Subject: [DNSOP] Mirja Kühlewind's No Objection on draft-ietf-dnsop-maintain-ds-03: (with COMMENT)

From: "Mirja Kuehlewind" <[email-masked]>
Date: Wed, 31 Aug 2016 07:37:45 -0700

Mirja Kühlewind has entered the following ballot position for
draft-ietf-dnsop-maintain-ds-03: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-dnsop-maintain-ds/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

One technical comment:
How does the client know that the parent supports the DNSSEC Delete
Algorithm and it actually can turn of DNSSEC after a while? What how long
is a while? Would it be possible to define a reply message from the
parent to the client to confirm that the deletion was understood?

One more or less editorial comment:
I agree with Spencer that the use of normative language in the security
section is odd. All used SHOULDs should be lower case. But I would also
recommend to rephrase to give clear guidance, e.g.

OLD:
"A parent zone might also consider sending an email to its
   contact addresses to give the child zone a warning that security will
   be enabled after a certain amount of wait time - thus allowing a
   child administrator to cancel the request."

NEW:
"A parent zone may send an email to its
   contact addresses to give the child zone a warning that security will
   be enabled after a defind amount of wait time - thus allowing a
   child administrator to cancel the request."

OR:
"A parent zone MAY send an email to its
   contact addresses to give the child zone a warning that security will
   be enabled after a defined amount of wait time - thus allowing a
   child administrator to cancel the request."