[DNSOP] Re: draft-ietf-dnsop-integration text on ASCII-or-not

[Ben Schwartz <[e-mail]>]

Looks good to me.

On Thu, Jul 23, 2026 at 12:20 PM Kaizer, Andrew
<akaizer=[e-mail]> wrote:
>
> >
> Thanks for the text. How about the following for the last paragraph:
>
>    Displaying, normalizing, comparing, encoding, and decoding of domain
>    names requires special processing, and cannot rely on generic string
>    operations alone.  In the user interface, applications should take
>    care to prevent potential attacks related to visually similar
>    characters as described in Section 4.4 of [RFC5890].  Other security
>    risks include improper use of case-sensitive comparison and failure
>    to reject names whose labels contain non-preferred characters.
>
> I would prefer to keep the references to IETF documents as possible, so RFC5890 4.4 seems most applicable. I also updated the second paragraph to state RFC1034 which has a definition for "preferred name syntax" which I did not find in RFC1123.
>
> --Andrew Kaizer
>
> On 7/23/26, 4:16 PM, "Ben Schwartz" <bemasc=[e-mail] <mailto:[e-mail]>> wrote:
>
>
> Caution: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.
>
>
> Here's an updated proposal:
>
>
> DNS integrations should be aware that the list of valid global
> DNS TLDs can change, so should not hard code a list of accepted TLDs.
> If applications want a list of currently valid TLDs, they can use a
> routinely updated list of public suffixes such as that provided by
> IANA [IANA-PSL]. Failure to account for new TLDs may lead
> to inadvertent exclusion which could also lead to registrant and user
> confusion.
>
>
> When interacting with non-technical users, applications should present and
> accept domain names in Unicode "u-label" format [RFC5890].
> In the DNS wire format, applications should only use domain names that
> conform to the "Preferred Name Syntax" [RFC1123] or the Attrleaf
> syntax [RFC8553]. Applications should store and display names only in
> fully-qualified form without the final ".", unless they also
> require access to
> network-local search domains [RFC3397].
>
>
> Displaying, normalizing, comparing, encoding, and decoding of domain names
> requires special processing, and cannot rely on generic string
> operations alone.
> In the user interface, applications should take care to prevent
> homograph attacks
> (https://urldefense.com/v3/__https://www.w3.org/International/articles/idn-and-iri/Overview.en*phishing__;Iw!!Bt8RZUm9aw!6bQH6nmitBR-l_XMJgu5ct-g_cY60OBIR88K4zlRRcLGzJi__uCaDd5wm5USqbgqjNNNavMlM7fUVv0vJqR4JFUM5eo$  <https://urldefense.com/v3/__https://www.w3.org/International/articles/idn-and-iri/Overview.en*phishing__;Iw!!Bt8RZUm9aw!6bQH6nmitBR-l_XMJgu5ct-g_cY60OBIR88K4zlRRcLGzJi__uCaDd5wm5USqbgqjNNNavMlM7fUVv0vJqR4JFUM5eo$ >).
> Other security risks include improper use of case-sensitive comparison
> and failure to reject names whose labels contain non-preferred characters.
>
>
> On Tue, Jul 21, 2026 at 4:52 AM Kaizer, Andrew
> <akaizer=[e-mail] <mailto:[e-mail]>> wrote:
> >
> > >
> > Thanks for the proposed text, Ben! Based on Andrew Sullivan's note, would the following update to the last sentence still address your point:
> >
> > When interacting with non-technical users, applications should
> > present and accept domain names in Unicode "u-label" format
> > [RFC5890]. Special care must be taken to avoid homograph attacks in
> > the user interface. In the DNS wire format, applications should only
> > use domain names that conform to the "Preferred Name Syntax"
> > [RFC1034] or the Attrleaf syntax [RFC8553]. Domain names in wire-
> > format should be checked for alignment with such syntax to avoid
> > security risks and user confusion.
> >
> > -- Andrew Kaizer
> >
> > On 7/20/26, 10:28 PM, "Andrew Sullivan" <[e-mail] <mailto:[e-mail]> <mailto:[e-mail] <mailto:[e-mail]>>> wrote:
> >
> >
> > Caution: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.
> >
> >
> > On Mon, Jul 20, 2026 at 02:45:24PM -0500, Ben Schwartz wrote:
> > > Domain names in wire-format should be checked for non-compliant
> > >characters (e.g.
> > > labels containing ".", uppercase, whitespace, or non-ASCII characters) due to
> > > security risks.
> >
> >
> > I'd be pretty surprised to learn that labels containing uppercase characters have wire-format labels that are not compliant. The protocol documents explicitly say you're supposed to preserve the case but ignore it for matching purposes.
> >
> >
> > A
> >
> >
> > --
> > Andrew Sullivan
> > [e-mail] <mailto:[e-mail]> <mailto:[e-mail] <mailto:[e-mail]>>
> >
> >
> > _______________________________________________
> > DNSOP mailing list -- [e-mail] <mailto:[e-mail]> <mailto:[e-mail] <mailto:[e-mail]>>
> > To unsubscribe send an email to [e-mail] <mailto:[e-mail]> <mailto:[e-mail] <mailto:[e-mail]>>
> >
> >
> >
> > _______________________________________________
> > DNSOP mailing list -- [e-mail] <mailto:[e-mail]>
> > To unsubscribe send an email to [e-mail] <mailto:[e-mail]>
>
>
>