[Iotops] Re: Review of draft-ietf-iotops-iot-dns-guidelines-03

[Jim Mozley <[e-mail]>]

Hi Alexey,

Thanks for the review and comments, we’ll look to incorporate the feedback. Some comments below...

> On 18 May 2026, at 17:35, Alexey Melnikov <[e-mail]> wrote:
> 
> !-------------------------------------------------------------------|
> This Message Is From an External Sender
> This message came from outside your organization.
> |-------------------------------------------------------------------!
> 
> Hi,
> 
> (With my participant hat on)
> 
> I am not a DNS expert, so it is hard for me to comment on validity of various DNS related requirements. However the document reads well and generally makes sense to me.
> 
> I have a few very small things that I think it would be worth clarifying:
> 
> 5.2.  Blocking of Unmanaged or Malicious DNS Traffic
> 
>    Where operators have networks dedicated to IoT devices, they MAY
>    limit DNS resolution to only domain names used by those IoT devices
>    to mitigate any impact in the event of a compromise to the device.
>    Manufacturers SHOULD provide domain names used for communication to
> 
> The document doesn't state who would be intended recipients of this information. Network operators? Software Developers?

It would be network operators.

> 
> Also where should this information be published?

Manufacturers would publish this with other support information related to the devices. This might be a link in a device PDF manual containing specification and set-up type information that points to the right support page or get the management domains, so that it allows for potential changes. We can make this a recommendation in the draft.

> 
>    facilitate this and other security measures used to secure devices
>    and identify those that are compromised.  Manufacturer Usage
>    Descriptions (MUDs) can provide details of domain names used in
> 
> MUD needs a reference. An Informative reference would suffice, unless you change the above text in response to my previous comment to make it an implementation requirement.

We can add an informative reference.

> 
>    device operations that can then be added to DNS security controls.
> 
> 
> 5.3.  Availability
> 
>    Providers SHOULD optimize resolver configurations to mitigate the
>    security and operational risks identified in this document, provided
>    that such optimizations do not adversely affect the operation of
>    other DNS clients.
> 
> SHOULD is a bit vague. How can this requirement be tested for compliance? Maybe you can you add a specific reference (to another section of this document) to make this more concrete? Alternatively maybe lowercase it.

We can expand on the different use cases/choices here, but it would be best to avoid expanding this into a section on DNS resolver configuration. Will put some thought into this.

Thanks again for your time in looking at the draft.

Cheers, Jim