IETF Logo Mail Archive

[DNSOP] Re: [Ext] Persistence of DCV, including for Delegated DCV (for draft-ietf-dnsop-domain-verification-techniques)

Ben Schwartz <bemasc@meta.com> Mon, 12 May 2025 20:44 UTC

Return-Path: <prvs=1227382186=bemasc@meta.com>
X-Original-To: dnsop@mail2.ietf.org
Delivered-To: dnsop@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 45C2427BC2F7 for <dnsop@mail2.ietf.org>; Mon, 12 May 2025 13:44:42 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.793
X-Spam-Level:
X-Spam-Status: No, score=-2.793 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=meta.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v_hF_9Vpull4 for <dnsop@mail2.ietf.org>; Mon, 12 May 2025 13:44:41 -0700 (PDT)
Received: from mx0a-00082601.pphosted.com (mx0b-00082601.pphosted.com [67.231.153.30]) by mail2.ietf.org (Postfix) with ESMTP id 2D8AC27BC2F0 for <dnsop@ietf.org>; Mon, 12 May 2025 13:44:40 -0700 (PDT)
Received: from pps.filterd (m0001303.ppops.net [127.0.0.1]) by m0001303.ppops.net (8.18.1.2/8.18.1.2) with ESMTP id 54CKbZIW019882; Mon, 12 May 2025 13:44:18 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=meta.com; h=cc :content-type:date:from:in-reply-to:message-id:mime-version :references:subject:to; s=s2048-2021-q4; bh=bWQHmATF63S6eOLUaUzo X5OFSvwLlkgO7oeyypRka54=; b=B8Cak2e1mEIa5bVJOY4pEdA0eGXM6tpFkXt/ gwtwmK+KXu71+nVFYNcN4TbuAzSjgwH/yLrkJZZ8sK6O0mCpefubqMumKUYNwBQS 30ZteaJLYauMSD8WEIG7AhhIAUpg8ohRtTa07EQ9Guy0ZvZE1uDRlXFlJwrkRGOB bLhzpsglnGmcazy2oc3BLdc9hFCFCIlHJROxhWFRO236cRm08q//y4MBZdvp4vMr pFxWG7qB8cUL3Xo+RJDIpRw7Bfr1hdePIUUOcpeYBvzZZ0yKfFOOxjxhfPnqy4ah 5AJZ30IjD0wcEvOQOcmnt6Ir5KvX2UU5LW6NVgZBNP8IqnjIqA==
Received: from nam10-dm6-obe.outbound.protection.outlook.com (mail-dm6nam10lp2044.outbound.protection.outlook.com [104.47.58.44]) by m0001303.ppops.net (PPS) with ESMTPS id 46k5ccxugw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 12 May 2025 13:44:17 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=IQde6Z8cERDnBhFSgCgqHmS+9Nj2/nbUAbra6KzrLdTuAIPJI6hihbQp6+SFh5FmSPy2nSeMFObdyQdoQRqxwjX8W0FlLlu0y9aRouuJU4MwNAY2x2LnzW/I9WGWMN/WcHfoPanW5Tu0p8sLOdMFB/SOWgz4+ZqjhJAKbRrw1xmCu2umT/XYxtWRO4wX5MQ3JjJel/nSF30QkXldx4uX4djeFIvFKZWW2wHNv4KcL56oD2eIHlGcfmnilO1WXkSptsUrHV5futKQiniNnHmDRu6YMgHBwbnLNDP3Q8PSzkqp156Yb25AftgVp8LQxldoDnxMXJL7/QyJIIgHg1pQgA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=bWQHmATF63S6eOLUaUzoX5OFSvwLlkgO7oeyypRka54=; b=lrTsJ1zauE4btoiJaoM8ld7MNdEgshpLW26Ffaf4Lvxf/Rdrn1747qiazH20yXlghS5W293FoCXxeeBw5errkvgHEZeopuDpCAUoDJAugeQJSmoF2dbeHing2HhXxEP/WgZqlKK36JRr6qWxhNkE0iKSkf1q/e/AaQsDO+i93wj34d+RYJ5XCa8+kQeJIZkHvhgIcEOMDYMhf5XxlPTQy5M/6wFxeOPSnJGXIizqyFaLxAHBt2t0oRqbh1560dtycZvirncQ9nSIfbDssZMykUGBnyAUCrNBjkSNd7XB3ZDj7XSz8FxVkcsMM2N5WrrFFoYg5w7DfXvo3+bQ5HJpRw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=meta.com; dmarc=pass action=none header.from=meta.com; dkim=pass header.d=meta.com; arc=none
Received: from SA1PR15MB4370.namprd15.prod.outlook.com (2603:10b6:806:191::8) by PH0PR15MB4480.namprd15.prod.outlook.com (2603:10b6:510:86::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8722.29; Mon, 12 May 2025 20:44:15 +0000
Received: from SA1PR15MB4370.namprd15.prod.outlook.com ([fe80::b6dd:72cc:243a:babb]) by SA1PR15MB4370.namprd15.prod.outlook.com ([fe80::b6dd:72cc:243a:babb%6]) with mapi id 15.20.8722.027; Mon, 12 May 2025 20:44:15 +0000
From: Ben Schwartz <bemasc@meta.com>
To: Paul Wouters <paul@nohats.ca>
Thread-Topic: [DNSOP] Re: [Ext] Persistence of DCV, including for Delegated DCV (for draft-ietf-dnsop-domain-verification-techniques)
Thread-Index: AQHbvp+M3AnOaq0ojUaBCQcWT05HUbPPNvmAgAAE7oCAAANIAIAABl7EgAAYbACAABp1cg==
Date: Mon, 12 May 2025 20:44:15 +0000
Message-ID: <SA1PR15MB4370B829C3CC8D4D5799309DB397A@SA1PR15MB4370.namprd15.prod.outlook.com>
References: <CAKC-DJiQXWqT+kitGO_bjdwAzN8u11WrGfSpE99HGtoVbg9OHw@mail.gmail.com> <C42CC896-CA4C-4894-9A35-D5027FD48521@icann.org> <1f9237cf-fc78-3e12-f8bb-40699dc04d21@nohats.ca> <CAKC-DJhLGHmWVT8JYkSHAfm7HiT8dLmiOqN6Aqc2kN4dyXK96g@mail.gmail.com> <SA1PR15MB43706B717CABF88178152F57B397A@SA1PR15MB4370.namprd15.prod.outlook.com> <7f785910-73c9-f322-b0f1-839cd3f7cce8@nohats.ca>
In-Reply-To: <7f785910-73c9-f322-b0f1-839cd3f7cce8@nohats.ca>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels:
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: SA1PR15MB4370:EE_|PH0PR15MB4480:EE_
x-ms-office365-filtering-correlation-id: 544d59f9-86b5-4002-afd2-08dd9195c2a2
x-fb-source: Internal
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|376014|1800799024|366016|8096899003|13003099007|7053199007|38070700018;
x-microsoft-antispam-message-info: gDfHnAhX5MNYhziwr0pMQd33tTRecSFQuVky4kRfOB7I8BX4fo1jtGMmiv5Qegi27FJfokUoQMyMo7hqGmp/XW1J/kmy/axanasGtGIsNXg5erQE4Dvfvb+l10bc90qlio/v52eSR8k0b4WuVnQF71QwjKPpA7gGYjMy63hhiLCUV+p41pDyG2hpNP6QfW9z72dnja+ykhPYdCe/qq88Q/6QYYbzS1azS3jZtT0NCHjAFj0ZBGeNMzEN7DmpxLW2WnER4eSr4HeKDdClOoXVA9Ui8A+zo2PulPiKk6eQAN7SMo+Zor4SOtUwfIEYgZkBkq35Q6Mq6uCfEL79NOrON0TpL1WGYYT/VcEu1YCjpERyeJHuVY1iWYe/N0KMrzyX2K4viwmRXp/E+Bjgpt+vVTf+aC7OxSNG+aT7/q/EKGt3LtPmk8PVK6ZdDsTxZg69H0YkaDYYKcw/fFkzY0wMl3sBS1y7Ukfxr830DlNhLGDNqGLQ69bautVFTq118kR02mc2JenjYmzyPTYGzvoMluPUWpV9v5DlvTIbvLHE4aNRDEFnJOP3DHyoNH80cO+v3MAHAIiF6C/Wqo9mSmmvRsJ4zkTTGH+WEHEPxmVbr9crMKeV7ibndijrYtuE0nqCt2NdGE7jEqToxgpWtg/2IvygdPIsYGIfs3aOtPa0M4wpY2F7hmVBWhpJr3425ZRvtNq935e/eyOPab/pl1DTMhaM9zlMu0VkEm5KlCNXU6yeatnpc6z7Q5Z9EhkLseaXvzAOKNeA8z2sdRinbYLrlDTXuvHxpcs0F+VHb7PdzA5OhsASSlA5Lwp/vlOqgkp4bqkV5n117M4bnls8HdksTXnKDwnfnO7xtx5Fnr8TnjMJLCQUrnwusse5ySCyGlt90TKGSZQQNI2KI3/4+biiPpg0seTRip+ucmJvtHIhHmifbzNq6y2W+bvZ+EVQEXkTyZVnPbKdSaOxj6+mzt3sA/Sv1G5PjvFEQd7XX0coc88apnF7dCRwiP8UDakET/ksId2nreKjqFQxm2rfjeVja6hoEuHiJYX7gOsCGoABaMQ5SPPZlr84R6Ge3KFtsMbfiaXLGGx5xsKty7zW3yJCSPaBaJV81ORw1PdQ7EuDi13i8bzLwojgFZirWwO7g8okVuuiRIeDzh9uc3JWMbinVEusKW9WryVjryN8pKQTMfjEGsaYIXXzAqRFEbSxKiWca4YkZ0kI8IM8fFOP8guIxXSU2aw8zAADSeABMzyNOkJ0xlvDcq+4uMekJ2LeCCsV6Aeuc5Nzs11tDOmKPrX0Bw6XXSWkb+Ozk6W9EvriN6ZlakhAzb37pC70ozmNiEE8KReT0PdQoUs8R6OZNMayS5D7IgjlE1o4wKVeE/c9xl14ae2NqcHaVCR3cRQhFx6pQVVJ+tOZsfiOnSKXnWi0IJyTRQvWh3UugH9J5FGeVBbHMUOI9MtQmCG3NQFHOGedmBWkQ0TQzkhL01p67nb08pKB1HZYXoCl+3Z+dXAzALM=
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SA1PR15MB4370.namprd15.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(1800799024)(366016)(8096899003)(13003099007)(7053199007)(38070700018);DIR:OUT;SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: JvCs/8Pqeaok4mvSlhPRfatxoeBWJRuWCXE4t5oPp4zr+wwBGSegPoavynH9aFsO5TUPNXXmOzJQpUoaMY5rJudc3JuqMQgbFAJKe0tHKT6i8NVNEuAapEaR6t6PDbn7dSo/I43Z8QpGRHKiWiLQN0unCasTnp2sINdXY6EnapFv6IPTYgkMZ5QJYIjramsWNJ5sdxQLWMVLcZTvOseU3WzmMwDuE3JhV8QzE5Awhyo/5VeqBR5fsly1ERuWFj+qMegL9V9qm1eIfpVBvdY6DWxZQoPnah7wGllRZXHrhpbVuluhrr29diHJBnf2vHomUcsKTW1jENCPKAAj4Q+Q8zfUFsbvmZ5FCDK+r+Ju+We6+lZkPeEpih8hJGtN29TIWiYDi2PAl8H0wW1U9NBmPOip7pRcOqbo2aAxLf4ZohJFHaeG5rH/m9BNSy1vdyjfDl2grjZNJoHurvfr6MNVVdCSoZKu1wzstofJJq11s1GIhd5mKzZrbf6XHzT49g95fYuB/zcqBZ4zzZcwRd3iANsNtDKhk1mxpo6WpcJBEowPMf1OAwQdv3mA6obwYv+4zJD/Y4curhBaBANyS0Tbyz0zvD0lLI0CzMYxKRsz3SdPoqChOwzJJO2knDydkq3L4UHdgRQNKzaTTXxOc2EYcN7wNTvu/4qGfTZXSnph8efJ5gBzE/lOi4ReW+4vICiZ8LalLVk5FCzhJYSu7ec06Y/ZfGaypYDTXlygi0s2x4aklGHc6AvYI4QMIx7RCkAppTN5B1+kmg+E8OSM/Q+9rav82HGU/31OtWEUdFbxB9IoPKp8AhWfYOmMVtC6iKaPtqqgxmRp2ABHsyvSntU6nest8sfsxStYQkyBcliBWAFlb1Nl6KyTNifd2QKfgBthOjPxaWUOpwt/Qj85uGFW3BrwHLIz5dWgmab7TYwewvBukBrHGmaQRqoEc8osAplRb03UzGB8y0c9NZs5jzx8fz1xZXWjc8KxwSZQWf06o9rRQn03tLmZMil+dxFvo6foLXfoLNXDbGd5Y+QLDoHs4FoqzW/3vkdg8K2Mdi8T/W70pHkbcjlL37XrdDmnorwT4KBv8SIIlZL4xyy4TotXjntS8vFiDDqy/LTnc0yJAtSQS/mT8+I4RvESX65KmR3eMdI+jSb8cjeYuRA8SwVD2HGmVh0gr9LD77GiNiYmgDV9KPYNc92+fFwoR9/UVbohrh3dyk2DgB65UNLhEhsju3v9+os+mxLTgMj7mzbFkcp8v0zpObZTHZ/HpLcFzvmRM/kC1PygT+Na0BV97GOKBQNODL13vlRheAKfWHN/1DORuerveR9kJqNI6IJtMI2yDkPSqAiK6FyA5sSezjmNlo07UuscCku/0/68+w3mNbqjvSwvXO1/CC3RIt1c97ihf3BjXOf0fcc6uBDr0pYxqdkkdC3HrC6a9/uKBArujEp2AhOOJ+aREUjAji+ibUzfD+cgJLj3f6cx/pf4HMnbt+CNAPFtE/fXe4dNe9QkbPHjhVOC0UtYsWarQxBFbGHaJw4mrX61QWIiWxcxDknU56kApQdYU9slyAqvneq7tZI=
Content-Type: multipart/alternative; boundary="_000_SA1PR15MB4370B829C3CC8D4D5799309DB397ASA1PR15MB4370namp_"
MIME-Version: 1.0
X-OriginatorOrg: meta.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SA1PR15MB4370.namprd15.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 544d59f9-86b5-4002-afd2-08dd9195c2a2
X-MS-Exchange-CrossTenant-originalarrivaltime: 12 May 2025 20:44:15.7504 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: uTaHU8eDZkUGvT2rZaSBMdY1lT2CNZwzTAWRCEarcPEfe4diWqdrRrJzCuATEBih
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR15MB4480
X-Authority-Analysis: v=2.4 cv=EaPIQOmC c=1 sm=1 tr=0 ts=68225da1 cx=c_pps a=di3315gfm3qlniCp1Rh91A==:117 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=wKuvFiaSGQ0qltdbU6+NXLB8nM8=:19 a=Ol13hO9ccFRV9qXi2t6ftBPywas=:19 a=xqWC_Br6kY4A:10 a=dt9VzEwgFbYA:10 a=NEAV23lmAAAA:8 a=N7iCXatbAAAA:8 a=ot94w4V77n00waI2zBsA:9 a=wPNLvfGTeEIA:10 a=LdGjuZ6kTDzoB08S:21 a=frz4AuCg-hUA:10 a=_W_S_7VecoQA:10 a=96hUrU2xWrTe0OLsCvyc:22
X-Proofpoint-GUID: 8KWBqFZP0TsM34CgGBt1Vc26pw2TlTCz
X-Proofpoint-ORIG-GUID: 8KWBqFZP0TsM34CgGBt1Vc26pw2TlTCz
X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNTEyMDIxNCBTYWx0ZWRfX2J4XMUmzhi7X 6kJLcneIFojPOdwrjqZt610IpwMlQqPWJHc2G0Zdr+DvNBBM++LXOb0anocXZMSrgYZ+7IN9Ht3 lrMxpRye0/85GAVGk7L+sqPjuCW9CT2ZbY8iFfI331NuUMKYsd9p9ddKF2dudFaX4u8kTPYRabM 6UEgi31QpBrmNkHyqzcxQVn2XhPPqUW3+0Ec/EkTRiwoXgdQwl2qLUGU1BYelriNexVndtGeYZT +5QbfmJzXppTmljKRbtpYV6FuOZDjKqWStHroRCdQg7Fbb83VPuGdbCk7OGXFFjfZ7S7lgpbavT mNBxHGeMSuEXc9cd0gcRDfhAOxCLoJTNoKGGYPiHmOZXkrEayU5gRUj6naJ3CHXEpbS+h5cUs7i 6r1+o2F1P/Mn8dnz57hVyrozcD3/WhcWQtLFWwR9BEO/ixNPyhdN12aEzuZ4xi2S4FD6o6y3
X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-05-12_07,2025-05-09_01,2025-02-21_01
Message-ID-Hash: YUIVJND42OJDIAB35IFFTI7D3GRJXSHL
X-Message-ID-Hash: YUIVJND42OJDIAB35IFFTI7D3GRJXSHL
X-MailFrom: prvs=1227382186=bemasc@meta.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-dnsop.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Erik Nygren <erik+ietf@nygren.org>, Paul Hoffman <paul.hoffman@icann.org>, dnsop WG <dnsop@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [DNSOP] Re: [Ext] Persistence of DCV, including for Delegated DCV (for draft-ietf-dnsop-domain-verification-techniques)
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/qqFmOubWZXIDL06rsTjaUOo-efw>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Owner: <mailto:dnsop-owner@ietf.org>
List-Post: <mailto:dnsop@ietf.org>
List-Subscribe: <mailto:dnsop-join@ietf.org>
List-Unsubscribe: <mailto:dnsop-leave@ietf.org>

________________________________
From: Paul Wouters <paul@nohats.ca>

> ... we should add a
> Section that talks about DVC and periodic revalidations and their
> issues in summary, and punt lifecycles of periodic to another document.

I agree.  I put a section like that at the top of my PR [1].  We can certainly expand it if you think we need more text.

>> Without this assumption (or an equivalent rule about parties authorized to update parts of the zone), DCV doesn't work at all.  Perhaps we need to make that more
>> explicit...

> I am not sure what this means.

To be concrete: suppose an untrusted party shows up and says "Hey can I add a new TXT record to your zone?  It's not at any name you're using.".  Without DCV, this is potentially safe.  This party can't influence the behavior of the names you care about.  With DCV, this is totally unsafe.  So DCV introduces a (arguably) new assumption about DNS zone behaviors.

This is mostly hypothetical ... except for any public suffixes that aren't blocking all underscore-prefix names.

> Do you mean to say that
> you would be okay with 1 DCV to prove control (which expires and gets
> removed) and 1 long term record without token/randomness that somehow
> points from a unique service name prefix via CNAME or RDATA to the target
> service provider's service. And is never updated to prove freshness?

That's precisely what my PR recommends.

> Or are you after monthly proofs of freshness?

Only if the verifier really needs repeated DCV for some reason.  If the verifier just wants to confirm authorization, don't use DCV for that.

Really, I would like to go even deeper and ask: are we sure all these deployments actually want DCV semantics?  Maybe they should be using persistent authorization instead, but are copying the DCV pattern from other deployments.

--Ben

[1] https://github.com/ietf-wg-dnsop/draft-ietf-dnsop-domain-verification-techniques/pull/160/files

v2.31.3 | Report a Bug | By Email | System Status