Re: WG chair nits on draft-ietf-secsh-dns-02.txt

[Jakob Schlyter <jakob%crt.se@localhost>]

we suggest the following changes.

	jakob

@@ -304,7 +304,14 @@
    <t>
     As stated in <xref target="policy"></xref>, we recommend that SSH
     implementors provide a policy mechanism to control the order of
-    methods used for host key verification.
+    methods used for host key verification. One specific scenario for
+    having a configurable policy is where clients use unqualified host
+    names to connect to servers. In this case, we recommend that SSH
+    implementations check the host key against a local database before
+    verifying the key via the fingerprint returned from DNS. This
+    would help prevent an attacker from injecting a DNS search path
+    into the local resolver and forcing the client to connect to a
+    different host.
    </t>

    <t>