"><div><meta charset=3D"UTF-8"><div = style=3D"font-style: normal; font-variant-caps: normal; font-weight: = 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: = 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: = 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;">Hi Ondrej,</div><div = style=3D"font-style: normal; font-variant-caps: normal; font-weight: = 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: = 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: = 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;"><br></div><div = style=3D"font-style: normal; font-variant-caps: normal; font-weight: = 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: = 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: = 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;">Thanks for the = question.</div><div style=3D"font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; orphans: 2; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; font-family: Calibri, Helvetica, sans-serif; = font-size: 12pt;"><br></div><div style=3D"font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;">Short answer: Yes. The = core concept, problem statement, architecture, and all technical = decisions in the draft are my work and reflect my hands=E2=80=91on = experience. I began diagramming and developing this idea in 2023 after = repeatedly observing DNS not being used because of topology exposure = issues during penetration tests and security reasons; my first notable = encounter with this issue was during a penetration test in the early = 2000's. I was talking with a network admin at a community event = last Friday; wherein, they confirmed the same reality: internal DNS = naming is avoided for fear of exposing network topology, and teams use = alternative tooling for operational needs like ITIL inventory reporting = and spreadsheets. These are the types of findings over decades directly = informed the problem framing and proposed design.</div><div = style=3D"font-style: normal; font-variant-caps: normal; font-weight: = 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: = 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: = 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;"><br></div><div = style=3D"font-style: normal; font-variant-caps: normal; font-weight: = 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: = 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: = 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;">I used many = AI=E2=80=91assisted tools during drafting for several purposes, I did = not track what AI did what sentence as it aways a cross multiples, yet I = want to be transparent about what they did and what I did:</div><div = style=3D"font-style: normal; font-variant-caps: normal; font-weight: = 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: = 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: = 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;"><br></div><div = style=3D"font-style: normal; font-variant-caps: normal; font-weight: = 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: = 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: = 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;">1) **Prior=E2=80=91art = discovery and literature search** </div><div style=3D"font-style: = normal; font-variant-caps: normal; font-weight: 400; letter-spacing: = normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: = none; white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;"> - I used = AI=E2=80=91assisted literature search to surface prior art and RFC = references. The tool(s) surfaced the vast majority of items in the = prior=E2=80=91art list (roughly 99%); I reviewed, curated, and edited = that list and added or removed items based on my domain knowledge. = Without that assistance the prior=E2=80=91art list would not be as = complete as it is today.</div><div style=3D"font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;"><br></div><div = style=3D"font-style: normal; font-variant-caps: normal; font-weight: = 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: = 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: = 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;">2) **Reference = verification and RFC validation support** </div><div = style=3D"font-style: normal; font-variant-caps: normal; font-weight: = 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: = 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: = 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;"> - I used = multiple AI tools to help assemble references and citations, 99% these = would not exist without them,</div><div style=3D"font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;"> - I also = used IETF authoring/validation tooling (including the authoring tools = and the validator checks). I iterated the draft until it passed = validation, spending several days (almost a month in total) addressing = validator flags and ensuring the draft met RFC formatting and reference = requirements. I sure there are typos there has to be.</div><div = style=3D"font-style: normal; font-variant-caps: normal; font-weight: = 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: = 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: = 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;"><br></div><div = style=3D"font-style: normal; font-variant-caps: normal; font-weight: = 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: = 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: = 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;">3) **Wording, = structure, and editorial assistance** </div><div = style=3D"font-style: normal; font-variant-caps: normal; font-weight: = 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: = 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: = 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;"> - I = provided the technical narrative, diagrams, and architecture. AI = assistance helped translate that narrative into RFC structure and = concise wording flagging when I was not precise enough. Every AI = suggestion was reviewed; I removed or modified suggestions as I felt = appropriate to ensured technical accuracy.</div><div style=3D"font-style: = normal; font-variant-caps: normal; font-weight: 400; letter-spacing: = normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: = none; white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;"><br></div><div = style=3D"font-style: normal; font-variant-caps: normal; font-weight: = 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: = 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: = 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;">4) **Sanity checks / = reality checks** </div><div style=3D"font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;"> - I used = multiple AI=E2=80=91assisted tools as independent sanity checks to = confirm references, surface missing items, and flag potential overlaps = with existing work. These tools acted as fast search and verification = aids; the final decisions about inclusion, exclusion, and interpretation = were made by me.</div><div style=3D"font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;"><br></div><div = style=3D"font-style: normal; font-variant-caps: normal; font-weight: = 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: = 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: = 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;">5) **Fundamental = use of AI**</div><div style=3D"font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; orphans: 2; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; font-family: Calibri, Helvetica, sans-serif; = font-size: 12pt;"> - No one AI in particular created entire = sections alone. I always feed everything an AI said to the other = AI's and asked if it with was truthful and correct multiple times. = They do not agree all time. Thus, I had to figure out what = to actually say in the end; I may have made mistakes in doing this = but it is what it is. I may have taken the final sentence from an = AI but everything went through multiples. They helped me with = grammar, sentence structure, spelling and what does my sentence actually = say or mean. They helped organize to make sure I did not miss = sections. If all 3 tools said I need a section, I would debate = with myself should it be there. Example all three AI's want = multiple sections on audit logs, but I considered that operational not = protocol. I left some mentions of the audit logging in, so people = understand it should exist, but removed all the sections that describe = it in detail. I could remove all mention of audit logging. = There are some MUST I not 100% sure about, and very open to debate on = them. Example: See this is what it looks like if I not have help = grammar. </div><div style=3D"font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;"><br></div><div = style=3D"font-style: normal; font-variant-caps: normal; font-weight: = 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: = 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: = 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;">One more note on = tooling: To reiterate, I used several different AI tools and did not = keep a per=E2=80=91suggestion audit mapping each output to a specific = tool, so I cannot precisely attribute every suggested edit or reference = to a particular tool after the fact. All surfaced items were = reviewed and curated by the me. If the WG requires a precise mapping or = the names of the specific tools used, I will provide that in the = disclosure.</div><div style=3D"font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; orphans: 2; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; font-family: Calibri, Helvetica, sans-serif; = font-size: 12pt;"><br></div><div style=3D"font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;">**Technical scope note = (brief):** this design enforces authentication at the DNS query level = within a managed trust domain by binding client identity to queries and = operating resolvers under enterprise control. Because it requires = per=E2=80=91client credentials, a managed identity fabric, and tight = operational control over caching and recursion, it is intended for = enterprise/internal deployments and not for the public = Internet.</div><div style=3D"font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; orphans: 2; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; font-family: Calibri, Helvetica, sans-serif; = font-size: 12pt;"><br></div><div style=3D"font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;">If the WG prefers a = formal disclosure, I will add a =E2=80=9CTools and Contributions=E2=80=9D = section to the draft that includes:</div><div style=3D"font-style: = normal; font-variant-caps: normal; font-weight: 400; letter-spacing: = normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: = none; white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;">- a per=E2=80=91section = provenance table indicating where AI assistance was used and who = reviewed each section, and </div><div style=3D"font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;">- an annotated list of = references showing which items were surfaced by the AI's and which were = added or removed by the author.</div><div style=3D"font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;"><br></div><div = style=3D"font-style: normal; font-variant-caps: normal; font-weight: = 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: = 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: = 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;">I can post an updated = draft with that disclosure by **EOD Tuesday, 2026=E2=80=9108=E2=80=9114** = (or sooner if the WG prefers). If the WG requires the names of the = specific tools used, I will provide them in the disclosure; otherwise = I=E2=80=99ve described the role the tools played and the human review = process.</div><div style=3D"font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; orphans: 2; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; font-family: Calibri, Helvetica, sans-serif; = font-size: 12pt;"><br></div><div style=3D"font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;">If you or the WG would = like the detailed list of references the AI surfaced (or a = section=E2=80=91by=E2=80=91section breakdown), I can provide that as = well.</div><div style=3D"font-style: normal; font-variant-caps: normal; = font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; widows: 2; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; font-family: Calibri, Helvetica, sans-serif; font-size: = 12pt;"><br></div><div style=3D"font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; orphans: 2; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; font-family: Calibri, Helvetica, sans-serif; = font-size: 12pt;">Regards, </div><div style=3D"font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Helvetica, sans-serif; font-size: 12pt;">Terry Teppo = </div><div style=3D"font-style: normal; font-variant-caps: normal; = font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; widows: 2; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; font-family: Calibri, Helvetica, sans-serif; font-size: = 12pt;"><br></div><div style=3D"font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; orphans: 2; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; font-family: Calibri, Helvetica, sans-serif; = font-size: 12pt;">IT is what we do because IT is fun.</div><div = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 14px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;"><br></div><div = style=3D"font-style: normal; font-variant-caps: normal; font-weight: = 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: = 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: = 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;"><br></div><hr = style=3D"font-family: Helvetica; font-size: 14px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; display: = inline-block; width: 1175.015625px;"><span style=3D"caret-color: rgb(0, = 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;"></span><div style=3D"font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Arial, Helvetica, sans-serif; font-size: = 12pt;"><b>From:</b><span = class=3D"Apple-converted-space"> </span>Ond=C5=99ej Sur=C3=BD = <<a = href=3D"mailto:[email protected]">[email protected]</a>><br><b>Sent:</b><sp= an class=3D"Apple-converted-space"> </span>Thursday, July 30, 2026 = 5:09 AM<br><b>To:</b><span = class=3D"Apple-converted-space"> </span>Terry Teppo <<a = href=3D"mailto:[email protected]">[email protected]</a>&= gt;<br><b>Cc:</b><span class=3D"Apple-converted-space"> </span><a = href=3D"mailto:[email protected]">[email protected]</a><span = class=3D"Apple-converted-space"> </span><<a = href=3D"mailto:[email protected]">[email protected]</a>><br><b>Subject:</b><s= pan class=3D"Apple-converted-space"> </span>Re: [DNSOP] I-D = Announcement: draft-teppo-corporate-authenticated-dns-02 - Authenticated = DNS Resolution for Enterprise</div><div style=3D"font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;"><br></div><div = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-style: = normal; font-variant-caps: normal; font-weight: 400; letter-spacing: = normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: = none; white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; font-size: = 11pt;">Hi,<br><br>the correct URL is:<span = class=3D"Apple-converted-space"> </span><a = href=3D"https://datatracker.ietf.org/doc/draft-teppo-corporate-authenticat= ed-dns/" id=3D"OWAdf8bb176-ca3f-a85c-17c9-3600ddd88997" = class=3D"OWAAutoLink" = data-auth=3D"NotApplicable">https://na01.safelinks.protection.outlook.com/= ?url=3Dhttps%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-teppo-corporate-au= thenticated-dns%2F&data=3D05%7C02%7C%7Cdcee0ed3424844e0f7e808deee22bb1= 5%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C639210030101080871%7CUnknow= n%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMi= IsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=3DnMJqZv5QHducGv= 8%2Bcya%2FkgLXywRDNdlFyS%2FUhf%2FKcEQ%3D&reserved=3D0</a><br><br>But = I am going to ask a different question: How much of the draft has been = generated using<br>tools and not written by yourself?<br><br>IETF and = dnsop WG is now in process of drafting a policy, but I am 100% sure that = we will<br>require a full transparency about the tools used to generate = the draft (similar to what other<br>publishers currently = have).<br><br>Ondrej<br>--<br>Ond=C5=99ej Sur=C3=BD (He/Him)<br><a = href=3D"mailto:[email protected]">[email protected]</a><br><br>A gentle = nudge is always appreciated if I take a little longer to = reply.<br><br>> On 29. 7. 2026, at 20:09, Terry Teppo <<a = href=3D"mailto:[email protected]">[email protected]</a>&= gt; wrote:<br>><br>> Hello DNSOP,<br>><br>> I have submitted = an Internet-Draft titled "Authenticated DNS Resolution (ADR) for = Enterprise DNS" as an independent submission:<br>><br>><span = class=3D"Apple-converted-space"> </span><a = href=3D"https://datatracker.ietf.org/doc/draft-teppo-corporate-authenticat= ed-dns-00/" id=3D"OWAd4c54737-bead-db1e-7fcf-5ac47aa92102" = class=3D"OWAAutoLink" = data-auth=3D"NotApplicable">https://na01.safelinks.protection.outlook.com/= ?url=3Dhttps%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-teppo-corporate-au= thenticated-dns-00%2F&data=3D05%7C02%7C%7Cdcee0ed3424844e0f7e808deee22= bb15%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C639210030101124525%7CUnk= nown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4= zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=3DhChttlSz6oj= uMGwxscENG8Y3B1R08AtLywccSTwwC5o%3D&reserved=3D0</a><br>><br>> = ADR proposes query-plane RBAC for enterprise DNS resolvers =E2=80=94 = controlling who may resolve DNS records at query time, bound to = authenticated machine and user identity via Kerberos, X.509 client = certificates, or OAuth/OIDC tokens.<br>><br>> The motivation is a = gap that existing mechanisms do not address: enterprises already = authenticate DNS writes (RFC 2136, TSIG), restrict zone transfers, and = block external queries, but reads remain open to any authenticated = principal with network access to a resolver. A domain-joined workstation = operated by a helpdesk technician can resolve router, firewall, and WAN = transit records with no credentials and no audit trail. ADR completes = the access control model enterprises have already been building by = applying RBAC at query time.<br>><br>> Key points:<br>> - ADR = carries identity in the transport layer (Kerberos, mTLS, DoH+OIDC) and = does not modify DNS message format, opcodes, EDNS options, or resource = record types<br>> - Scoped strictly to enterprise private namespaces; = no impact on Internet DNS, DNSSEC, or public resolvers<br>> - = Introduces AUTH-NXDOMAIN to distinguish "record does not exist" from = "record exists but you lack permission"<br>> - Fully compatible with = DNSSEC; ADR resolvers validate before returning answers<br>> - = Supports incremental deployment alongside legacy unauthenticated = DNS<br>><br>> I searched the datatracker and found no prior drafts = addressing query-plane DNS authorization. The draft includes a prior art = section covering DNSSEC, AD-integrated DNS, split-horizon, DoT/DoH, = mDNS, RFC 2136, TSIG, SIG(0), DNS Cookies, RPZ, DNS ACLs, and = 802.1X/NAC.<br>><br>> I would welcome feedback on technical gaps, = pointers to related work I may have missed, or interoperability = concerns. I am not requesting WG adoption at this stage but would = welcome guidance if the WG has interest.<br>><br>> Thank you for = your time.<br>> = _______________________________________________<br>> DNSOP mailing = list --<span class=3D"Apple-converted-space"> </span><a = href=3D"mailto:[email protected]">[email protected]</a><br>> To unsubscribe = send an email to<span class=3D"Apple-converted-space"> </span><a = href=3D"mailto:[email protected]">[email protected]</a><br><br><br><= /div><span style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; = font-size: 14px; font-style: normal; font-variant-caps: normal; = font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; widows: 2; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; float: none; display: inline = !important;">_______________________________________________</span><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 14px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;"><span = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 14px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;">DNSOP mailing list --<span = class=3D"Apple-converted-space"> </span></span><a = href=3D"mailto:[email protected]" style=3D"font-family: Helvetica; = font-size: 14px; font-style: normal; font-variant-caps: normal; = font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; widows: 2; = word-spacing: 0px; -webkit-text-stroke-width: = 0px;">[email protected]</a><br style=3D"caret-color: rgb(0, 0, 0); = font-family: Helvetica; font-size: 14px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;"><span = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 14px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;">To unsubscribe send an email to<span = class=3D"Apple-converted-space"> </span></span><a = href=3D"mailto:[email protected]" style=3D"font-family: Helvetica; = font-size: 14px; font-style: normal; font-variant-caps: normal; = font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; widows: 2; = word-spacing: 0px; -webkit-text-stroke-width: = 0px;">[email protected]</a></div></blockquote></div><br></body></html>= --Apple-Mail=_0D095B86-3E07-484B-874D-FD1DB6F2BBDF-- --===============3535127311109424019== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KRE5TT1AgbWFp bGluZyBsaXN0IC0tIGRuc29wQGlldGYub3JnClRvIHVuc3Vic2NyaWJlIHNlbmQgYW4gZW1haWwg dG8gZG5zb3AtbGVhdmVAaWV0Zi5vcmcK --===============3535127311109424019==--