Subject: Re:

From: Rob Austein <[email-masked]>
Date: Sun, 02 Jun 2002 13:39:43 +0200

At Sat, 1 Jun 2002 18:05:43 -0700, Art Shelest wrote:
> 
> Secure name resolution question: is there an existing mechanism that
> permits configuring DNS server to only resolve name X for authorized
> clients?
> 
> For example, I would like to have www.example.com only be resolvable by
> members of a specific group, and make it "invisible" to others.

This was an explict non-goal for DNSSEC (RFC 2535 et seq).  DNSSEC
explicitly does not attempt to provide confidentiality.

You could probably hack together something based on TSIG (RFC 2845).
It wouldn't scale, and I wouldn't advise it, but it's your life....

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Kevin Darcy <[email-masked]>
Date: Mon, 03 Jun 2002 13:58:34 -0400

Art Shelest wrote:

> Hi:
> permits
> configuring DNS server to only resolve name X for authorized clients?
>

I assume by "invisible" you mean that the nameserver responds that the
name doesn't exist, as opposed to REFUSE'ing the query, which would let
the "forbidden" clients know that something is there (?)

You could define those "special" names as zones by themselves, and then
define separate "view"s for the "permitted" versus the
"forbidden" clients. This would require BIND 9, which supports "view".
Note, however, that this would be a lot of work to set up and maintain,
since *every* existing zone on the nameserver would need to be defined and
maintained in each "view" (but you may be able to play
multiple-references-to-the-same-file or $INCLUDE-file games to make your
life easier in this regard...).

- Kevin