[apps-discuss] Comments on draft-levine-orgboundary

["Murray S. Kucherawy" <[e-mail]>]

Hi there,

Similar to draft-sullivan-domain-policy-authority, I'm interested in this
stuff from the email authentication angle.

I've offered off-list to develop this with John in terms of the text.  Here
I'm just talking about the mechanism itself.

The mechanism provided here is fairly straightforward, but there's one
limitation in particular.  You use this as an example:

A query to _ob.ca might yield a response that indicates boundaries at the
federal, provincial, and municipal levels, such as "ob=1 ca on.ca
toronto.on.ca".  The issue I can see is that in fact there are domains in
.ca, domains in .on.ca (and the other twelve), and domains in the
municipal-level domains which as I recall number in the thousands in
Canada.  It would be impossible to enumerate them all in a reply to _ob.ca,
certainly without switching to TCP or having some kind of indirection.
Might it be better to have a reply syntax that can indicate "stuff can be
registered here and up to n levels below"?

For example, maybe this would work:

ob=1 ca on.ca+1 bc.ca+1 ...

This allows domains in ca, on.ca, bc.ca, and the rest of the province
domains, and one level down from each of those (and would fit in a UDP
reply), while maybe this:

ob=1 ca on.ca/1 bc.ca/1 ...

...allows domains in ca, and then one below on.ca and bc.ca and the
province domains but not directly in them.

It also doesn't handle all of the use cases as Andrew's document does.  The
one in particular that's of interest is the "two related domains" use case
that's popped up lately in the DNS groups.  It would be great to tackle
that as well, but that may be wishful thinking here.

-MSK