[DNSOP] Re: draft-ietf-dnsop-integration text on ASCII-or-no t

Here's an updated proposal:

   DNS integrations should be aware that the list of valid global
   DNS TLDs can change, so should not hard code a list of accepted TLDs.
   If applications want a list of currently valid TLDs, they can use a
   routinely updated list of public suffixes such as that provided by
   IANA [IANA-PSL]. Failure to account for new TLDs may lead
   to inadvertent exclusion which could also lead to registrant and user
   confusion.

   When interacting with non-technical users, applications should present and
   accept domain names in Unicode "u-label" format [RFC5890].
   In the DNS wire format, applications should only use domain names that
   conform to the "Preferred Name Syntax" [RFC1123] or the Attrleaf
   syntax [RFC8553].  Applications should store and display names only in
   fully-qualified form without the final ".", unless they also
require access to
   network-local search domains [RFC3397].

   Displaying, normalizing, comparing, encoding, and decoding of domain names
   requires special processing, and cannot rely on generic string
operations alone.
   In the user interface, applications should take care to prevent
homograph attacks
(https://www.w3.org/International/articles/idn-and-iri/Overview.en#phishing).
   Other security risks include improper use of case-sensitive comparison
   and failure to reject names whose labels contain non-preferred characters.

On Tue, Jul 21, 2026 at 4:52 AM Kaizer, Andrew
<[email protected]> wrote:
>
> >
> Thanks for the proposed text, Ben! Based on Andrew Sullivan's note, would the following update to the last sentence still address your point:
>
>    When interacting with non-technical users, applications should
>    present and accept domain names in Unicode "u-label" format
>    [RFC5890].  Special care must be taken to avoid homograph attacks in
>    the user interface.  In the DNS wire format, applications should only
>    use domain names that conform to the "Preferred Name Syntax"
>    [RFC1034] or the Attrleaf syntax [RFC8553].  Domain names in wire-
>    format should be checked for alignment with such syntax to avoid
>    security risks and user confusion.
>
> -- Andrew Kaizer
>
> On 7/20/26, 10:28 PM, "Andrew Sullivan" <[email protected] <mailto:[email protected]>> wrote:
>
>
> Caution: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.
>
>
> On Mon, Jul 20, 2026 at 02:45:24PM -0500, Ben Schwartz wrote:
> > Domain names in wire-format should be checked for non-compliant
> >characters (e.g.
> > labels containing ".", uppercase, whitespace, or non-ASCII characters) due to
> > security risks.
>
>
> I'd be pretty surprised to learn that labels containing uppercase characters have wire-format labels that are not compliant. The protocol documents explicitly say you're supposed to preserve the case but ignore it for matching purposes.
>
>
> A
>
>
> --
> Andrew Sullivan
> [email protected] <mailto:[email protected]>
>
>
> _______________________________________________
> DNSOP mailing list -- [email protected] <mailto:[email protected]>
> To unsubscribe send an email to [email protected] <mailto:[email protected]>
>
>
>
> _______________________________________________
> DNSOP mailing list -- [email protected]
> To unsubscribe send an email to [email protected]

_______________________________________________
DNSOP mailing list -- [email protected]
To unsubscribe send an email to [email protected]