[DNSOP] Re: on the more general problem of delegating to other namespaces in the DNS

[Peter van Dijk <[e-mail]>]

On Tue, 2025-06-17 at 17:44 +0200, Joe Abley wrote:
> Hi all,
> 
> Warren, Wes and I put our respective heads together in Prague and came up with this:
> 
>   https://datatracker.ietf.org/doc/draft-jabley-dnsop-zone-cut-to-nowhere/
> 
> This is some general advice for how to delegate a domain to another namespace.

Based on my limited understanding of the ACME specification, and
specifically https://github.com/letsencrypt/boulder/issues/7050 being
an open, unimplented ticket for Boulder, the Let's Encrypt CA software,
I strongly suspect that adding such zone cuts would prevent the
issuance, via the dns-01 method (which, I think, is the only one
suitable for issuing certificates for private names), of Let's Encrypt
certificates.

Longer version: many people run private subdomains of public domains.
The document clearly recognises that. Some of those people use TXT
records in the public domain to complete ACME/LE dns-01 challenges to
generate certificates for those private names. With a zone cut to
nowhere, there is no place to put those TXT records. The CA/B Baseline
Requirements allow a successful challenge for example.com to also be
used to issue a cert for internal.example.com,
office.internal.example.com, *.internal.example.com, etcetera. But the
ACME specification as it is written in RFC8855 does not provide this
freedom (based on my reading). RFC9444 adds this, but LE has not
implemented it.

If I'm wrong, awesome. If I'm right, this may warrant a note in the
document. I hope somebody better versed in ACME, and specifically Let's
Encrypt's implementation, can give a more definitive answer.

I also did not look at other ACME-supporting providers.

Kind regards,
-- 
Peter van Dijk
PowerDNS.com B.V. - https://www.powerdns.com/