Re: [Spasm] CAA erratum 4515

[Jacob Hoffman-Andrews <[e-mail]>]

On 03/12/2017 12:33 PM, Ryan Sleevi wrote:
> On Sun, Mar 12, 2017 at 11:06 AM, Jacob Hoffman-Andrews <[e-mail]
> <mailto:[e-mail]>> wrote:
>
>     Looking at the types of policy I described earlier:
>
>     > 1. Policy set by user-facing domain owner for their own hostnames.
>     > 2. Blanket policy set by CDN for hostnames they operate on their
>     customers' behalf.
>     > 3. Policy set by CDN for their own hostnames, which share the same
>     base domain as the CNAME targets used in (2).
>
>     In the tree-climbing world, given the above restriction on CNAMEs
>     coexisting, it would be impossible for a CDN to express "(3) without
>     (2)". Worse, if some CDN did express (3), it would be impossible for
>     their customers to opt out by setting CAA records on their own
>     domains.
>     This would effectively bar CDNs from expressing (3) in the
>     tree-climbing
>     world. 
>
>
>     I think this is sufficient to say that tree climbing is undesirable.
>     What do other folks think?
>
>
> I think you're correct in that, in the absence of some form of
> trampoline - and an 'any' policy - it can't be expressed.
>
> However, am I mistaken in thinking that with those two - it could be?
Actually, thinking about it some more, all that's needed is an 'any'
policy. Even without a trampoline, the CDN only has to set the 'any'
policy on their CNAME target.

Separately: since we now realize that customers can't override CDN
policy by adding CAA records to their own zone, if a customer wants to
set their own CAA policy, the records have to be present on the CNAME
target. That is, the CDN would have to cooperate in adding that record.
Because different customers would no doubt want to express different
policies, the CDN would have to use a trampoline if they wanted to offer
per-customer CAA settings. However, this is true in both tree-climbing
and non-tree-climbing worlds. Do you agree?