Re: [dbound] [art] Related Domains By DNS (RDBD) Draft

[Stephen Farrell <[e-mail]>]

Hiya,

On 26/02/2019 15:26, John R Levine wrote:
>> Main differences I see are:
>> - RDBD has DKIM-like signatures (so a bit of computational
>>  complexity)
> 
> It does, but they don't prove anything that you wouldn't already know if
> you can look stuff up in the DNS.

Not sure I agree. While I accept a signature doesn't
provide a strong "proof", it can provide evidence
that the primary is ok with the secondary claiming
that some relationship exists and that the primary
was involved in creation of the RR values. (The "can
provide evidence" above of course depends on things
like DNSSEC or using a previously cached version of
the public key etc.)

But regardless of that...

> 
> ... So if you want to do
> this, here's what I'd do.
> 
> We have a new record type, call it SAME.  Each SAME record has a flag
> for parent/child and a domain name.  So if foo.com wants to say it's the
> same as foo-bar.org:
> 
> foo.com. SAME 1 foo-bar.org.
> 
> foo-bar.org SAME 0 foo.com.
> 
> If foo.com wants to claim many other domains, it can publish as many
> SAME records as it needs to.

I'd be fine if we had such an RFC and be happy if people
wanted to publish such RRs in their zones.

If the above existed, we could in any case define a way
to digitally sign for the relationship separately, if
there was support for doing so, and that could be done
now or later.

> If new RRs are too scary, you can do it with a txt record and a prefix:
> 
> _same.foo.com TXT "v=same 1 foo-bar.org"
> 
> _same.foo-bar.org TXT "v=same 0 foo.com"

Could be done. I suspect the IETF-process overhead of
having a fight over TXT vs a new RR type isn't really
worthwhile myself, so a new RR type would be just fine
by me.

Cheers,
S.


> 
> Regards,
> John Levine, [e-mail], Taughannock Networks, Trumansburg NY
> "I dropped the toothpaste", said Tom, crestfallenly.
> 
> _______________________________________________
> dbound mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dbound