Phil comment on CNAME security for 3.5