Re: [apps-discuss] "finding registered domains"

["MH Michael Hammer (5304)" <[e-mail]>]

> -----Original Message-----
> From: [e-mail] [mailto:apps-discuss-
> [e-mail]] On Behalf Of Andrew Sullivan
> Sent: Tuesday, March 12, 2013 11:27 PM
> To: [e-mail]
> Subject: Re: [apps-discuss] "finding registered domains"
> 
> On Tue, Mar 12, 2013 at 06:58:28PM -0400, Murray S. Kucherawy wrote:
> > In my use case, it's defined that an example.com policy is used (if it
> > exists) in the absence of a foo.bar.example.com policy.  The problem
> > is I don't know how far up the tree to make that second query.
> 
> In order for that to be defined, you put a SOPA record at
> foo.bar.example.com that says "example.com".  If you have no SOPA record,
> the policy for foo.bar.example.com is "nobody else shares this".  This is a
> "default closed" policy, which I think has to be the right one.
> 

I'm trying to wrap my head around this for the use case for domain trees such as example.co.uk. We know (or should know) that the (or at least one important) cut is always going to be at .co.uk. I think this is one of the use cases that has been problematic. Do we really want to rely on each subdomain up the tree publishing a SOPA record for this type of case? What do we do when some subdomains publish and others do not? Is the intent to force domain administrators to go along by them ending up with suboptimal outcomes if they don't?

I'm not asking these things to be snarky - I'm really not clear on the thinking here. In the email authentication space we've always gone to some lengths to avoid imposing new standards (SPF, DKIM, DMARC) on folks that don't really care to participate. I'm also concerned because my experience is that so many admins/domain owners get even the simplest DNS records wrong in implementation.

> There's something slightly awkward about this for the CA case, however,
> when you have deep trees and you want a wildcard cert that descends the
> tree from example.com.  I'm still not sure what to do about that, because it's
> going to be impossible to enumerate all the names under a wildcard (and
> anyway, you can't do multi-label wildcards).  I remain a little unhappy about
> this, but it strikes me that anyone doing wildcard certs for deep trees may be
> in a world of hurt anyway, and it would be better to add an additional SOPA
> record for (for instance) *.oneIactuallyWant.example.com.
> 
> > So in my case I explicitly will believe the
> > parent/grandparent/whatever statement, but I don't know how far up to
> > go, and I don't want to ask everyone; I only want to ask at most two
> questions.
> 
> As long as you have the pointer up the tree, that should work.
> 
> A
> 
> --

Mike