Re: [lamps] Next steps on CAA

[Phillip Hallam-Baker <[e-mail]>]

On Sat, Oct 7, 2017 at 4:13 PM, John R Levine <[e-mail]> wrote:

> On Sat, 7 Oct 2017, Phillip Hallam-Baker wrote:
>
>> Right.  I think that solves everything but the DNAME problem, and I
>>> think the DNAME problem, if it actually exists, is insoluble.
>>>
>>
> ​I don't think there is a DNAME problem.
>>
>
> Neither do I but for a completely different reason.
>
> The CNAME problem here is that you use a CNAME to point your web server at
> a third party host but you want to publish your own CAA, not the host's CAA.
>
> Hypothetically, you might want to do the same thing with DNAME, but every
> DNAME I've ever seen other than AS112 aliases two name trees where the
> corresponding names are (or at least are supposed to be) under the same
> control.


​If DNAME appeared on the wire, that would be a good reason to make use of
it. for that purpose. Unfortunately, the only time you can rely on it being
published is when DNSSEC is in use.

When CAA was originally written, CDNs were sufficiently rare that the main
use of CNAME was also name equality under the same control. That has
changed.