Re: [DNSOP] DNSOPI-D Action: draft-ietf-dnsop-nsec3-guidance-02.txt

[Matthijs Mekking <[e-mail]>]

On 25-11-2021 13:00, Petr Špaček wrote:
> On 25. 11. 21 9:33, Matthijs Mekking wrote:

>> 3.2.  Recommendation for validating resolvers
>>
>> I understand why the new text is here, but I think this now actually 
>> gives too little advice for operators and vendors.
>>
>> I know, this is a vague comment, I need to think about it a bit more.
> 
> Honestly I can't see anything more specific which will not get out of 
> date quickly.

Can we make use of the keyword MAY? This allows I think for text that 
will not get out of date:

    Validating resolvers MAY return an insecure response when processing
    NSEC3 records with iterations larger than 0. Validating resolvers MAY
    also return SERVFAIL when processing NSEC3 records with iterations
    larger than 0. This significantly decreases the requirements
    originally specified in Section 10.3 of [RFC5155]. See the Security
    Considerations for arguments on how to handle responses with non-zero
    iteration count.

Having text that says "MAY do this at value X" is more quantifiable and 
IMO a stronger signal that zone publishers really should not use value X.


Best regards,

Matthijs