Thank you for sharing your thoughts. I appreciate your perspective and understand the practical concerns you raised. I agree that using unique random validation tokens is an important best practice that should be encouraged across applications.
AliasLeap could serve as a useful real-world example illustrating the potential security consequences of not adopting this practice. In particular, the risks are not limited to dangling DNS records but can also arise from CNAME following in otherwise legitimate DNS configurations. I believe briefly mentioning this scenario could further reinforce the importance of the draft's existing recommendations, without requiring any substantial changes to its scope or direction. Thank you again for considering my suggestions and for your efforts on this draft. Best regards, Ruixuan > -----原始邮件----- > 发件人: "Paul Wouters" <[email protected]> > 发送时间:2026-10-14 05:38:09 (星期三) > 收件人: [email protected] > 抄送: "Erik Nygren" <[email protected]>, > [email protected], [email protected], > [email protected] > 主题: Re: [DNSOP] Re: Security consideration for > draft-ietf-dnsop-domain-verification-techniques > > On Tue, 13 Oct 2026, [email protected] wrote: > > > I agree with the draft's recommendation to use unique validation tokens, as > > this is an effective mitigation against the AliasLeap attack. I do not > > think the current > > recommendations are incorrect, but they may overlook some security risks. > > Therefore, I believe it would be reasonable to discuss the risks > > highlighted by AliasLeap > > in the Threat Model, Security Considerations, or the CNAME usage section. > > The document is mostly about how to do things right, not on explaining > the many wrong things one can do. The document aims at a concrete BCP, > and this is different from a whitepaper about a found security issue. > > > For these reasons, I believe that prohibiting CNAME following during DCV is > > a necessary security measure. > > That is going to be very very difficult, as most people who implement > DCV are application developers, and not DNS engineers/experts. They > will just use an existing DNS server or library and that in turn > will just follow CNAMEs. Asking them to develop some backend code > that has custom DNS processing will be very difficult and also > error prone. > > Therefor, randomization remains an essential property that developers > should not skip. > > Paul _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
