boucadair/add-resolver-information

add-resolver-information's Issues

generalize to include any secure url scheme

add-resolver-information/draft-ietf-add-resolver-info.md

Line 162 in 631a2a3

client MUST reject the URL if the scheme is not "https". The URL

Then, list "https" as recommended.

I'm thinking about future uses such as DNS-over-CoAP and the like.

Sig validation needs to anchor to IP address

In the description for sig validation:

DNS clients using DDR for encrypted resolver discovery quering for an RESINFO RR MUST validate the signature in the "sig" attribute for data origin authentication. If the signature validation fails, the DNS client MUST reject the RESINFO RR.

Nit: s/quering/querying

The point of DDR is that the trust anchor is the original IP address of the resolver. I think it's worth calling out there that the MUST validate involves ensuring the certificate that signed can also claim the IP address that DDR used to validate.

That clarification may be more appropriate in this text which already describes the requirements for validation:

The signature algorithm MUST be compatible with the public key in the DNS server's end-entity certificate. As a reminder, the server's end-entity certificate's public key will be compatible with the selected authentication algorithm from the client's "signature_algorithms" TLS extension.

Grammatical nit

There are two instances of "a an" in the document, as in "This is a an optional attribute" -- the "a " should be deleted.