Subject: [hiprg] comments on draft-irtf-hiprg-proxies-02

From: "Henderson, Thomas R" <[email-masked]>
Date: Mon, 28 Mar 2011 11:40:33 -0700

Dacheng and all,
I reviewed this draft and I believe the presentation and terminology is much improved from the previous version.  I can provide editorial comments separately.  The terminology section in Section 2 needs to be completed more fully.  Another term that is used frequently in the draft but is not completely clear to me is "DNS lookup inspector" (is this a resolver?).  

I do not have a specific text suggestion for this but I would suggest also in the security considerations section to talk about considerations for DI-proxy types in the DNS intercepting aspects of the configuration.  Earlier in the draft, you brought up the problems with DNSSEC, but are there also security concerns introduced by having a DNS intercepting proxy involved in general (is a host more exposed to DNS-related attacks)?

- Tom