DNSOP Working Group A. Suhonen Internet-Draft TREX Intended status: Standards Track W. Toorop Expires: 27 September 2025 NLnet Labs A. Buddhdev RIPE NCC 26 March 2025 DNS Catalog Zone Properties for Zone Transfers draft-axu-dnsop-catalog-zone-xfr-properties-00 Abstract This document specifies DNS Catalog Zones Properties that define the primary name servers from which specific or all member zones can transfer their associated zone, as well as properties for access control for those transfers. About This Document This note is to be removed before publishing as an RFC. Status information for this document may be found at https://datatracker.ietf.org/doc/draft-axu-dnsop-catalog-zone-xfr- properties/. Discussion of this document takes place on the dnsop Working Group mailing list (mailto:dnsop@iets.org), which is archived at https://mailarchive.ietf.org/arch/browse/dnsop/. Source for this draft and an issue tracker can be found at https://github.com/https://github.com/DNS-Hackathon/catalog- extensions-draft. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Suhonen, et al. Expires 27 September 2025 [Page 1] Internet-Draft catalog-zone-xfr-properties March 2025 Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 27 September 2025. Copyright Notice Copyright (c) 2025 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 1.1. Requirements language . . . . . . . . . . . . . . . . . . 3 2. Description . . . . . . . . . . . . . . . . . . . . . . . . . 3 3. Catalog Zone Structure . . . . . . . . . . . . . . . . . . . 3 4. New Properties . . . . . . . . . . . . . . . . . . . . . . . 3 4.1. Primaries . . . . . . . . . . . . . . . . . . . . . . . . 3 4.1.1. TSIG Key Name . . . . . . . . . . . . . . . . . . . . 3 4.1.2. TLSA . . . . . . . . . . . . . . . . . . . . . . . . 4 4.2. Allow Notify . . . . . . . . . . . . . . . . . . . . . . 4 4.3. Allow Transfer . . . . . . . . . . . . . . . . . . . . . 4 4.4. Allow Query . . . . . . . . . . . . . . . . . . . . . . . 4 5. Name Server Behavior . . . . . . . . . . . . . . . . . . . . 4 6. Implementation and Operational Notes . . . . . . . . . . . . 4 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 4 8. Implementation Status . . . . . . . . . . . . . . . . . . . . 5 9. Security and Privacy Considerations . . . . . . . . . . . . . 5 10. References . . . . . . . . . . . . . . . . . . . . . . . . . 5 10.1. Normative References . . . . . . . . . . . . . . . . . . 5 10.2. Informative References . . . . . . . . . . . . . . . . . 5 Appendix A. Example Catalog with One of Everything . . . . . . . 6 Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 6 Contributors . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 6 Suhonen, et al. Expires 27 September 2025 [Page 2] Internet-Draft catalog-zone-xfr-properties March 2025 1. Introduction DNS Catalog Zones [RFC9432] described a method for automatic DNS zone provisioning among DNS name servers by the catalog of zones to be provisioned as one or more regular DNS zones. Configuration associated with the member zones, such as from which primary name servers and with which TSIG keys [RFC8945] to transfer the zones, and from which IP addresses and with which TSIG keys DNS notifies [RFC1996] are allowed, were assumed to be preprovisioned at the catalog consumer. This document specifies DNS Catalog Zones Properties to specify primary name servers and TSIG keys to use to transfer the member zones in a catalog, as well as properties to specify which IP addresses, using which TSIG keys, are allowed to notify [RFC1996] the secondary name server serving the member zones, in order to remove the need to preprovision those at the catalog consumers. 1.1. Requirements language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. 2. Description Body text [REPLACE] 3. Catalog Zone Structure These new properties can be at the top of the catalog zone, where they will affect all member zones, or under a member zone label, where they will affect just that member zone. 4. New Properties Body text [REPLACE] 4.1. Primaries Body text [REPLACE] 4.1.1. TSIG Key Name Body text [REPLACE] Suhonen, et al. Expires 27 September 2025 [Page 3] Internet-Draft catalog-zone-xfr-properties March 2025 4.1.2. TLSA Body text [REPLACE] 4.2. Allow Notify Body text [REPLACE] 4.3. Allow Transfer Body text [REPLACE] 4.4. Allow Query Body text [REPLACE] 5. Name Server Behavior Body text [REPLACE] 6. Implementation and Operational Notes Body text [REPLACE] 7. IANA Considerations IANA is requested to add the following entries to the "DNS Catalog Zones Properties" registry under the "Domain Name System (DNS) Parameters" page: +=================+======================+===========+===========+ | Property Prefix | Description | Status | Reference | +=================+======================+===========+===========+ | primaries | Primary name servers | Standards | [this | | | | Track | document] | +-----------------+----------------------+-----------+-----------+ | allow-notify | Allow NOTIFY from | Standards | [this | | | | track | document] | +-----------------+----------------------+-----------+-----------+ | allow-transfer | Allow zone transfer | Standards | [this | | | from | track | document] | +-----------------+----------------------+-----------+-----------+ | allow-query | Allow queries from | Standards | [this | | | | track | document] | +-----------------+----------------------+-----------+-----------+ Table 1 Suhonen, et al. Expires 27 September 2025 [Page 4] Internet-Draft catalog-zone-xfr-properties March 2025 8. Implementation Status *[NOTE to the RFC Editor: Please remove this section before publication]* This section records the status of known implementations of the protocol defined by this specification at the time of posting of this Internet-Draft [RFC7942]. 9. Security and Privacy Considerations Security and Privacy Considerations 10. References 10.1. Normative References [RFC1996] Vixie, P., "A Mechanism for Prompt Notification of Zone Changes (DNS NOTIFY)", RFC 1996, DOI 10.17487/RFC1996, August 1996, . [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, . [RFC8945] Dupont, F., Morris, S., Vixie, P., Eastlake 3rd, D., Gudmundsson, O., and B. Wellington, "Secret Key Transaction Authentication for DNS (TSIG)", STD 93, RFC 8945, DOI 10.17487/RFC8945, November 2020, . [RFC9432] van Dijk, P., Peltan, L., Surý, O., Toorop, W., Monshouwer, C.R., Thomassen, P., and A. Sargsyan, "DNS Catalog Zones", RFC 9432, DOI 10.17487/RFC9432, July 2023, . 10.2. Informative References [RFC7942] Sheffer, Y. and A. Farrel, "Improving Awareness of Running Code: The Implementation Status Section", BCP 205, RFC 7942, DOI 10.17487/RFC7942, July 2016, . Suhonen, et al. Expires 27 September 2025 [Page 5] Internet-Draft catalog-zone-xfr-properties March 2025 Appendix A. Example Catalog with One of Everything Example Catalog with One of Everything Acknowledgements Thanks everybody who helped making this work possible. Contributors Thanks to all of the contributors. Authors' Addresses Aleksi Suhone TREX Regional Exchanges Oy Kuninkaankatu 30 A FI-33720 Tampere Finland Email: i-d-2025@ssd.axu.tm Willem Toorop NLnet Labs Science Park 400 1098 XH Amsterdam Netherlands Email: willem@nlnetlabs.nl Anand Buddhdev RIPE NCC Stationsplein 11 1012 AB Amsterdam Netherlands Email: anandb@ripe.net Suhonen, et al. Expires 27 September 2025 [Page 6]