[mif] New revision of DNS server selection

[<[e-mail]>]

Hi,

I made some changes and posted a quick -05 http://www.ietf.org/id/draft-savolainen-mif-dns-server-selection-05.txt with things I had in my mind at this point.

Inline:

> There are two cases, one where one provider gives the client
> information that causes it to act against the interests of the owner of
> the mif node in the sense of using the wrong network for access, and

But then elsewhere people say network knows always better:) I'm confused of IETF:)

The user can fallback to use single interface. 

> the other where an attacker tricks the client into sending messages for
> a particular subdomain through it, while leaving the rest of the DNS
> service untouched.

The latest draft now recommends using DNSSEC to validate responses. Of course attacker can still *route* packets (and cause user to go to external side of www.corporation.com instead of internal?-)

> Because there is no mechanism for authenticating or authorizing this
> option, there is no way to prevent this from happening.

In some scenarios the uplinks are always trusted (BBF). Sometimes you can administratively limit which interfaces to trust.