Re: [dnsext] WGLC: draft-ietf-dnsext-dnssec-bis-updates-16

Big:

5.10 is long, scary, and useless for most environments because most environments will have just one trust anchor. Please add the following after the first paragraph of the section:

When DNSSEC was first published, many sites had multiple (and sometimes nested) trust anchors. Now, it is believed that very few do. If a site has a single trust anchor, the information in this entire section can safely be skipped.

Medium:

5.6 (setting the DO bit in replies) suggests resolvers should "be liberal in what they accept". That's a bit vague. Instead, say what you mean "In order to interoperate with implementations that ignore this rule on sending, resolvers need to allow either the DO bit to be set or unset when receiving responses". However, that's still not as honest as I would like. "Because some implementations ignore this rule on sending, the rule for receivers is now that they MUST NOT expect the DO bit to be set as it was sent."

In 5.8, it is unclear what "protect" means. Either clarify what is being protected or use a different word.

Small:

1.1 should start "The clarifications and changes to ..."

--Paul Hoffman

_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext