Re: [dnsext] Some thoughts on the updated aliasing draft

[Florian Weimer <[e-mail]>]

* Ted Hardie:

> But the problem remains daunting.  Even if DNSEXT creates the perfect record
> for sameness, we still have to get apps to check it--and that suggests to me
> designing the system for that goal should be a primary consideration in the
> design space.

The problem is worse: applications routinely do not have access to the
public DNS when the proposed sameness or normalization step would have
to be performed.  For example, I'm writing this message on an
IDNA-capable mail client (it will use Punycode for the domain part
during submission if necessary), but the system it runs on lacks
access to the public DNS.  While our network is probably not
representative at all, I'm sure that the phenomenon (lack of DNS
access) is common on corporate networks.

There is something that borders on willful ignorance of this fact.
But it is pretty clear to me that you cannot use DNS for protocol
version signalling (this is what the IDNA folks really need, it just
got perverted to aliasing because an IDNA-specific kludge was not
received favorably) when you haven't got access to the DNS at the
point where you need the information.

-- 
Florian Weimer                <[e-mail]>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: [phone]
D-76133 Karlsruhe             fax: [phone]