Subject: [dnssd] User Perspectives

From: RJ Atkinson <[email-masked]>
Date: Mon, 21 Jul 2014 09:48:35 -0400

Several of my clients are very interested in deploying
and using some form of DNS-SD (+ mDNS) within a single
administrative domain within a network having multiple 
IP subnetworks.  

In this note I'd like to make some (incomplete) observations,
based on various discussions with my clients over the past 
while...

Summary for old timers:
	My clients essentially would like to have the roughly
 	the same capabilities that existed 20 years ago in 
	the proprietary AppleTalk networks. Although one
        client wants to be able to authenticate DNS-SD
        records, which is something AppleTalk did not support.

Routed IP Infrastructure MUST be Supported:
   All of my clients have multiple IP subnetworks, generally
   all are behind a firewall/security-gateway.  RIP is a
   very common routing protocol in smaller networks such as
   these, since RIP is easy to manage and scales adequately 
   for smaller networks.  Any solution adopted by the IETF
   needs to work well in routed/subnetted IP deployments.

   Deploying a flat bridged network is a non-starter from the 
   client perspective.  So any solution MUST work in an 
   IP deployment having multiple interior IP routers.  

   A few clients have multiple sites that are routed together 
   within a single interior routing domain, using IPsec VPNs 
   between the security-gateways (e.g., one firewall/gateway 
   is at each different site of the organisation).

Correct DNS Administration Is Not Easy:
   Some clients, not all, would like to minimise the burden 
   of configuring, managing, and updating their DNS.  This
   is not easy for them to do correctly, especially for
   organisations that have limited IT staff available (which
   by the way includes most home networks, but perhaps does
   not include IETF-attendee home networks).  This makes
   increased reliance on DNS-SD + mDNS very attractive.

DNS Update Might Not Be Available:
   Several clients that have smaller enterprise networks, either
   single building or very small number of sites (each of which 
   is smallish) do not have control of their own DNS namespace.  
   
   Instead, their DNS namespace (and its administration) has been 
   outsourced to their IP service provider.  The client can request 
   changes to their DNS (e.g., www.example.com; mail.example.com) 
   via an ISP web portal, but (Secure) Dynamic DNS Update is not 
   a viable deployment option for them.

DNS-SD Caching/Proxying Within Routers Is VERY Attractive:
   My clients would be very happy if their IP routers would act
   as caching DNS-SD/mDNS proxy devices.  Caching and *very thoughtful*
   proxy implementation within the routers is important to them, 
   because they do NOT want to flood their network in the way
   that some historic approaches (e.g., Service Location Protocol)
   have done.  [I have a specific concern that a caching/proxying
   implementation will not be sufficiently thoughtful unless 
   specific guidance on this is provided to (potentially naive)
   implementers.]

Support For Logical (Non-Topological) Namespaces Is Desired:
   My clients would like to have the notion of logical 
   (i.e., non-topological) namespaces.  For example, a client 
   might have logical groups for "Sales", "Marketing", and 
   "Engineering".  A single device (e.g. printer) might exist 
   in multiple logical groups at the same time.  

   [AppleTalk called these logical groups "zones", but that's 
   NOT great terminology for this list because DNS "zones" 
   have somewhat different semantics than AppleTalk zones had.]

Security Considerations
  Most clients have adopted a model with a border firewall/security
  gateway and are not very concerned about mDNS-based masquerading
  attacks.  One client, which is more sophisticated and has a PKI,
  is concerned that any work done with DNS-SD (or mDNS) does not 
  preclude future concurrent use of DNSsec (with DNS-SD & mDNS) 
  for authentication.

Yours,

Ran Atkinson