Subject: [secdir] Secdir last call review of draft-ietf-dnsop-7706bis-07

From: Linda Dunbar via Datatracker <[email-masked]>
Date: Mon, 24 Feb 2020 15:06:27 -0800

Reviewer: Linda Dunbar
Review result: Has Nits

Reviewer: Linda Dunbar
Review result: Ready with questions

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG.  These
comments were written primarily for the benefit of the security area directors.
 Document editors and WG chairs should treat these comments just like any other
last call comments.

The Abstract of  This document claims that this document shows how to start and
maintain  a copy of the root zone in the Recursive Resolvers so that the
Resolvers don't need to send query to  another node. Two questions: - What if
the node is not authorized to have the entire records? It would desirable for
the Resolvers to have all the records of the root zone. Is there any scenario
that the Resolvers simply cannot get all the records of the root zone?

-  How to detect if any records stored in the Resolver are STALE?

Page 3, last sentence of the 3rd paragraph:  is it a typo? or miss a verb?
"... it would all responses from a remote root server"

Cheers,

Linda Dunbar

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 28 Feb 2020 18:48:23 +0000

Thanks for the review! Answers to your questions here:

On Feb 24, 2020, at 3:06 PM, Linda Dunbar via Datatracker <[email-masked]> wrote:
> - What if

No, there is no such scenario. Every resolver can always get and cache any record in the root zone.

> -  How to detect if any records stored in the Resolver are STALE?

Resolvers would treat the records gotten from transferring the root zone wholesale as if they had requested each one from a root server. Thus, record staleness is handled for these records exactly as they are for normal queries.

> "... it would all responses from a remote root server"

Good catch. We'll fix that to "just as it would validate all responses from a remote root server".

--Paul Hoffman