<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body dir="auto">
<div>Eric, the discussions around CAA have often included less-than-strict enforcement because some CAs were opposed to CAA deployment. Some thought that it might be easier to achieve broad adoption by mandating a lax minimum and then ratcheting it up over
time. </div>
<div id="AppleMailSignature"><br>
-Rick</div>
<div><br>
On Sep 10, 2016, at 10:50 PM, Eric Mill <<a href="mailto:eric.mill@gsa.gov">eric.mill@gsa.gov</a>> wrote:<br>
<br>
</div>
<blockquote type="cite">
<div>
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote"><span class="">
<div>* Any failures occur at issuance-time, not request-time. While an issuance failure might lead to request failures when replacing expired or imminently-expiring certificates, many (most?) issuance failures will give service operators time to respond before
request failures, including adjusting DNS records as necessary.<br>
</div>
</span></div>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>To clarify this paragraph, by "request" I meant "HTTP request", not "certificate request".</div>
<div> </div>
</div>
</div>
</div>
</div>
</blockquote>
</body>
</html>