[dd] DBOUND scope

[Ben Schwartz <[e-mail]>]

I saw a few concerns in Zulip today about whether the DBOUND-like work is addressable by any​ technical solution.  I think it is.  Additionally, I think:

* We should use DELEG to solve it.
* We should ensure that DELEG is specified so that it can be used for this (e.g. supporting SvcParams in AliasMode.)
* We should keep this solution out of scope for the charter, because it's a complex topic and requires some additional protocol elements beyond DELEG.

Here's an example:

Some browsers today show only the "registrable domain" in the title bar, to minimize user confusion.  This is sometimes the second-level domain, but not always (e.g. for co.uk).  There are also some other contexts in which the "registrable domain" is a valuable concept (e.g. rate limits for PKI certificate issuance, like Let's Encrypt [1]).

A DELEG flag meaning "this delegation is from a registry" would be useful to help clients identify the "registrable domain".  For browser use, this would require some additional protocol work, to accumulate relevant DELEG metadata and pass it back to the stub in EDNS.

It's true that further delegations down the tree could set the "registry" flag disingenuously.  That's not a problem: the client is only interested in the "topmost registrable domain", and would ignore any indications from further down the tree.

There are certainly significant challenges here, such as convincing registry and resolver operators to implement this system, but the technical function could address the relevant problem.

--Ben

[1] https://letsencrypt.org/docs/rate-limits/#:~:text=The%20main%20limit%20is%20Certificates%20per%20Registered%20Domain%20(50%20per%20week).