IETF conflict review for draft-gieben-auth-denial-of-existence-dns
conflict-review-gieben-auth-denial-of-existence-dns-00

The following approval message was sent
From: The IESG
To: "Nevil Brownlee" , draft-gieben-auth-denial-of-existence-dns@tools.ietf.org
Cc: The IESG , , 
Subject: Results of IETF-conflict review for draft-gieben-auth-denial-of-existence-dns-05

The IESG has completed a review of
draft-gieben-auth-denial-of-existence-dns-05 consistent with RFC5742.


The IESG has no problem with the publication of 'Authenticated Denial of
Existence in the DNS'
as an Informational RFC.


The IESG has concluded that there is no conflict between this document
and IETF work.


The IESG would also like the RFC-Editor to review the comments in the
datatracker related to this document and determine whether or not they
merit incorporation into the document. Comments may exist in both the
ballot and the history log.

The IESG review is documented at:
http://datatracker.ietf.org/doc/conflict-review-gieben-auth-denial-of-existence-dns/

A URL of the reviewed Internet Draft is:
http://datatracker.ietf.org/doc/draft-gieben-auth-denial-of-existence-dns/

The process for such documents is described at
http://www.rfc-editor.org/indsubs.html

Thank you,

The IESG Secretary

I asked on the dnsext mailing list and nobody objected to this; indeed, it got some good additional review and comment and the authors are updating the document.  So I don't see a conflict here, and I think the right things are happening with the document.

Hi IESG Secretary:

The draft draft-gieben-auth-denial-of-existence-dns-03
is ready for publication from the Independent Stream.
Please ask IESG to review it, as set out in RFC 5742.

The following is some background for this draft, please forward it
to IESG along with this request ...

Its title is:
Authenticated Denial of Existence in the DNS

Its abstract says:
"Authenticated denial of existence allows a resolver to validate that
a certain domain name does not exist. It is also used to signal that
a domain name exists, but does not have the specific RR type you were
asking for. When returning a negative DNSSEC response, a name server
usually includes up to two NSEC records. With NSEC3 this amount is
three. This document provides additional background commentary and
some context for the NSEC and NSEC3 mechanisms used by DNSSEC to
provide authenticated denial of existence responses"

It was reviewed for me by Joe Abley and Geoff Huston, both of them
made suggestions for improvements.
The authors have made thos improvements in their -02 and -03
versions, I have checked that they are sensible responses to the
reviewers' suggestions.

Thanks, Nevil (ISE)