Re: [lamps] [EXTERNAL] Re: CAA processing for email addresses

[Phillip Hallam-Baker <[e-mail]>]

On Fri, Dec 2, 2022 at 10:51 AM Antonios Chariton <[e-mail]>
wrote:

> I think that CAA for S/MIME is useful, and can help enforce policies for
> an enterprise, and even for large e-mail providers (although probably not
> for their main domain gmail.com / hotmail.com / etc.). I participate here
> on my personal capacity and won’t speak on behalf of Gmail.
>

I agree. The point I was making earlier is that participation by the likes
of GMail is not necessary for the proposal to be useful. While it would
certainly make a good deal of sense for Google's one product to offer a
full S/MIME CA capability etc. etc. and run it all on behalf of its
industry clients, that doesn't have to happen for this proposal to succeed.

Two things I’d maybe consider, one of which is described in my thread[1]
> too:
>
> - Perhaps “mailissue” or “mail” is better (explained in the thread) or
> even “smime”. This allows for “smimeentity” and “smimeserver” for example,
> if there’s a future need for that.
>
> - I don’t know if I would make this critical
>

Don't.

It really is a mystery to me why people still get the criticality bit
wrapped around their axles. It is a bad name for a necessary tool. Calling
it critical caused people to think it means 'important'. It doesn't.

The purpose of the criticality flag in PKIX, CAA included is to tell
applications processing it, 'if you see information marked with this flag
and you do not understand what the information means, don't do anything
until you do.'

The point of the criticality flag in CAA is to provide an upgrade mechanism
for introducing new features without causing legacy infrastructures to do
bad things. It is not there to say 'this is important' or 'I triple dog
dare you'.

Making a CAA extension critical should almost always be left to the
discretion of the site operator.