<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On 30 Jun 2014, at 8:17 am, Stephen Davidson <<a href="mailto:S.Davidson@quovadisglobal.com">S.Davidson@quovadisglobal.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div lang="EN-US" link="blue" vlink="purple" style="font-family: HelveticaNeue; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div class="WordSection1" style="page: WordSection1;"><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">During the CABF discussion about CAA in June 2013, a browser representative pointed out that companies may hit against size constraints when using CAA:<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Adding the records increased our authoritative nameserver's DNS response from an already juicy 458 bytes to supreme juicyness of 506 bytes (512 bytes is still somewhat of the limit, at the very least resource usage will increase when topping that).<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">And besides, we've seen that before of course, and our TXT SPF record is the main offender here, but 506 byte responses is probably on the "winning" side when it comes to selecting authoritative DNS servers for DNS amplification attacks.<span class="Apple-converted-space"> </span><span style="background-color: yellow; background-position: initial initial; background-repeat: initial initial;">Or spoken more generally: Maybe the CABForum should discuss how eager the community is to add a potential massive load of additional records to the root element of a zone/"domain".</span><o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); background-color: yellow; background-position: initial initial; background-repeat: initial initial;">If you use more than one CA for signing "https" certs, this can quickly explode in size all on itself, without the help of SPF entries in the zone. I'd guess this needs to be discussed.</span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"><o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">The technical discussion dropped off at this point. I believe it bears further analysis.<o:p></o:p></span></div></div></div></blockquote><br></div><div>I presume here we're talking about an ANY query, since a CAA response itself is usually small by itself. In that case it should be considered that an ANY query for <a href="http://icann.org">icann.org</a> is 5278 bytes, and even TLDs like com. or us. are 1555 bytes and 538 bytes respectively.</div><div><br></div><div>In actual use there should be no problem since real queries (as opposed to those intended for DoS) will not ask for the CAA record and so won't get it.</div></body></html>