Subject: [secdir] Secdir last call review of draft-ietf-ipsecme-split-dns-12

From: Stefan Santesson <[email-masked]>
Date: Sun, 19 Aug 2018 10:59:35 -0700

Reviewer: Stefan Santesson
Review result: Has Nits

In agreement with nit comments in the Gen-Art review.

1) Section 2. Background seems to be a duplication with the introduction
section and could probably be merged with this section.

2) In general I wander wether the requirement level "SHOULD" is to week in some
places. The concern (and question) here is whether this may lead to uncertainty
whether a Split-DNS configuration always will provide the expected level of
security (or fail), or wether such configuration may lead to successful
communication without the expected level of security ( in compliance with this
specification).

---

From: Paul Wouters <[email-masked]>
Date: Sun, 19 Aug 2018 15:08:46 -0400 (EDT)

> Reviewer: Stefan Santesson

Thanks for your review.

> section and could probably be merged with this section.

I agree. It is so small we can pull it into the Introduction.

> communication without the expected level of security ( in compliance with this

Unfortunately, this is the case because of the original text regarding
CFG requests and replies that basically allow each party to omit or send
these completely ignoring which of these CFG's the other party decided
to include. We actually had to loosen up the language or otherwise we
would be modifying the behaviour specified in 5996/7296.

Paul