Subject: [IPsec] I-D Action: draft-ietf-ipsecme-split-dns-10.txt

From: [email-masked]
Date: Wed, 18 Jul 2018 13:26:42 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the IP Security Maintenance and Extensions WG of the IETF.

        Title           : Split DNS Configuration for IKEv2
        Authors         : Tommy Pauly
                          Paul Wouters
	Filename        : draft-ietf-ipsecme-split-dns-10.txt
	Pages           : 13
	Date            : 2018-07-18

Abstract:
   This document defines two Configuration Payload Attribute Types for
   the IKEv2 protocol that add support for private DNS domains.  These
   domains are intended to be resolved using DNS servers reachable
   through an IPsec connection, while leaving all other DNS resolution
   unchanged.  This approach of resolving a subset of domains using non-
   public DNS servers is referred to as "Split DNS".

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-ipsecme-split-dns/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-ipsecme-split-dns-10
https://datatracker.ietf.org/doc/html/draft-ietf-ipsecme-split-dns-10

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-ipsecme-split-dns-10

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Tommy Pauly <[email-masked]>
Date: Wed, 18 Jul 2018 16:28:30 -0400

Hello all,

This new rev of the Split DNS document includes the feedback from our WG discussion today for handling of the DNSSEC domain whitelist.

Please take a look! The document should be ready to progress at this point.

Best,
Tommy

> On Jul 18, 2018, at 4:26 PM, [email-masked] wrote:
> 
> 
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec

---

From: "Waltermire, David A. (Fed)" <[email-masked]>
Date: Wed, 18 Jul 2018 20:35:13 +0000

I think the two "may" entries and the "should" in the following sentence should be capitalized.

Regards,

Dave

________________________________
From: IPsec <[email-masked]> on behalf of Tommy Pauly <[email-masked]>
Sent: Wednesday, July 18, 2018 4:28:30 PM
To: IPsecME WG; Eric Rescorla
Subject: Re: [IPsec] I-D Action: draft-ietf-ipsecme-split-dns-10.txt

Hello all,

Best,
Tommy

> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-ipsecme-split-dns%2F&amp;data=02%7C01%7Cdavid.waltermire%40nist.gov%7Cff7ef1c6c1be4bdf912608d5eced14e3%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C636675425355607080&amp;sdata=k%2F6Juy9hDJucBOTXoJgrwBeVfzw6iL3JcOsH1oP%2F4rk%3D&amp;reserved=0
>
> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-ietf-ipsecme-split-dns-10&amp;data=02%7C01%7Cdavid.waltermire%40nist.gov%7Cff7ef1c6c1be4bdf912608d5eced14e3%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C636675425355607080&amp;sdata=anQJZuOh9jiwQY0DRjnkJF9t6rwoKUnCTkTtGD4pRjI%3D&amp;reserved=0
> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-ipsecme-split-dns-10&amp;data=02%7C01%7Cdavid.waltermire%40nist.gov%7Cff7ef1c6c1be4bdf912608d5eced14e3%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C636675425355607080&amp;sdata=3%2FHdtPgHVzi%2B1gXSLO7m029WGCUJM2p0w940mZ8uH4I%3D&amp;reserved=0
>
> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Frfcdiff%3Furl2%3Ddraft-ietf-ipsecme-split-dns-10&amp;data=02%7C01%7Cdavid.waltermire%40nist.gov%7Cff7ef1c6c1be4bdf912608d5eced14e3%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C636675425355607080&amp;sdata=b6TiXdCbVieE5xT7lx3gludJT3DZi%2FyCpEkYXPb3Bx4%3D&amp;reserved=0
>
>
> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fipsec&amp;data=02%7C01%7Cdavid.waltermire%40nist.gov%7Cff7ef1c6c1be4bdf912608d5eced14e3%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C636675425355607080&amp;sdata=X%2FXEIPG%2BAZH5dG7EzMMZrRs5YsvxxujN8roweX15YHs%3D&amp;reserved=0

_______________________________________________
IPsec mailing list
[email-masked]
https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fipsec&amp;data=02%7C01%7Cdavid.waltermire%40nist.gov%7Cff7ef1c6c1be4bdf912608d5eced14e3%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C636675425355607080&amp;sdata=X%2FXEIPG%2BAZH5dG7EzMMZrRs5YsvxxujN8roweX15YHs%3D&amp;reserved=0

---

From: Tommy Pauly <[email-masked]>
Date: Wed, 18 Jul 2018 16:53:21 -0400

> On Jul 18, 2018, at 4:35 PM, Waltermire, David A. (Fed) <[email-masked]> wrote:
> 

The "may" references are not intended to be capitalized MAYs; we are stating a fact (like "can"), since the normative language about the lists of domain requests comes above in the text. Specifying both a MAY and its opposite doesn't seem to add much textual value?

Similarly, the "should" that is not capitalized is not intended to be a normative command, but a description to introduce the following two normative statements.

IKE clients MUST use a preconfigured whitelist of one or more domain
   names for which it will allow INTERNAL_DNSSEC_TA updates.  This list
   may be sent in the CFG_REQUEST payload, or may be applied after
   reception of the CFG_REPLY payload.

   IKE clients should take care to only whitelist domains that apply to
   internal or managed domains, rather than to generic Internet traffic.
   The DNS root zone (".") MUST NOT be whitelisted.  Other generic or
   public domains, such as top-level domains, similarly SHOULD NOT be
   whitelisted.

> 
> Regards,
> Dave
> From: IPsec <[email-masked] <mailto:[email-masked]>> on behalf of Tommy Pauly <[email-masked] <mailto:[email-masked]>>
> > On Jul 18, 2018, at 4:26 PM, [email-masked] <mailto:[email-masked]> wrote:
> > 
> > 
> >   public DNS servers is referred to as "Split DNS"..
> > 
> > 
> > https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-ipsecme-split-dns%2F&amp;data=02%7C01%7Cdavid.waltermire%40nist.gov%7Cff7ef1c6c1be4bdf912608d5eced14e3%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C636675425355607080&amp;sdata=k%2F6Juy9hDJucBOTXoJgrwBeVfzw6iL3JcOsH1oP%2F4rk%3D&amp;reserved=0 <https://na01.safelinks.protection.outlook.com/?url=https://datatracker.ietf.org/doc/draft-ietf-ipsecme-split-dns/&amp;data=[email-masked]|ff7ef1c6c1be4bdf912608d5eced14e3|2ab5d82fd8fa4797a93e054655c61dec|1|0|636675425355607080&amp;sdata=k/6Juy9hDJucBOTXoJgrwBeVfzw6iL3JcOsH1oP/4rk=&amp;reserved=0>
> > 
> > https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-ietf-ipsecme-split-dns-10&amp;data=02%7C01%7Cdavid.waltermire%40nist.gov%7Cff7ef1c6c1be4bdf912608d5eced14e3%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C636675425355607080&amp;sdata=anQJZuOh9jiwQY0DRjnkJF9t6rwoKUnCTkTtGD4pRjI%3D&amp;reserved=0 <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-ietf-ipsecme-split-dns-10&amp;data=02%7C01%7Cdavid.waltermire%40nist.gov%7Cff7ef1c6c1be4bdf912608d5eced14e3%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C636675425355607080&amp;sdata=anQJZuOh9jiwQY0DRjnkJF9t6rwoKUnCTkTtGD4pRjI%3D&amp;reserved=0>
> > https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-ipsecme-split-dns-10&amp;data=02%7C01%7Cdavid.waltermire%40nist.gov%7Cff7ef1c6c1be4bdf912608d5eced14e3%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C636675425355607080&amp;sdata=3%2FHdtPgHVzi%2B1gXSLO7m029WGCUJM2p0w940mZ8uH4I%3D&amp;reserved=0 <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-ipsecme-split-dns-10&amp;data=02%7C01%7Cdavid.waltermire%40nist.gov%7Cff7ef1c6c1be4bdf912608d5eced14e3%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C636675425355607080&amp;sdata=3%2FHdtPgHVzi%2B1gXSLO7m029WGCUJM2p0w940mZ8uH4I%3D&amp;reserved=0>
> > 
> > https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf..org%2Frfcdiff%3Furl2%3Ddraft-ietf-ipsecme-split-dns-10&amp;data=02%7C01%7Cdavid.waltermire%40nist.gov%7Cff7ef1c6c1be4bdf912608d5eced14e3%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C636675425355607080&amp;sdata=b6TiXdCbVieE5xT7lx3gludJT3DZi%2FyCpEkYXPb3Bx4%3D&amp;reserved=0 <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Frfcdiff%3Furl2%3Ddraft-ietf-ipsecme-split-dns-10&amp;data=02%7C01%7Cdavid.waltermire%40nist.gov%7Cff7ef1c6c1be4bdf912608d5eced14e3%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C636675425355607080&amp;sdata=b6TiXdCbVieE5xT7lx3gludJT3DZi%2FyCpEkYXPb3Bx4%3D&amp;reserved=0>
> > 
> > 
> > until the htmlized version and diff are available at tools.ietf.org <http://tools.ietf.org/>.
> > 
> > ftp://ftp.ietf.org/internet-drafts/ <ftp://ftp.ietf.org/internet-drafts/>
> > 
> > [email-masked] <mailto:[email-masked]>
> > https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf..org%2Fmailman%2Flistinfo%2Fipsec&amp;data=02%7C01%7Cdavid.waltermire%40nist.gov%7Cff7ef1c6c1be4bdf912608d5eced14e3%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C636675425355607080&amp;sdata=X%2FXEIPG%2BAZH5dG7EzMMZrRs5YsvxxujN8roweX15YHs%3D&amp;reserved=0 <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fipsec&amp;data=02%7C01%7Cdavid.waltermire%40nist.gov%7Cff7ef1c6c1be4bdf912608d5eced14e3%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C636675425355607080&amp;sdata=X%2FXEIPG%2BAZH5dG7EzMMZrRs5YsvxxujN8roweX15YHs%3D&amp;reserved=0>
> 
> [email-masked] <mailto:[email-masked]>
> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fipsec&amp;data=02%7C01%7Cdavid.waltermire%40nist.gov%7Cff7ef1c6c1be4bdf912608d5eced14e3%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C636675425355607080&amp;sdata=X%2FXEIPG%2BAZH5dG7EzMMZrRs5YsvxxujN8roweX15YHs%3D&amp;reserved=0 <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fipsec&amp;data=02%7C01%7Cdavid..waltermire%40nist.gov%7Cff7ef1c6c1be4bdf912608d5eced14e3%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C636675425355607080&amp;sdata=X%2FXEIPG%2BAZH5dG7EzMMZrRs5YsvxxujN8roweX15YHs%3D&amp;reserved=0>
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/ipsec <https://www.ietf.org/mailman/listinfo/ipsec>