Subject: [DNSOP] Working Group Last Call for draft-ietf-dnsop-rfc7816bis

From: Tim Wicinski <[email-masked]>
Date: Tue, 27 Oct 2020 20:31:29 -0400

All,

This starts a Working Group Last Call for draft-ietf-dnsop-rfc7816bis

Current versions of the draft is available here:
https://datatracker.ietf.org/doc/draft-ietf-dnsop-rfc7816bis/

The Current Intended Status of this document is: "Standards Track"

Please review the draft and offer relevant comments.
If this does not seem appropriate please speak out.
If someone feels the document is *not* ready for publication, please speak
out with your reasons.

This starts a two week Working Group Last Call process, and ends on: 10
November 2020

thanks
tim

---

From: Brian Dickson <[email-masked]>
Date: Tue, 27 Oct 2020 18:07:27 -0700

> Please review the draft and offer relevant comments.

I have reviewed the draft. It is good.

I do have one question/observation, which I apologise for bringing up at
this late stage: there isn't any reference to CNAME/DNAME rewriting.
I wonder if adding a small bit of wording to the effect of, "If/when query
rewriting occurs due to CNAME or DNAME processing, the rewritten query MUST
begin again using these same QNAME minimization steps."

Modulo that, I support publication.

Brian

> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
>

---

From: Viktor Dukhovni <[email-masked]>
Date: Wed, 28 Oct 2020 15:16:19 -0400

> The Current Intended Status of this document is: "Standards Track"

A potential improvement to the algorithm that's not mentioned in the
draft is avoiding probing for zone cuts at non-LDH A-labels, e.g.
labels starting with "_" used in SRV records, DANE, ...

Such labels should rarely represent privacy-relevant administrative
boundaries, and e.g. with DANE and sometimes flawed support for
denial of existence, probes for "_tcp.example.com" sometimes return
invalid NXDomain proofs (poor handling of ENTs, missing wildcards
from NSEC chains, ...).

Therefore, it is best to avoid breaking the queue name below special-use
labels (_tcp, ...).  After asking for "smtp.example.com", ask for
"_25._tcp.smtp.example.com" and not "_tcp.smtp.example.com" followed
by "_25._tcp.smtp.example.com".

-- 
    Viktor.