Re: [lamps] CAA Simplification draft

Administrative boundaries are not visible in the DNS. Attempting to attach
semantics to the zone cut creates more problems than it solves.

Given the length of the document and the need to cite it in other
documents, I don't think an update is appropriate. Obsoleting the old text
and replacing is the way to go.

The reason the tree climbing is necessary is that MANY DNS host and service
names are not visible on the public DNS. So most of the time, a CA has no
way to validate the records for secrethost.example.com, the CAA record has
to be at example.com.

The reason aliases are necessary is two fold. One is to support delegation
of the domain to a different administration as is typical in a CDN, the
other is to simplify management of large portfolios of domains. The DNS
only provides one alias record (DNAME is not an alias, see below) so it is
not clear what the purpose of the alias is. When RFC6844 was written, CDNs
were the exception, now they are much more common.

Further, the DNS spec is broken in that it requires that a CNAME be the
only entry at a node if present.

On the DNAME issue, it is not really an alias as a DNAME is a wildcard
record that would have never appeared on the wire until DNSSEC made it
necessary. An application does not process a DNAME directly, it uses the
DNAME record to either validate a CNAME or infer that one should have been
presented but was not.

On Tue, Sep 19, 2017 at 6:20 AM, <fujiwara@jprs.co.jp> wrote:

> I did not know about RFC 6844 and was surprised about "tree climing"
> and "CNAME".
>
> > From: Jacob Hoffman-Andrews <jsha@eff.org>
> > https://www.ietf.org/id/draft-hoffman-andrews-caa-simplification-00.txt
>
> I checked differences between RFC 6844 and the draft.
> https://tools.ietf.org/rfcdiff?url1=https://tools.
> ietf.org/rfc/rfc6844.txt&url2=https://www.ietf.org/id/draft-
> hoffman-andrews-caa-simplification-01.txt
>
> I have some comments.
>
> - Current draft has some formatting mistakes.
>
>   current text: $ORIGIN example.com .  CAA 0 issue "ca.example.net"
>
>   should be   (from RFC 6844)
>
>   rfc6844:  $ORIGIN example.com
>   rfc6844:  .  CAA 0 issue "ca.example.net"
>
>   However, I would like to suggest to remove "$ORIGIN" and add tailing
>   dot in domain names.
>
>   proposed:  example.com. CAA 0 issue "ca.example.net"
>
> - Current document still contain "tree climing" and checks CAA RR in TLDs.
>
>   The tree climing should stop at administrative domain boundaries.
>
>   "example.com." domain name owner does not want to be checked "com. CAA".
>
>   See (concluded) dbound WG and Public Suffix list discussions.
>     https://tools.ietf.org/wg/dbound/
>     https://publicsuffix.org/
>
> - I like prefixed record solution proposed at IETF 99 lamps WG.
>   https://datatracker.ietf.org/meeting/99/materials/slides-
> 99-lamps-caabis/
>
>   However, it is not compatible with RFC 6844.
>
> Regards,
>
> --
> Kazunori Fujiwara, JPRS <fujiwara@jprs.co.jp>
>
> _______________________________________________
> Spasm mailing list
> Spasm@ietf.org
> https://www.ietf.org/mailman/listinfo/spasm
>