Re: [secdir] SECDIR review of draft-ietf-dnsop-root-loopback-03

["Paul Hoffman" <[e-mail]>]

Thanks! We have made these changes in the pre-draft of -04. If the ADs 
want us to publish this before the IESG review, we can; otherwise, we'll 
wait until after the IESG review to release them.

--Paul Hoffman

       <t>A system that does not follow the DNSSEC-related requirements 
given
       in <xref target="reqs"/> can be fooled into giving bad responses 
in the
       same way as any recursive resolver that does not do DNSSEC 
validation on
       responses from a remote root server. Anyone deploying the method
       described in this document should be familiar with the 
operational benefits
       and costs of deploying DNSSEC <xref target="RFC4033"/>.</t>

       <t>As stated in <xref target="intro"/>, this design explicitly 
only allows
       the new root zone server to be run on a loopback address, in 
order to
       prevent the server from serving authoritative answers to any 
system other
       than the recursive resolver. This has the security property of 
limiting
       damage to any other system that might try to rely on the copy of 
the root
       in case that copy becomes altered.</t>