[lamps] CAA tree climbing, gurrghhg

["John R Levine" <[e-mail]>]

I see that the current draft says that CAs climb up the tree a label at a 
time all the way to the TLD, looking for a CAA policy record.

I think you will find a great deal of resistance to that design, because 
it runs into the dbound problem. If I register fobar.hockey, I do not want 
the .hockey TLD setting my default certificate policy.

DMARC has a similar problem looking for policy records for mail 
authentication.  If there's no _dmarc record for a particular domain, 
implementations find the related "organizational domain", roughly the 
highest name under the same management, and it looks for a _dmarc record 
for the organizational domain.  Current implementations use the mozilla 
PSL or something similar; if we were able to converge in something in 
dbound or its reincarnation, they'd use that instead.

I cheefully agree that the PSL is awful, but as far as I can tell all of 
the alternatives are worse.

R's,
John