RE: Last Call: Simple Secure Domain Name System (DNS) Dynamic Update to Proposed Standard

["Levon Esibov" <[e-mail]>]

I'd like to recommend to replace the text fragment from Section 3
"By default, a principal MUST NOT be permitted to make any changes to
zone
data; any permissions MUST be enabled though configuration."

by the following text

"By default, a principal SHOULD NOT be permitted to make any changes to
zone
data; any permissions SHOULD be enabled through configuration."

I believe the decision on the default configuration should be left to
implementers. The deployment experience of Beta Windows 2000
demonstrated difficulties that administrators experienced in
configuration of the zones for the dynamic updates. It was found that
the default configuration that satisfied majority of customers is to
allow all the authenticated principals to create new names in a zone,
but prohibit any unauthorized principals from modifying the existing
records. This is the default configuration of the Windows 2000 DNS
server.

I apologize that I didn't notice the issue during the workgroup last
call.

Levon

From: The IESG [mailto:[e-mail]]
Sent: Friday, June 02, 2000 5:34 AM
To: IETF-Announce: ;
Cc: [e-mail]
Subject: Last Call: Simple Secure Domain Name System (DNS) Dynamic
Update to Proposed Standard



The IESG has received a request from the DNS Extensions Working Group
to consider Simple Secure Domain Name System (DNS) Dynamic Update
<draft-ietf-dnsext-simple-secure-update-01.txt> as a Proposed Standard.
This will replace/obsolete RFC2137, currently a Proposed Standard.

The IESG will also consider Domain Name System Security (DNSSEC)
Signing Authority <draft-ietf-dnsext-signing-auth-01.txt> as a Proposed
Standard, updating RFC2535

The IESG plans to make a decision in the next few weeks, and solicits
final comments on this action.  Please send any comments to the=20
[e-mail] or [e-mail] mailing lists by June 16, 2000.

Files can be obtained via
http://www.ietf.org/internet-drafts/draft-ietf-dnsext-simple-secure-upda
te-01.txt
http://www.ietf.org/internet-drafts/draft-ietf-dnsext-signing-auth-01.tx
t




to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.

to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.