Re: [Spasm] CAA erratum 4515

[Ryan Sleevi <[e-mail]>]

On Fri, Mar 10, 2017 at 4:50 PM, Jacob Hoffman-Andrews <[e-mail]> wrote:

> One thing that might help is to detail that there are actually three
> policies in play, that we've tended to squash into two:
>
> 1. Policy set by user-facing domain owner for their own hostnames.
> 2. Blanket policy set by CDN for hostnames they operate on their
> customers' behalf.
> 3. Policy set by CDN for their own hostnames, which share the same base
> domain as the CNAME targets used in (2).
>
> The goal is that these can be set as three independent policies, without
> unintended interactions.
>
> Also, one thing I want to clarify: To what extent are you trying to
> incentivize (2) and make it easy to do? I've been assuming that's a core
> goal for you, but I may be misunderstanding that.
>

Thanks for summarizing that, and I agree - it's really three different
things.

I don't even think I'm trying to incentivize (2), so much as try to figure
out the solution that allows the least changes to be made re: DNS records
to support the most number of variations of these policies, and to identify
where the most likely failure points are with respect to complexity.

Or, put differently, I want as many people to be able to set CAA policies
that work "out of the box" with minimal configuration. This, of course,
relies on a subjective interpretation of what the most likely scenarios
are, and I want to fully acknowledge that up-front. I think both
tree-climbing and non-tree-climbing can work, to be abundantly clear :)


> If domain operators wish to operate with their own policy, but support
> customers with another policy, the trampoline is necessary or the customer
> has an additional configuration step.
>
> This depends. Are the CDNs trying to support unique policies on a
> per-customer basis, or a blanket policy as in (2) above? If it's a blanket
> policy, no trampoline is needed. The CDN does need to have a CNAME target
> that is not a base domain, but that target doesn't need to be unique
> per-customer: i.e., not a trampoline.
>

Fair point - some indirection is necessary, but it's not necessarily
per-customer indirection.


> If domain operators wish to operate with their own policy, and support
> customers with the same policy (on the domains the domain operator
> operates), while allowing their customers to operate with their own policy
> on the customer domains, the trampoline is necessary.
>
> I don't think this case is significantly different than the above. One
> policy gets set on the CDN's base domain, while the other policy gets set
> on the CNAME target. If those policies happen to be the same, that's fine.
>

Fair point here as well. The complexity then comes from whether this
reflects current deployment, or whether it reflects a point of deployment
which would have to change to support. I think this is what you've
identified in (2).

The fewer things that need to change - and just work out of the box - the
better the deployment scenario for CAA looks. My instinct - perhaps
incorrectly - is that tree climbing allows fewer changes for the most
participants, not that tree climbing is an intrinsic necessity.