Hello DNSOP, I have submitted an Internet-Draft titled "Authenticated DNS Resolution (ADR) for Enterprise DNS" as an independent submission:
https://datatracker.ietf.org/doc/draft-teppo-corporate-authenticated-dns-00/ ADR proposes query-plane RBAC for enterprise DNS resolvers — controlling who may resolve DNS records at query time, bound to authenticated machine and user identity via Kerberos, X.509 client certificates, or OAuth/OIDC tokens. The motivation is a gap that existing mechanisms do not address: enterprises already authenticate DNS writes (RFC 2136, TSIG), restrict zone transfers, and block external queries, but reads remain open to any authenticated principal with network access to a resolver. A domain-joined workstation operated by a helpdesk technician can resolve router, firewall, and WAN transit records with no credentials and no audit trail. ADR completes the access control model enterprises have already been building by applying RBAC at query time. Key points: - ADR carries identity in the transport layer (Kerberos, mTLS, DoH+OIDC) and does not modify DNS message format, opcodes, EDNS options, or resource record types - Scoped strictly to enterprise private namespaces; no impact on Internet DNS, DNSSEC, or public resolvers - Introduces AUTH-NXDOMAIN to distinguish "record does not exist" from "record exists but you lack permission" - Fully compatible with DNSSEC; ADR resolvers validate before returning answers - Supports incremental deployment alongside legacy unauthenticated DNS I searched the datatracker and found no prior drafts addressing query-plane DNS authorization. The draft includes a prior art section covering DNSSEC, AD-integrated DNS, split-horizon, DoT/DoH, mDNS, RFC 2136, TSIG, SIG(0), DNS Cookies, RPZ, DNS ACLs, and 802.1X/NAC. I would welcome feedback on technical gaps, pointers to related work I may have missed, or interoperability concerns. I am not requesting WG adoption at this stage but would welcome guidance if the WG has interest. Thank you for your time.
_______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
