[apps-discuss] Comments on draft-sullivan-domain-policy-authority

["Murray S. Kucherawy" <[e-mail]>]

As someone who's involved in email authentication work, identifying the
apex of authority given an arbitrary domain name has long been a valuable
goal.  The current way to do this (the public suffix list) is undesirable,
but it's currently the only way to do this.

This draft proposes a new solution to this problem and also takes into
scope several other related problem statements.  It does a very good job
describing the problem spaces and also is very up front of its various (and
in a couple of cases, daunting) limitations.  I'd love to be part of a
conversation that talks about how to mitigate some or all of those.

One thing it doesn't mention is that it will require a SOPA record to be
created at every extant node in the DNS tree for a domain that wishes to
make use of it.  Unless I've misread something, the document does indicate
that a node can indicate it is in the same policy realm as all of its
descendants, but it also says this relationship needs to be confirmed to be
believed.  That means all of the descendant nodes also have to have SOPA
records pointing back to that parent node.  If I'm understanding that
correctly, the document should probably call this out as a constraint as
well.

There's another related document, draft-levine-orgboundary, about which
I'll comment separately.  I wonder, though, since we have time on the
APPSAWG/APPAREA agenda, if the authors of both drafts would be interested
in talking to that audience about their ideas in Berlin.

-MSK