Re: [Spasm] CAA erratum 4515

[Jacob Hoffman-Andrews <[e-mail]>]

On 03/09/2017 01:45 PM, Patrick Donahue wrote:
> www.staffie.dog.        CNAME staffie.terrier.dog.
> staffie.terrier.dog.    A 192.0.2.1
> terrier.dog.            CAA 0 issue "happy-hacker-fake-ca.net
> <http://happy-hacker-fake-ca.net>"
>
>
>     Should issuance for www.staffie.dog require a CAA query for
>     terrier.dog? Or should it only require CAA queries for
>     www.staffie.dog and staffie.terrier.dog?
>
>
> I'm a bit confused here as I would say "no" to the first question and
> I would say that staffie.terrier.dog is irrelevant in the second part
> of the question (but a CA may need to check staffie.dog if nothing set
> at www.staffie.dog).
Sorry, I was a little fuzzy in my language here. There are two
questions: What queries does the CA make to its recursive resolver, and
what queries does the recursive resolver make?

If the CA queries "CAA www.staffie.dog.", the recursive resolver will
query the authoritative resolver for "CAA www.staffie.dog." Failing to
find it, the recursive resolver will then query the authoritative
resolver for "CNAME www.staffie.dog." The recursive resolver will follow
a sequence of CNAMEs, querying CAA (but not tree-climbing) at each step.
In this case there's just one step, and the recursive resolver queries
the authoritative resolver for "CAA staffie.terrier.dog." The recursive
resolver includes the result in its response to the CA software. This is
defined in RFC 1034 about DNS in general:

https://tools.ietf.org/html/rfc1034#section-3.6.2
> CNAME RRs cause special action in DNS software.  When a name server
> fails to find a desired RR in the resource set associated with the
> domain name, it checks to see if the resource set consists of a CNAME
> record with a matching class.  If so, the name server includes the CNAME
> record in the response and restarts the query at the domain name
> specified in the data field of the CNAME record.  The one exception to
> this rule is that queries which match the CNAME type are not restarted.

In other words, one CAA query to a recursive resolver can trigger
multiple CAA queries from the recursive resolver to the authoritative
resolver.