Re: [DNSOP] Tell me about tree walks

[Paul Vixie <[e-mail]>]

On Wed, Nov 11, 2020 at 05:45:52PM -0500, Joe Abley wrote:
> On 11 Nov 2020, at 17:08, Paul Vixie <[e-mail]> wrote:
> 
> > if you guys are going to automate and secure the public suffix list
> > functionality, please spare a thought for automated / at-scale ("not
> > in whois") identification of the domain's registrar and registrant.
> 
> I understand the reason why being able to identify the registrar for a
> particular domain is useful (or "necessary" depending on your perspective).
> I don't understand the overlap between this problem and the problem that
> John is trying to solve, though. Could you explain?

i'm happy to try. otherwise i'll just be sheltering in place.

what the public suffix list does is keep track of a set of labels under
which responsibility has almost always shifted. for example, under COM,
unless it's verisign.com, the "." between example and com in example.com
represents a change-of-party. knowing when this happens is necessary for
a lot of security-related purposes, for example, same-origin web policies
where labs.fsi.io may want to emit a cookie for fsi.io or www.fsi.io but
should be prevented from emitting one for gandi.io ("won't be believed").

doing this syntactically failed, because of co.uk and a lot of other
things that aren't TLD's but act like them (subdomains belong to someone
other than the delegator.) the public suffix list avoids syntax limits
by simply listing all the domains whose subdomains belong to others.
this comes up in dynamic dns providers also; it's not just a TLD thing
or an "effective TLD" thing. however, the public suffix list should
remind us all of HOSTS.TXT, and we should remember why DNS was invented.

so, some signal pattern (e.g., an RRset) that was in-band (not in a file)
and available at-scale (subject to DNS caching) could at a minimum solve
the problem john brought up, asserting for example that "subdomains of COM
are different parties".

what i'm asking is that if we're going that far we overload this signal
pattern slightly by letting it assert that "the registrar for fsi.io is
gandi" or even "the registrant for fsi.io is farsight". an RP RR could
be used. if you find an RP at some dns vertex you can assume it's only
there because it differs from the parent, or you can tree walk to be
sure, if you care.

but where to find that RP isn't obvious. fsi.io may be a criminal who
does not want anyone to know who its registrar (or registrant) was. so
a cousin domain such as should have been used for DS might be specified:
look in at fsi._registrar._meta.io and fsi._registrant._meta.io for them.

this is many orders of magnitude more state mass than would be required
just for io (and com and co.uk and so on) to say "my subdomains belong
to other parties") but would provide a useful metric for service quality
differentiation among registrars, and would also solve for john's need.

people you (joe) know personally would love to be able to tell potential
customers that if they don't want their domains marked in this way, they
should find some registrar who cares less.

-- 
Paul Vixie