Re: [dbound] draft-brotman-rdbd

[Andrew Sullivan <[e-mail]>]

Hi,

Since this is the place, I read draft-brotman-rdbd-00 and have a few
observations.

I'm slightly concerned at the way this is being conceived, because I
think it has a conceptual separation in it that is troublesome.  It's
found here:

   RDBD is intended to demonstrate a relationship between registered
   domains, not individual hostnames.  That is to say that the
   relationship should exist between "example.com" and "dept-
   example.com", not "foo.example.com" and "bar.dept-example.com".

The problem, of course, is that foo.example.com, bar.dept-example.com,
and really.long.set.of.labels.example.com are all _perfectly good_
domains.  Now, maybe what the above intends to communicate is that
RDBD is intended to demonstrate a relationship between the owner name
at an apex and all the subsidiary names in that zone (i.e. up until
any subordinate zone cut), and the owner name at an apex and all the
subsidiary names in _that_ zone.  Alternatively, maybe what the above
intends to communicate is that RDBD is intended to demonstrate a
relationship between owner names immediately below a so-called public
suffix.  I can imagine use cases for either, though I am not sure
they're as general purpose as people might think.

I am more than a little worried about the parent/secondary split.
(Also, both of these are already well-used terms in the DNS, so I
really strongly urge some other terms.  We have enough trouble with
overloading DNS terms without doing so with two of the most frequently
used terms in DNS operations, particularly when this mixes terms from
delegation and from zone transfers.)  It isn't clear to me, from the
discussion, that it is obviously true in most of the use cases people
have that one of the domains people want to talk about is "the main
one".  More importantly, it is quite likely that someone trying to
query this will have a different idea about which is "main" than the
domain operator, so if this isn't a fully bidirectional operation
(which it's not in -00) there could easily be problems in use.  (This
is part of why SOPA was proposed to be two-way.)

If you're going to do this with TXT records, then you definitely need
an underscore label, or the apex name is going to be a mess.  But that
will mean that this won't work for DNAME.  That consideration is part
of why SOPA defined a new RRTYPE and put the RR at the name that was
supposed to be related.

I hope these comments are useful.  I have limited cycles to spend on
IETF stuff these days, but this was always a topic close to my heart
(and I'm super annoyed the DBOUND WG failed), so I'll try to keep up.

A

-- 
Andrew Sullivan
[e-mail]