Re: [Spasm] CAA erratum 4515

[Jacob Hoffman-Andrews <[e-mail]>]

> 1. Policy set by user-facing domain owner for their own hostnames.
> 2. Blanket policy set by CDN for hostnames they operate on their
customers' behalf.
> 3. Policy set by CDN for their own hostnames, which share the same
base domain as the CNAME targets used in (2).

So, back to the subjective evaluation: Now it's clear that the CDN in
our scenario is the only one who can add CAA records. If a customer
wants (1) they need cooperation from their CDN, and the CDN needs to
implement a trampoline no matter what.

*In the non-tree-climbing world*

If a CDN wants to implement (3), they put in place a single CAA record
and it doesn't impact (1) or (2). If the CDN wants to implement (1) or
(2), they put in a CAA record at each of their CNAME targets. Neither
policy affects the other in any way, assuming that CNAME targets are
never base domains.

*In the tree-climbing world*

If a CDN wants to implement (3), they have to carefully understand CAA
and be sure to add a separate "any" record to each of their CNAME
targets. They also have to make sure to copy that CAA record to any new
CNAME targets they create.

I argue that this is less intuitive and more difficult than in the
tree-climbing world. More difficult, because it requires deploying extra
CAA records to express a straightforward policy. Less intuitive, because
most DNS-using applications don't care about the hostnames that are part
of a CNAME chain, only the "final value" received from a recursive
resolver. For instance, when looking up an A record, Chrome doesn't care
about the CNAME aliases in between, only the final A record.

Also, as a concrete example of the non-intuitiveness, Rob (one of the
CAA authors) mentioned on the CA/Browser Forum list that he has had to
double-check the lookup algorithm with Phill, his co-author. I've also
been confused by the CAA lookup algorithm, as have my coworkers. I can't
speak for Rob, but for me a big part of the confusion has been the fact
that tree-climbing seems like an anomaly in the DNS world.