Re: [lamps] CAA records on CNAMEs

This is exactly back where we started.

There are three technical options. Each time I comment on this I understand
that we have decided to go for the prefix records solution and every time
it turns out we didn't and a few months later the same problem comes up.

The problem here is that CNAME delegation is used to implement two entirely
different types of delegation and does not specify which one is intended.
When 6844 was written, the Web was in a different place, CDNs were not so
ubiquitous and so the needs then were different and when we discussed it
then we decided to make one particular choice. But it was a fully
considered choice.

Also at the time CAA was proposed, the DNS folk insisted that prefix
records represent some sort of heresy and must be avoided at all costs. It
has since been realized that they are necessary to fix the fact that the
DNS architecture does not meet DNS use. And why would something designed 35
years ago to meet the needs of the Internet scaling from 100 hosts to 1000
anticipate everything that came since?

The two uses of delegation are:

1) Asserting name equality. i.e. *.example.net = *.example.com

2) Delegating isolated domains www.example.com -> example.mycdn.com

On top of this there is the fact that DNAME isn't really a DNS RR only it
is because it has to be because of DNSSEC only it doesn't have the
semantics you would expect and certainly not the semantics that you want.

Long and the short of it is that if you want to do the right thing for both
the use cases, you need to distinguish one of the cases using a prefix to
the CAA record.

I am not going to be in Prague as I am still finishing the Mesh specs and
getting my company registered as an LLC. Right now it is
VentureCryptography.com

On Mon, Mar 18, 2019 at 11:29 AM Salz, Rich <rsalz@akamai.com> wrote:

> >    As noted in e.g.,
>
> https://datatracker.ietf.org/meeting/100/materials/slides-100-lamps-rfc-6844-bis-00.pdf
> ,
>     there are cases where it's desirable for an organization to set a CAA
>     record on a CNAME.  For example:
>
> Start by changing RFC RFC 1912, which does not allow any other data to
> appear with a CNAME. ;)
>
>
> _______________________________________________
> Spasm mailing list
> Spasm@ietf.org
> https://www.ietf.org/mailman/listinfo/spasm
>