Re: [DNSOP] Fwd: [homenet] WGLC on "redact" and "homenet-dot"

[Mark Andrews <[e-mail]>]

In message <[e-mail]>, Michael S
tJohns writes:
> 
> On 12/14/2016 12:07 PM, Ted Lemon wrote:
> > I hope it was obvious that I was pretty confident that you actually 
> > had a reason.   :)
> >
> > The issue what what you are saying is that sometimes it is technically 
> > correct for a name to not be validatable.   The reason we want an 
> > unsecured delegation for .homenet is that .homenet can't be validated 
> > using the root trust anchor, because the name is has no globally 
> > unique meaning.   So the reason that you've given doesn't apply to 
> > this case, although I completely agree with your reason as it applies 
> > to the case of names that are globally unique.
> 
> I went back and forth on this three times in 3 minutes "Steve's right, 
> no Ted's right, no, Steve's right" before settling on "I think Steve is 
> mostly right, but there may be an alternative third approach".
> 
> Here's the reasoning:   Either your home router understands .homenet or 
> it doesn't.  If it doesn't, then your homenet shouldn't be using 
> .homenet and any .homenet lookups to the real world should fail.  If it 
> does, then it should trap .homenet queries and do with it what it will.

This isn't a issue for the router.  It is a issue for DNSSEC
validating clients of the router.

> Doing it Steve's way removes one attack surface for non-compliant 
> routers on home networks and for all the rest of the networks (e.g. 
> feeding a user a URL with a .homenet name on a fake webpage).

Doing it Steve's way breaks ever DNSSEC validating client using the
home router.  There are good reasons why RFC 6303 requires insecure
delegations for all the namespaces listed in it.  It is mathematically
impossible for a homerouter to inject answers into a secured namespace
and that is what .homenet routers do.   Those same reasons are
equally applicable to .homenet.

If Steve is being honest in his convictions of wanting DNSSEC he
would be objecting to insecure delegations for .home{net}.arpa and
any other names we decide to use.

Now if you want .homenet to be secure it is possible.  This is one
possible way to do it.

We woud need to have homenet routers attempt to add a <TBD Algorithm
(e.g.  RSASHA256)> KEY record via UPDATE over TCP for <label>.homenet
and if they succeed they use <label>.homenet they domain for the
network.  <label> would be <TBD> characters randomly selected from
letters and digits.  The homenet router would then add up to <TBD>
NS records (and glue if necessary) using that KEY's private key to
delegate the zone to a hosting service / the homenet router.  The
homenet router could also add DS records via UPDATE again secured
using the KEY's private key.

Attempts to add records other than KEY records without a valid SIG(0)
record for the name would be rejected.  Attempts to remove records
without a valid SIG(0) would be rejected.  Only a single KEY record
would be permitted.

We also need to be able to garbage collect <label>.homenet so we
would allocate a new record type that indicates when the servers
for .homenet will clean up all records at <label>.homenet.  The
homenet router would update this periodically.  The maximum time
into the future would be <TBD>.  This would be cleaner than repurposing
a existing record.  The garbage collection could be driven by a
process outside of the servers that transfers the zone and sends
removal requests at the specified time with a prerequisite that the
removal record with matching time stamp exists.  This update request
would be secured using a key that is known to the .homenet
administrators.

Apart from restricting the number of records in a RRSet nameservers
exist that already have the policy knobs with the ability to do
this.  Adding the ability to specify policy like this is a couple
of hours work for a developer.  The zones contents contains all the
state for managing the delegation.

If we don't want the servers for the zone to handle the update
traffic there is already a SRV label registered for redirecting it
dedicated update servers.  Apple registered the label.  I believe
this was done so that it could send updates to Dyn's servers without
having to hard code the server names.

Now there are problems with this:
* ldhgldhgln.homenet isn't a user friendly label
* we would have to pay for servers to host the zone for $0
* a homenet only gets a name if it is online
* people would attempt to DoS the servers by adding lots entries

Mark

> However, I think doing it Steve's way requires a *real* TLD zone for 
> .homenet, if for no other reason than to include NSEC and NSEC3 records 
> indicating an empty domain.
> 
> The third way is to do no delegation from the root for .homenet and just 
> ensure that that name never gets registered and published.
> 
> "If it's stupid and it works, it's not stupid".
> 
> Mike
> 
> >
> > On Wed, Dec 14, 2016 at 11:59 AM, Steve Crocker <[e-mail] 
> > <mailto:[e-mail]>> wrote:
> >
> >     The latter.  All DNS answers at all levels should be signed to
> >     assure the querier of the integrity of the answer.  This has been
> >     the goal and best practice for a very long time.  For example, it
> >     was the explicit objective of the quote substantial DNSSEC effort
> >     funded by the US Dept of Homeland Security starting in 2004.
> >
> >     Within ICANN, in 2009 we made it a formal requirement of all new
> >     gTLDs must be signed.  The ccTLDs are not subject to ICANN rules
> >     but they have been gradually moving toward signed status.  Most of
> >     the major ccTLDs are signed and many of the others are too. 
> >     Detailed maps are created every week by ISOC.
> >
> >     I will also try to contribute to the homenet mailing list.
> >
> >     Steve
> >
> >     Sent from my iPhone
> >
> >     On Dec 14, 2016, at 11:36 AM, Ted Lemon <[e-mail]
> >     <mailto:[e-mail]>> wrote:
> >
> >>     Is this a matter of religious conviction, or is there some issue
> >>     with unsecured delegations in the root that you are assuming is
> >>     so obvious that you don't need to tell us about it?   :)
> >>
> >>     On Wed, Dec 14, 2016 at 11:18 AM, Steve Crocker
> >>     <[e-mail] <mailto:[e-mail]>> wrote:
> >>
> >>         I am strongly opposed to unsecured delegations in the root
> >>         zone.  No matter what the problem is, an unsecured delegation
> >>         is not the answer.
> >>
> >>         Steve
> >>
> >>>         On Dec 14, 2016, at 11:11 AM, Suzanne Woolf
> >>>         <[e-mail] <mailto:[e-mail]>> wrote:
> >>>
> >>>         Hi all,
> >>>
> >>>         DNSOP participants who are interested in the special use
> >>>         names problem might want to review draft-ietf-homenet-redact
> >>>         (https://datatracker.ietf.org/doc/draft-ietf-homenet-redact/
> >>>         <https://datatracker.ietf.org/doc/draft-ietf-homenet-redact/>)
> >>>         and draft-ietf-homenet-dot
> >>>         (https://datatracker.ietf.org/doc/draft-ietf-homenet-dot/
> >>>         <https://datatracker.ietf.org/doc/draft-ietf-homenet-dot/>)
> >>>         for the WGLC on them in the HOMENET wg.
> >>>
> >>>         WGLC comments should go to the WG list, [e-mail]
> >>>         <mailto:[e-mail]>.
> >>>
> >>>         If you do, it will also be helpful to look at RFC 7788,
> >>>         which specifies the Home Networking Control Protocol for
> >>>         homenets.
> >>>
> >>>         The redact draft is intended to remove the inadvertent
> >>>         reservation of “.home” as the default namespace for homenets
> >>>         in RFC 7788.
> >>>
> >>>         The homenet-dot draft is intended to provide a request under
> >>>         RFC 6761 for “.homenet” as a special use name to serve as a
> >>>         default namespace for homenets. It also asks IANA for an
> >>>         unsecured delegation in the root zone to avoid DNSSEC
> >>>         validation failures for local names under “.homenet”. The
> >>>         root zone request to IANA has caused some discussion within
> >>>         the WG, as there’s no precedent for such a request.
> >>>
> >>>         Terry Manderson mentioned the homenet-dot draft briefly at
> >>>         the mic in Seoul.
> >>>
> >>>         The WGLC ends this week.
> >>>
> >>>
> >>>         Suzanne
> >>>
> >>>>         Begin forwarded message:
> >>>>
> >>>>         *From: *Ray Bellis <[e-mail] <mailto:[e-mail]>>
> >>>>         *Subject: **[homenet] WGLC on "redact" and "homenet-dot"*
> >>>>         *Date: *November 17, 2016 at 11:27:08 PM EST
> >>>>         *To: *HOMENET <[e-mail] <mailto:[e-mail]>>
> >>>>
> >>>>         This email commences a four week WGLC comment period on
> >>>>         draft-ietf-homenet-redact and draft-ietf-homenet-dot
> >>>>
> >>>>         Please send any comments to the WG list as soon as possible.
> >>>>
> >>>>         Whilst there was a very strong hum in favour of ".homenet"
> >>>>         vs anything
> >>>>         else during the meeting, and there's some discussion of
> >>>>         that ongoing
> >>>>         here on the list - I'd like us to please keep the
> >>>>         discussion of the
> >>>>         choice of domain separate from other substantive comment
> >>>>         about the
> >>>>         drafts' contents.
> >>>>
> >>>>         thanks,
> >>>>
> >>>>         Ray
> >>>>
> >>>>         _______________________________________________
> >>>>         homenet mailing list
> >>>>         [e-mail] <mailto:[e-mail]>
> >>>>         https://www.ietf.org/mailman/listinfo/homenet
> >>>>         <https://www.ietf.org/mailman/listinfo/homenet>
> >>>
> >>>         _______________________________________________
> >>>         DNSOP mailing list
> >>>         [e-mail] <mailto:[e-mail]>
> >>>         https://www.ietf.org/mailman/listinfo/dnsop
> >>>         <https://www.ietf.org/mailman/listinfo/dnsop>
> >>
> >>
> >>         _______________________________________________
> >>         DNSOP mailing list
> >>         [e-mail] <mailto:[e-mail]>
> >>         https://www.ietf.org/mailman/listinfo/dnsop
> >>         <https://www.ietf.org/mailman/listinfo/dnsop>
> >>
> >>
> >
> >
> >
> > _______________________________________________
> > DNSOP mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/dnsop
> 
> 
> 
> --------------A28221197AC4A69387D6FCCF
> Content-Type: text/html; charset=windows-1252
> Content-Transfer-Encoding: 8bit
> 
> <html>
>   <head>
>     <meta content="text/html; charset=windows-1252"
>       http-equiv="Content-Type">
>   </head>
>   <body bgcolor="#FFFFFF" text="#000000">
>     <div class="moz-cite-prefix">On 12/14/2016 12:07 PM, Ted Lemon
>       wrote:<br>
>     </div>
>     <blockquote
> cite="mid:CAPt1N1n+PcuJ+AU-6U4TFiJvjNWz1PRNNp+y=[e-mail]"
>       type="cite">
>       <div dir="ltr">I hope it was obvious that I was pretty confident
>         that you actually had a reason.   :)
>         <div><br>
>         </div>
>         <div>The issue what what you are saying is that sometimes it is
>           technically correct for a name to not be validatable.   The
>           reason we want an unsecured delegation for .homenet is that
>           .homenet can't be validated using the root trust anchor,
>           because the name is has no globally unique meaning.   So the
>           reason that you've given doesn't apply to this case, although
>           I completely agree with your reason as it applies to the case
>           of names that are globally unique.</div>
>       </div>
>     </blockquote>
>     <br>
>     I went back and forth on this three times in 3 minutes "Steve's
>     right, no Ted's right, no, Steve's right" before settling on "I
>     think Steve is mostly right, but there may be an alternative third
>     approach".<br>
>     <br>
>     Here's the reasoning:   Either your home router understands .homenet
>     or it doesn't.  If it doesn't, then your homenet shouldn't be using
>     .homenet and any .homenet lookups to the real world should fail.  If
>     it does, then it should trap .homenet queries and do with it what it
>     will.<br>
>     <br>
>     Doing it Steve's way removes one attack surface for non-compliant
>     routers on home networks and for all the rest of the networks (e.g.
>     feeding a user a URL with a .homenet name on a fake webpage).<br>
>     <br>
>     However, I think doing it Steve's way requires a *real* TLD zone for
>     .homenet, if for no other reason than to include NSEC and NSEC3
>     records indicating an empty domain.<br>
>     <br>
>     The third way is to do no delegation from the root for .homenet and
>     just ensure that that name never gets registered and published.<br>
>     <br>
>     "If it's stupid and it works, it's not stupid".<br>
>     <br>
>     Mike<br>
>     <br>
>     <blockquote
> cite="mid:CAPt1N1n+PcuJ+AU-6U4TFiJvjNWz1PRNNp+y=[e-mail]"
>       type="cite">
>       <div class="gmail_extra"><br>
>         <div class="gmail_quote">On Wed, Dec 14, 2016 at 11:59 AM, Steve
>           Crocker <span dir="ltr">&lt;<a moz-do-not-send="true"
>               href="mailto:[e-mail]" target="_blank">steve@shinkuro
> .com</a>&gt;</span>
>           wrote:<br>
>           <blockquote class="gmail_quote" style="margin:0 0 0
>             .8ex;border-left:1px #ccc solid;padding-left:1ex">
>             <div dir="auto">
>               <div>The latter.  All DNS answers at all levels should be
>                 signed to assure the querier of the integrity of the
>                 answer.  This has been the goal and best practice for a
>                 very long time.  For example, it was the explicit
>                 objective of the quote substantial DNSSEC effort funded
>                 by the US Dept of Homeland Security starting in 2004.</div>
>               <div id="m_4011273099726099435AppleMailSignature"><br>
>               </div>
>               <div id="m_4011273099726099435AppleMailSignature">Within
>                 ICANN, in 2009 we made it a formal requirement of all
>                 new gTLDs must be signed.  The ccTLDs are not subject to
>                 ICANN rules but they have been gradually moving toward
>                 signed status.  Most of the major ccTLDs are signed and
>                 many of the others are too.  Detailed maps are created
>                 every week by ISOC.</div>
>               <div id="m_4011273099726099435AppleMailSignature"><br>
>               </div>
>               <div id="m_4011273099726099435AppleMailSignature">I will
>                 also try to contribute to the homenet mailing list.</div>
>               <div id="m_4011273099726099435AppleMailSignature"><br>
>               </div>
>               <div id="m_4011273099726099435AppleMailSignature">Steve</div>
>               <div id="m_4011273099726099435AppleMailSignature"><br>
>                 Sent from my iPhone</div>
>               <div>
>                 <div class="h5">
>                   <div><br>
>                     On Dec 14, 2016, at 11:36 AM, Ted Lemon &lt;<a
>                       moz-do-not-send="true"
>                       href="mailto:[e-mail]" target="_blank">mellon@f
> ugue.com</a>&gt;
>                     wrote:<br>
>                     <br>
>                   </div>
>                   <blockquote type="cite">
>                     <div>
>                       <div dir="ltr">Is this a matter of religious
>                         conviction, or is there some issue with
>                         unsecured delegations in the root that you are
>                         assuming is so obvious that you don't need to
>                         tell us about it?   :)</div>
>                       <div class="gmail_extra"><br>
>                         <div class="gmail_quote">On Wed, Dec 14, 2016 at
>                           11:18 AM, Steve Crocker <span dir="ltr">&lt;<a
>                               moz-do-not-send="true"
>                               href="mailto:[e-mail]"
>                               target="_blank">[e-mail]</a>&gt;</spa
> n>
>                           wrote:<br>
>                           <blockquote class="gmail_quote"
>                             style="margin:0 0 0 .8ex;border-left:1px
>                             #ccc solid;padding-left:1ex">
>                             <div style="word-wrap:break-word">I am
>                               strongly opposed to unsecured delegations
>                               in the root zone.  No matter what the
>                               problem is, an unsecured delegation is not
>                               the answer.
>                               <div><br>
>                               </div>
>                               <div>Steve</div>
>                               <div><br>
>                                 <div>
>                                   <blockquote type="cite">
>                                     <div>
>                                       <div
>                                         class="m_4011273099726099435h5">
>                                         <div>On Dec 14, 2016, at 11:11
>                                           AM, Suzanne Woolf &lt;<a
>                                             moz-do-not-send="true"
>                                             href="mailto:suzworldwide@gmail.c
> om"
>                                             target="_blank">suzworldwide@gmai
> l.com</a>&gt;
>                                           wrote:</div>
>                                         <br
> class="m_4011273099726099435m_8089574139994213748Apple-interchange-newline">
>                                       </div>
>                                     </div>
>                                     <div>
>                                       <div>
>                                         <div
>                                           class="m_4011273099726099435h5">
>                                           <div
>                                             style="word-wrap:break-word">Hi
>                                             all,
>                                             <div><br>
>                                             </div>
>                                             <div>DNSOP participants who
>                                               are interested in the
>                                               special use names problem
>                                               might want to review
>                                               draft-ietf-homenet-redact
>                                               (<a moz-do-not-send="true"
> href="https://datatracker.ietf.org/doc/draft-ietf-homenet-redact/"
>                                                 target="_blank">https://datat
> racker.ietf.org/<wbr>doc/draft-ietf-homenet-redact/</a><wbr>)
>                                               and draft-ietf-homenet-dot
>                                               (<a moz-do-not-send="true"
> href="https://datatracker.ietf.org/doc/draft-ietf-homenet-dot/"
>                                                 target="_blank">https://datat
> racker.ietf.org/<wbr>doc/draft-ietf-homenet-dot/</a>)
>                                               for the WGLC on them in
>                                               the HOMENET wg.</div>
>                                             <div><br>
>                                             </div>
>                                             <div>WGLC comments should go
>                                               to the WG list, <a
>                                                 moz-do-not-send="true"
>                                                 href="mailto:[e-mail]
> "
>                                                 target="_blank">homenet@ietf.
> org</a>.</div>
>                                             <div><br>
>                                             </div>
>                                             <div>If you do, it will also
>                                               be helpful to look at RFC
>                                               7788, which specifies the
>                                               Home Networking Control
>                                               Protocol for homenets. </div>
>                                             <div><br>
>                                             </div>
>                                             <div>The redact draft is
>                                               intended to remove the
>                                               inadvertent reservation of
>                                               “.home” as the default
>                                               namespace for homenets in
>                                               RFC 7788. </div>
>                                             <div><br>
>                                             </div>
>                                             <div>The homenet-dot draft
>                                               is intended to provide a
>                                               request under RFC 6761 for
>                                               “.homenet” as a special
>                                               use name to serve as a
>                                               default namespace for
>                                               homenets. It also asks
>                                               IANA for an unsecured
>                                               delegation in the root
>                                               zone to avoid DNSSEC
>                                               validation failures for
>                                               local names under
>                                               “.homenet”. The root zone
>                                               request to IANA has caused
>                                               some discussion within the
>                                               WG, as there’s no
>                                               precedent for such a
>                                               request.</div>
>                                             <div><br>
>                                             </div>
>                                             <div>Terry Manderson
>                                               mentioned the homenet-dot
>                                               draft briefly at the mic
>                                               in Seoul. </div>
>                                             <div><br>
>                                             </div>
>                                             <div>The WGLC ends this
>                                               week.</div>
>                                             <div><br>
>                                             </div>
>                                             <div><br>
>                                             </div>
>                                             <div>Suzanne</div>
>                                             <div>
>                                               <div><br>
>                                                 <blockquote type="cite">
>                                                   <div>Begin forwarded
>                                                     message:</div>
>                                                   <br
> class="m_4011273099726099435m_8089574139994213748Apple-interchange-newline">
>                                                   <div
> style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0px"><sp
> an
> style="font-family:-webkit-system-font,'Helvetica
>                                                       Neue',Helvetica,sans-se
> rif"><b>From:
>                                                       </b></span><span
>                                                       style="font-family:-web
> kit-system-font,Helvetica
> Neue,Helvetica,sans-serif">Ray Bellis &lt;<a moz-do-not-send="true"
>                                                         href="mailto:ray@bell
> is.me.uk"
>                                                         target="_blank">ray@b
> ellis.me.uk</a>&gt;<br>
>                                                     </span></div>
>                                                   <div
> style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0px"><sp
> an
> style="font-family:-webkit-system-font,'Helvetica
>                                                       Neue',Helvetica,sans-se
> rif"><b>Subject:
>                                                       </b></span><span
>                                                       style="font-family:-web
> kit-system-font,Helvetica
> Neue,Helvetica,sans-serif"><b>[homenet] WGLC on "redact" and
>                                                         "homenet-dot"</b><br>
>                                                     </span></div>
>                                                   <div
> style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0px"><sp
> an
> style="font-family:-webkit-system-font,'Helvetica
>                                                       Neue',Helvetica,sans-se
> rif"><b>Date:
>                                                       </b></span><span
>                                                       style="font-family:-web
> kit-system-font,Helvetica
> Neue,Helvetica,sans-serif">November 17, 2016 at 11:27:08 PM EST<br>
>                                                     </span></div>
>                                                   <div
> style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0px"><sp
> an
> style="font-family:-webkit-system-font,'Helvetica
>                                                       Neue',Helvetica,sans-se
> rif"><b>To:
>                                                       </b></span><span
>                                                       style="font-family:-web
> kit-system-font,Helvetica
> Neue,Helvetica,sans-serif">HOMENET &lt;<a moz-do-not-send="true"
>                                                         href="mailto:homenet@
> ietf.org"
>                                                         target="_blank">homen
> [e-mail]</a>&gt;<br>
>                                                     </span></div>
>                                                   <br>
>                                                   <div>This email
>                                                     commences a four
>                                                     week WGLC comment
>                                                     period on<br>
> draft-ietf-homenet-redact and draft-ietf-homenet-dot<br>
>                                                     <br>
>                                                     Please send any
>                                                     comments to the WG
>                                                     list as soon as
>                                                     possible.<br>
>                                                     <br>
>                                                     Whilst there was a
>                                                     very strong hum in
>                                                     favour of ".homenet"
>                                                     vs anything<br>
>                                                     else during the
>                                                     meeting, and there's
>                                                     some discussion of
>                                                     that ongoing<br>
>                                                     here on the list -
>                                                     I'd like us to
>                                                     please keep the
>                                                     discussion of the<br>
>                                                     choice of domain
>                                                     separate from other
>                                                     substantive comment
>                                                     about the<br>
>                                                     drafts' contents.<br>
>                                                     <br>
>                                                     thanks,<br>
>                                                     <br>
>                                                     Ray<br>
>                                                     <br>
> ______________________________<wbr>_________________<br>
>                                                     homenet mailing list<br>
>                                                     <a
>                                                       moz-do-not-send="true"
> href="mailto:[e-mail]" target="_blank">[e-mail]</a><br>
>                                                     <a
>                                                       moz-do-not-send="true"
> href="https://www.ietf.org/mailman/listinfo/homenet" target="_blank">https://
> www.ietf.org/mailman/l<wbr>istinfo/homenet</a><br>
>                                                   </div>
>                                                 </blockquote>
>                                               </div>
>                                               <br>
>                                             </div>
>                                           </div>
>                                         </div>
>                                       </div>
>                                       ______________________________<wbr>____
> _____________<br>
>                                       DNSOP mailing list<br>
>                                       <a moz-do-not-send="true"
>                                         href="mailto:[e-mail]"
>                                         target="_blank">[e-mail]</a><br
> >
>                                       <a moz-do-not-send="true"
>                                         href="https://www.ietf.org/mailman/li
> stinfo/dnsop"
>                                         target="_blank">https://www.ietf.org/
> mailman/l<wbr>istinfo/dnsop</a><br>
>                                     </div>
>                                   </blockquote>
>                                 </div>
>                                 <br>
>                               </div>
>                             </div>
>                             <br>
>                             ______________________________<wbr>______________
> ___<br>
>                             DNSOP mailing list<br>
>                             <a moz-do-not-send="true"
>                               href="mailto:[e-mail]"
>                               target="_blank">[e-mail]</a><br>
>                             <a moz-do-not-send="true"
>                               href="https://www.ietf.org/mailman/listinfo/dns
> op"
>                               rel="noreferrer" target="_blank">https://www.ie
> tf.org/mailman/l<wbr>istinfo/dnsop</a><br>
>                             <br>
>                           </blockquote>
>                         </div>
>                         <br>
>                       </div>
>                     </div>
>                   </blockquote>
>                 </div>
>               </div>
>             </div>
>           </blockquote>
>         </div>
>         <br>
>       </div>
>       <br>
>       <fieldset class="mimeAttachmentHeader"></fieldset>
>       <br>
>       <pre wrap="">_______________________________________________
> DNSOP mailing list
> <a class="moz-txt-link-abbreviated" href="mailto:[e-mail]">DNSOP@ietf.o
> rg</a>
> <a class="moz-txt-link-freetext" href="https://www.ietf.org/mailman/listinfo/
> dnsop">https://www.ietf.org/mailman/listinfo/dnsop</a>
> </pre>
>     </blockquote>
>     <p><br>
>     </p>
>   </body>
> </html>
> 
> --------------A28221197AC4A69387D6FCCF--
> 
> 
> --===============6339611341455032002==
> Content-Type: text/plain; charset="us-ascii"
> MIME-Version: 1.0
> Content-Transfer-Encoding: 7bit
> Content-Disposition: inline
> 
> _______________________________________________
> DNSOP mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dnsop
> 
> --===============6339611341455032002==--
> 
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]