[secdir] secdir re-review of draft-ietf-dnsext-rfc2672bis-dname-24.txt

Stephen Hanna <shanna@juniper.net> Mon, 10 October 2011 18:26 UTC

From: Stephen Hanna <shanna@juniper.net>
To: "secdir@ietf.org" <secdir@ietf.org>, "draft-ietf-dnsext-rfc2672bis-dname@tools.ietf.org" <draft-ietf-dnsext-rfc2672bis-dname@tools.ietf.org>
Date: Mon, 10 Oct 2011 14:24:35 -0400
Thread-Topic: secdir re-review of draft-ietf-dnsext-rfc2672bis-dname-24.txt
Thread-Index: Acwgh9s80YeQfWrkRySR5CC9/YhwJhm8X62g
Message-ID: <AC6674AB7BC78549BB231821ABF7A9AEB80E5B7A00@EMBX01-WF.jnpr.net>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Subject: [secdir] secdir re-review of draft-ietf-dnsext-rfc2672bis-dname-24.txt
Precedence: list

I was asked to review the changes made to this document
in the last few months. I have done so. None of the changes
have any apparent security impact. Some text was clarified
and examples were added. Therefore, my previous analysis
still applies.

I do not see any security issues that are not well covered in
this document. While I don't think this document will close any
major security issues, it includes some helpful guidance. So
I recommend that this document advance to RFC status.

Thanks,

Steve

> -----Original Message-----
> From: Stephen Hanna
> Sent: Wednesday, June 01, 2011 2:15 PM
> To: 'secdir@ietf.org'; 'draft-ietf-dnsext-rfc2672bis-
> dname@tools.ietf.org'
> Cc: 'ietf@ietf.org'
> Subject: secdir review of draft-ietf-dnsext-rfc2672bis-dname-22.txt
> 
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the
> IESG. These comments were written primarily for the benefit of the
> security area directors. Document editors and WG chairs should treat
> these comments just like any other last call comments.
> 
> This document intends to replace RFC 2672, the definition of DNAME
> redirection in the DNS. DNAME is a DNS resource record type that
> (in layman's terms) indicates that all domain names ending in a
> specified suffix should be redirected to domain names where the
> suffix is replaced by a specified value. For example, all names
> that end with example.com should be remapped to example.net.
> 
> The document is quite thorough, apparently because the DNAME RR
> has been used for many years and a great deal of real-world
> experience has been gained. That's definitely a good thing!
> 
> From a security perspective, this document includes a more
> thorough analysis of security considerations than the original
> RFC 2672. It also includes a more thorough discussion of DNSSEC
> interactions than the earlier document.
> 
> I do not see any security issues that are not well covered in
> this document. While I don't think this document will close any
> major security issues, it includes some helpful guidance. So
> I recommend that this document advance to RFC status.
> 
> Thanks,
> 
> Steve

[secdir] secdir re-review of draft-ietf-dnsext-rf… Stephen Hanna