Re: [lamps] Next steps on CAA

["John R Levine" <[e-mail]>]

On Sat, 7 Oct 2017, Phillip Hallam-Baker wrote:
>>> Right.  I think that solves everything but the DNAME problem, and I
>>>> think the DNAME problem, if it actually exists, is insoluble.
>>>
>> ​I don't think there is a DNAME problem.

> ​If DNAME appeared on the wire, t...

> When CAA was originally written, CDNs were sufficiently rare that the main
> use of CNAME was also name equality under the same control. That has
> changed.

Right about CNAMEs.

The DNAME problem (if it exists) has nothing to do with whether the DNAME 
shows up in the DNS answer.  It's whether it's important to be able to 
publish a CAA record that describes a policy for a DNAME'd web server, 
with the CAA not DNAME'd, just like the CNAME problem that prefixed names 
address.

As I've said several times, although it's hypothetically possible, I doubt 
it's an issue in practice because other than the exotic AS112 I've never 
seen anyone use DNAME to point names at a third party.  That's fortunate 
since the prefix hack doesn't help for DNAMEs.

R's,
John