[IPsec] Terry Manderson's No Objection on draft-ietf-ipsecme-split-dns-14: (with COMMENT)

[Terry Manderson <[e-mail]>]

Terry Manderson has entered the following ballot position for
draft-ietf-ipsecme-split-dns-14: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-ipsecme-split-dns/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for the time and effort invested in this document. I'm also very
interested to see the resolution to Warren's DISCUSS regarding
ipsecme-split-dns being used as an easy tool to over-claim entire sections of
the DNS hierarchy. Perhaps specifying that the DOMAIN and TA sent to the client
MUST be in the administrative control of the VPN provider (I'm not sure I read
that in the draft) might be one way out, yet I wonder if this is a case of
simply having to trust that the VPN provider does the right thing (as cold as
that leaves me) regardless of the words in the document.