Hi, the correct URL is: https://datatracker.ietf.org/doc/draft-teppo-corporate-authenticated-dns/
But I am going to ask a different question: How much of the draft has been generated using tools and not written by yourself? IETF and dnsop WG is now in process of drafting a policy, but I am 100% sure that we will require a full transparency about the tools used to generate the draft (similar to what other publishers currently have). Ondrej -- Ondřej Surý (He/Him) [email protected] A gentle nudge is always appreciated if I take a little longer to reply. > On 29. 7. 2026, at 20:09, Terry Teppo <[email protected]> wrote: > > Hello DNSOP, > > I have submitted an Internet-Draft titled "Authenticated DNS Resolution (ADR) > for Enterprise DNS" as an independent submission: > > https://datatracker.ietf.org/doc/draft-teppo-corporate-authenticated-dns-00/ > > ADR proposes query-plane RBAC for enterprise DNS resolvers — controlling who > may resolve DNS records at query time, bound to authenticated machine and > user identity via Kerberos, X.509 client certificates, or OAuth/OIDC tokens. > > The motivation is a gap that existing mechanisms do not address: enterprises > already authenticate DNS writes (RFC 2136, TSIG), restrict zone transfers, > and block external queries, but reads remain open to any authenticated > principal with network access to a resolver. A domain-joined workstation > operated by a helpdesk technician can resolve router, firewall, and WAN > transit records with no credentials and no audit trail. ADR completes the > access control model enterprises have already been building by applying RBAC > at query time. > > Key points: > - ADR carries identity in the transport layer (Kerberos, mTLS, DoH+OIDC) and > does not modify DNS message format, opcodes, EDNS options, or resource record > types > - Scoped strictly to enterprise private namespaces; no impact on Internet > DNS, DNSSEC, or public resolvers > - Introduces AUTH-NXDOMAIN to distinguish "record does not exist" from > "record exists but you lack permission" > - Fully compatible with DNSSEC; ADR resolvers validate before returning > answers > - Supports incremental deployment alongside legacy unauthenticated DNS > > I searched the datatracker and found no prior drafts addressing query-plane > DNS authorization. The draft includes a prior art section covering DNSSEC, > AD-integrated DNS, split-horizon, DoT/DoH, mDNS, RFC 2136, TSIG, SIG(0), DNS > Cookies, RPZ, DNS ACLs, and 802.1X/NAC. > > I would welcome feedback on technical gaps, pointers to related work I may > have missed, or interoperability concerns. I am not requesting WG adoption at > this stage but would welcome guidance if the WG has interest. > > Thank you for your time. > _______________________________________________ > DNSOP mailing list -- [email protected] > To unsubscribe send an email to [email protected] _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
