[Secdispatch] Please help dispatch "Dangerous Labels"

[Daniel Kahn Gillmor <[e-mail]>]

I've written a document that tries to establish a registry of labels --
just DNS labels and e-mail local parts at the moment -- that have
surprising security properties:

   https://datatracker.ietf.org/doc/draft-dkg-intarea-dangerous-labels/

The not-so-secret goal of the document is to *discourage* creation of
new labels like this.  Or, rather, to discourage the creation of systems
that treat certain "magic" labels as having special properties.

For example, if the administrators of "example.com" permit Jennifer to
take control of "mta-sts.example.com", she can change the e-mail
transport security properties of the entire zone.  Similarly, if the
admins allow Roberto to have access to the e-mail address
[e-mail], he can create an X.509 certificate for any host
in the zone, due to the CA/B Forum's baseline requirements.  Take a look
at the doc for other examples.

These dangerous labels are booby-traps for unwary administrators.

If someone is designing a system that would want to add a label to
either of the registries that this document designs, it gives us an
opportunity to try to divert them to using something better, such as a
.well-known URL, an underscore-prefixed DNS label, or anything more
principled.

If anyone knows of other dangerous labels that should be listed here
(DNS labels, e-mail local parts, or even labels in other categories),
feel free to reply directly to me, or open an issue or merge request on
https://gitlab.com/dkg/dangerous-labels/

But if this document goes forward, it has an explicit ask for IANA to
create the registries, so it probably would need to culminate in an RFC.
I have no idea where this document should live within the IETF.

Suggestions?

        --dkg