[dns-dir] How bad an idea is this?

[Andrew Sullivan <[e-mail]>]

Dear colleagues,

I wasn't sure where else to send this: it's not actually about the
protocol, and it's not about operations as such, but it is about the
(ab)use of the DNS.  Suggestions for a better target welcome, but
reactions to the suggestion below are even more welcome.

In draft-sullivan-domain-origin-assert-00, I outline a mechanism to
make claims about whether a given DNS name lies within the same
administrative realm as another name.  By "same administrative realm",
what I mean to say is that the services at that name and at some other
name are somehow subject to the same control, &c.  The standard
example of where this might help is with the "cookies problem", but I
don't think we have to be too creative to think of ways in which it
would be helpful to know that services at different names are related
to one another in important ways, without really being "the same
service".

I received a number of comments about that draft, not least of which
was that to be useful it needed finer granularity.  (More exactly, the
mechanism is apparently worthless without being able to specify it by
scheme, port, _and_ name.)  That would be easy given that I was
originally inclined to create a new RRTYPE, except that I also heard
over and over again that new RRTYPEs are not deployable: the
provisioning software doesn't know how to do it.  I have some sympathy
for this, since Dyn (who partly pays for the roof over my head) has
plenty of clueful staff, but avoids completely unknown RRTYPE support
in its consumer-grade offerings because of the potential support
headaches.

As a result of this, I have been toying with reusing the SRV RRTYPE,
adding some additional underscore labels to the front.  This idea
makes me want to tear at my clothes, but I haven't been able to think
of ways in which it actually breaks anything.  Does anyone have such
an argument?

In addition (just to make you even more queasy), it seems to me that
the mechanism is going to have to be able to say "for everything under
this name, the same label under that name".  A wildcard isn't exactly
going to work, particularly on the target side of the SRV record.  I
was thinking of inventing a new "prefix" (like the xn-- in IDNA) to
express this sort of thing.  It's yet more evidence, I think, that a
real RRTYPE with its own semantics is just going to be necessary, but
that probably means the mechanism will never get deployed.

Thoughts?

A

-- 
Andrew Sullivan
[e-mail]