[lamps] CAA DNAME behavior is surprising

[Andrew Ayer <[e-mail]>]

Roughly speaking, the CAA lookup algorithm in RFC 6844 section 4 says
that if X does not have a CAA record, but is an alias, then the CA
should look for a CAA record at the target of X.

Specifically, it defines "alias" to be either a CNAME or a DNAME:

"Let ... A(X) be the target of a CNAME or DNAME alias record specified
at the label X."

A straightforward interpretation of this language is that if you have
the following records:

sub1.example.com.  IN  DNAME  sub2.example.com.
sub2.example.com.  IN  CAA    0 issue "example.net"
example.com.       IN  CAA    0 issue "example.org"

then the only CA that is allowed to issue for sub1.example.com is
example.net.  This is the case even with erratum 5065.

However, this does not match the typical behavior of DNAME.  Per section 2.3
of RFC 6672:

"Unlike a CNAME RR, a DNAME RR redirects DNS names subordinate to its
owner name; the owner name of a DNAME is not redirected itself."

It's therefore rather surprising that CAA says you should follow the
DNAME target of X and use the CAA record there.  Given the above
records, I would expect example.org, not example.net, to be the only CA
that can issue for sub1.example.com.

Is this behavior intentional?  If so, what was its motivation?

Regards,
Andrew