Subject: [dnsop] Minor comments on reflectors-are-evil

From: "Olaf M. Kolkman" <[email-masked]>
Date: Sun, 9 Jul 2006 09:54:21 -0400

Dear Colleagues,

I have a couple of NITS and a little issue. The issue comes first.

In section 3, TSIG is used as client authentication mechanism but  
SIG0 is not.

I would agree that SIG0 is not used in practice and therefore has no  
place in a BCP but the same holds for TSIG. I do not really mind if  
TSIG is mentioned but it would be nice to point people to SIG0 to.  
For this kind of problem SIG0 actually has nice properties. So not  
mention SIG0 as BCP but certainly refer (?)

NITS:
In the header:
s/Preventing Use of NS in Reflector Attacks/Preventing Use of NSs in  
Reflector Attacks/
(plural NSs)

section 2 point 2:
s/to a public public nameserver/to one, but usually more public  
nameservers/

In section 3:
s/and NAPTR as used in ENUM/and NAPTR used with DDDS[RFC3401 etc]  
such as in ENUM/
(This scopes the problem with NAPTRs a bit more generic)

Oh the document is a good and simple recommendation and if anybody  
who has seen this claims ignorance of BCP38 I'd be amazed :-).  
Although this document has not been last called I would support its  
publication.

Thanks,

--Olaf

-----------------------------------------------------------
Olaf M. Kolkman
NLnet Labs
http://www.nlnetlabs.nl/