Re: [dnsext] Advice sought on DNS file format for new RRs

[Phillip Hallam-Baker <[e-mail]>]

I think that it is right that people will perform such checking, but to do
so on the basis of current CA issuing authorizations will lead to error.

When example.com changes from VeriSign to Comodo they would expect to change
their CAA record to revoke VeriSign's issue authorization immediately. They
would not want this to invalidate existing certificates.


Looking at the mechanics of Certificate management within enterprises, I
think it is going to be necessary for most sites to get their issue of certs
under control as a pre-condition for implementing client enforceable policy.

We had this experience with DKIM. It did not take as much time to write the
spec as people imagine. What really took the time was the fact that
deployment at the sites that mattered required a vast amount of effort to
catalog what was already deployed. From a technical standpoint, DKIM is very
easy to deploy, from an administrative standpoint it is really easy to
administer once it is installed. But going from not using DKIM to using DKIM
can require major changes to management processes and in some cases
centralization of concerns that had previously not been tracked at all.


That is why I think that we need to separate this part of the problem from
the rest and why I think we need a separate DNS RR.



On Mon, Nov 22, 2010 at 11:04 AM, Tony Finch <[e-mail]> wrote:

> On Fri, 19 Nov 2010, Phillip Hallam-Baker wrote:
> >
> > The community that is going to use the published information is about 50,
> > highly technical organizations who are only going to make use of the
> > information to effect additional validation checks within a precisely
> > calibrated legal process.
>
> I expect that whether you like it or not, people other than CAs are going
> to check the assertions in these records, and they are going to implement
> these checks in widely-deployed software.
>
> Tony.
> --
> f.anthony.n.finch  <[e-mail]>  http://dotat.at/
> HUMBER THAMES DOVER WIGHT PORTLAND: NORTH BACKING WEST OR NORTHWEST, 5 TO
> 7,
> DECREASING 4 OR 5, OCCASIONALLY 6 LATER IN HUMBER AND THAMES. MODERATE OR
> ROUGH. RAIN THEN FAIR. GOOD.
>



-- 
Website: http://hallambaker.com/