Subject: draft-ietf-dnsext-nsec3-01

From: Roy Arends <[email-masked]>
Date: Mon, 21 Feb 2005 11:19:36 +0100 (CET)

I've just submitted draft-ietf-dnsext-nsec3-01 and am hereby solliciting
comments.

Abstract

   The DNS Security (DNSSEC) NSEC resource record (RR) is intended to be
   used to provide authenticated denial of existence of DNS ownernames
   and types; however, it permits any user to traverse a zone and obtain
   a listing of all ownernames.

   A complete zone file can be used either directly as a source of
   probable e-mail addresses for spam, or indirectly as a key for
   multiple WHOIS queries to reveal registrant data which many
   registries (particularly in Europe) may be under strict legal
   obligations to protect.  Many registries therefore prohibit copying
   of their zone file; however the use of NSEC RRs makes renders
   policies unenforceable.

   This document proposes a scheme which obscures original ownernames
   while permitting authenticated denial of existence of non-existent
   names.  Non-authoritative delegation point NS RR types may be
   excluded.

Full version can be found at:

http://www.logmess.com/~roy/

Roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>