I like to point out 3 issues with this document that benefit from another pass.
1. The document says providing a "consistent user experience" is a primary goal, but what this means and who the user is never quite defined. In application integrations (such as ATP and ENS examples of Appendix A), there are at least three classes of users - admin users, end users, and application developers. Consistent user experience means different things for these different users. Recommendation: Define the distinct roles and the draft should clarify *which* role a specific consideration is aimed at (e.g., "Failure to validate domain control impacts the Registrant, while failure to handle IDNs impacts the End User"). 2. The draft says one of its goals is avoiding "impacts to the security, stability, and resiliency of the global DNS". I think this claim is misleading. Improperly integrating a DNS name into an external application (like a decentralized network or smart contract) creates application-level risks (e.g handle hijacking, user spoofing within the app), but it generally poses no threat to the security or stability, of the global DNS protocol/infrastructure itself. Recommendation*:* Scope the security claims accurately. Clarify that the risks discussed are application layer risks and reserve claims about DNS stability for actual DNS interaction risks (e.g applications causing excessive query load). 3. DNS integrations where the DNS name serves merely as a handle pointing to a persistent underlying ID (Bluesky mapping alice.com to did:plc:123) pose many social engineering attack risks (such as as when alice.com changes hands to Bob, Alice’s underlying DID remains did:plc:123, but her claim to the alice.com handle becomes invalid opening up trust-abuse, impersonation, and identity-takeover vectors. Suggestion: While the document mentions technical risks, perhaps it will be more useful to Itemize and categorize these attack vectors and group the mitigations around those vectors. Good luck. Bob Traverz *From: *Ondřej Surý <[email protected]> *Date: *Sunday, September 6, 2026 at 2:41 AM *To: *Ondřej Surý <[email protected]> *Cc: *[email protected] <[email protected]>, [email protected] <[email protected]> *Subject: *[DNSOP] Re: WG Last Call: draft-ietf-dnsop-integration-04 (Ends 2026-09-07) The WGLC ends tomorrow, so if you have anything to say, please do so today or tomorrow. Ondrej -- Ondřej Surý (He/Him) [email protected] A gentle nudge is always appreciated if I take a little longer to reply. > On 24. 8. 2026, at 14:52, Ondřej Surý via Datatracker <[email protected]> wrote: > > This message starts a WG Last Call for: > draft-ietf-dnsop-integration-04 > > This Working Group Last Call ends on 2026-09-07 > > Abstract: > This document describes considerations when integrating a DNS domain > name into an application environment. Goals of this document include > minimizing conflicts between the global DNS and applications that > integrate with the global DNS, providing a consistent user experience > (unique identifier across environments), and avoiding impacts to the > security, stability, and resiliency of the global DNS. While all > sources of potential concern cannot be enumerated in one document, > accounting for at least the considerations discussed here should > improve the security posture of both the global DNS and integrating > applications. > > File can be retrieved from: > https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Farchive%2Fid%2Fdraft-ietf-dnsop-integration-04.txt&data=05%7C02%7C%7Cd338edd4c3e34deb5ff008df0bea383a%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C639242772770312897%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=%2FqPQ6C9%2BHpgfQnCBhPVjmiYhNQs8FNEflThu%2BtLkNQg%3D&reserved=0 > > Please review and indicate your support or objection to proceed with the > publication of this document by replying to this email keeping [email protected] > in copy. Objections should be explained and suggestions to resolve them are > highly appreciated. > > Authors, and WG participants in general, are reminded of the Intellectual > Property Rights (IPR) disclosure obligations described in BCP 79 [1]. > Appropriate IPR disclosures required for full conformance with the provisions > of BCP 78 [1] and BCP 79 [2] must be filed, if you are aware of any. > Sanctions available for application to violators of IETF IPR Policy can be > found at [3]. > > Thank you. > > [1] https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fbcp78%2F&data=05%7C02%7C%7Cd338edd4c3e34deb5ff008df0bea383a%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C639242772770351874%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=GEGnqPGg5GW%2FC37bDr4pKzR%2BdDGAQbWvfJhW9YvMZKA%3D&reserved=0 > [2] https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fbcp79%2F&data=05%7C02%7C%7Cd338edd4c3e34deb5ff008df0bea383a%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C639242772770379479%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=5k%2FX1TfwldTFeXkuJ%2FSkEpeKXS1EReJT684SzQw2cdA%3D&reserved=0 > [3] https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Frfc6701%2F&data=05%7C02%7C%7Cd338edd4c3e34deb5ff008df0bea383a%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C639242772770402442%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=qUkxUPTgJMNtu9LljkdrF%2FtRqyBQxvyFThLAfohsgCk%3D&reserved=0 > > The IETF datatracker status page for this Internet-Draft is: > https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-dnsop-integration%2F&data=05%7C02%7C%7Cd338edd4c3e34deb5ff008df0bea383a%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C639242772770426637%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=mjFqLpTcDH%2FixqpF2t%2FzN4rGhFaQAraiisDSnJfjXR0%3D&reserved=0 > > There is also an HTML version available at: > https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Farchive%2Fid%2Fdraft-ietf-dnsop-integration-04.html&data=05%7C02%7C%7Cd338edd4c3e34deb5ff008df0bea383a%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C639242772770458839%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=MPDYhBMKcMbSQFAJQ3N0wu8IbPSTFYHSIFtUIG6%2FA%2FY%3D&reserved=0 > > A diff from the previous version is available at: > https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fauthor-tools.ietf.org%2Fiddiff%3Furl2%3Ddraft-ietf-dnsop-integration-04&data=05%7C02%7C%7Cd338edd4c3e34deb5ff008df0bea383a%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C639242772770492264%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=raCKKv9hmnDfD5h%2F11jcx9Qzx6ymL7TMWPn7q2Gdy0Y%3D&reserved=0 > > _______________________________________________ > DNSOP mailing list -- [email protected] > To unsubscribe send an email to [email protected] _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
_______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
