On Tue, 13 Oct 2026, [email protected] wrote:
I agree with the draft's recommendation to use unique validation tokens, as this is an effective mitigation against the AliasLeap attack. I do not think the current recommendations are incorrect, but they may overlook some security risks. Therefore, I believe it would be reasonable to discuss the risks highlighted by AliasLeap in the Threat Model, Security Considerations, or the CNAME usage section.
The document is mostly about how to do things right, not on explaining the many wrong things one can do. The document aims at a concrete BCP, and this is different from a whitepaper about a found security issue.
For these reasons, I believe that prohibiting CNAME following during DCV is a necessary security measure.
That is going to be very very difficult, as most people who implement DCV are application developers, and not DNS engineers/experts. They will just use an existing DNS server or library and that in turn will just follow CNAMEs. Asking them to develop some backend code that has custom DNS processing will be very difficult and also error prone. Therefor, randomization remains an essential property that developers should not skip. Paul _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
