Hi Roy, Minor nit:
On 7/20/26 16:28, Roy Arends wrote:
3) "To avoid a downgrade attack, where the Delegation Type RRsets and NSEC (or NSEC3) records can be replaced by unsigned NS records, causing the resolver to use unencrypted transport"
[...]
I will remove ", causing the resolver to use unencrypted transport” and add a reference to paragraph 8.2.1
When reading "the Delegation Type RRsets and NSEC (or NSEC3) records can be replaced", I was briefly confused regarding what about their RRSIGs. Suggest adding "signed" before "Delegation Type RRsets", or "and their signatures" after "records". Cheers, Peter _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
