[Dbound] Online vs Offline modes

[Jeffrey Walton <[e-mail]>]

I think one thing to consider with the Dbound is online vs offline modes.

It looks like the two drafts [1,2] both have online requirements. I
don't mind the online requirement when collecting information or
building a list as a prep step to compiling my program. But when my
program operates in the field, I want to avoid going online.

The extra online query is an additional point of network failure.
Plus, I don't know that I'm getting an authentic answer under many
circumstances. I can tolerate the potential failures when gathering
information or building a list. But at runtime, I don't want to
introduce the additional risks.

This might be a unrealistic requirement when solving the general
problem, but I think its reasonable in my case. My case is validating
host name data in an X509 certificate with an emphasis on catching
wildcards in gTLDs and ccTLDs. I'm less concerned about administrative
boundaries in subdomains.

[1] draft-levine-orgboundary
[2] draft-sullivan-domain-policy-authority