Re: [lamps] Next steps on CAA

[Russ Housley <[e-mail]>]

> On Oct 4, 2017, at 10:15 AM, Phillip Hallam-Baker <[e-mail]> wrote:
> 
> Consider the case that www.example.net <http://www.example.net/> is CNAME to www.example.com <http://www.example.com/>. This may be because
> 
> 1) The name www.example.net <http://www.example.net/> is owned by the same party as www.example.com <http://www.example.com/> and wants the two to be precisely equivalent.
> 
> 2) www.example.com <http://www.example.com/> is a CDN that is hosting www.example.net <http://www.example.net/>.
> 
> The DNS does not provide the ability to distinguish between the two. The only information in the DNS describes WHAT and to distinguish them, we need WHY.
> 
> The reason we would want to distinguish is if there is a CAA record at example.net <http://example.net/>. 
> 
> 1) The CNAME is there to make the names equivalent so the CAA record at example.net <http://example.net/> should aply
> 
> 2) The CNAME is only there to make the CDN work and the CAA record at example.net <http://example.net/> should be ignored.

If one looks in the DNS for www.ietf.org, one will see:

	www.ietf.org.		607	IN	CNAME	www.ietf.org.cdn.cloudflare.net.

I'm not sure how you would expect to distinguish the two cases.

Russ