<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">I think that we have a problem in Internet security generally similar to that of 802.11b vs WiFi. There is a specification but implementations of the specification vary and are not always up to date.<div class=""><br class=""></div><div class="">Perhaps we could create a checklist for various parties for implementing PKI-2017 or whatever. Giving concrete steps for what has to be implemented. </div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Sep 22, 2016, at 5:02 PM, Ryan Sleevi <<a href="mailto:sleevi@google.com" class="">sleevi@google.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><br class=""><div class="gmail_extra"><br class=""><div class="gmail_quote">On Thu, Sep 22, 2016 at 9:55 AM, Erwann Abalea <span dir="ltr" class=""><<a href="mailto:Erwann.Abalea@docusign.com" target="_blank" class="">Erwann.Abalea@docusign.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">We also need more support from DNS servers.<br class=""></blockquote><div class=""><br class=""></div><div class="">I think we'll constantly be in this chicken-and-egg problem until the CA/B Forum takes action.</div><div class=""><br class=""></div><div class="">Customers don't receive value in CAA until (all) CAs are obligated to check & respect it. However, if we get there, it becomes a vital and valuable security feature.</div><div class=""> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
For my domains, I host everything on the « Cloud », and register my domain names on Gandi, who is also my DNS service, with a nice web UI.<br class="">
I wanted to add a CAA record for testing, but Gandi doesn’t support that. Amazon Route 53 doesn’t either. I looked for some documentation about Cloudflare DNS, <a href="http://dyn.com/" rel="noreferrer" target="_blank" class="">dyn.com</a> Managed DNS, GoDaddy, Microsoft Azure, EasyDNS, none of them seem to support CAA.<br class=""></blockquote><div class=""><br class=""></div><div class="">That's unfortunate, but luckily we've got members in both Microsoft and GoDaddy who might be able to poke their product teams, and we know CloudFlare is generally responsive to security feature improvements.</div><div class=""> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
The only positive finding is that Google Cloud DNS supports CAA records with an easy to use UI.<br class=""></blockquote><div class=""><br class=""></div><div class="">I'll be sure to pass this on to the team that implemented this =)</div><div class=""> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">The fact that we still have to use « -t TYPE257 » on dig or host command or the equivalent « set type=TYPE257 » on nslookup to manually perform this query is not encouraging.</blockquote><div class=""><br class=""></div><div class="">Encouraging in what sense? There's naturally an ecosystem issue, but the need to use -t TYPE257 on older versions of dig/host doesn't preclude you from taking advantage of the security benefits, if CAs were willing or required to respect it. </div></div><br class=""></div></div>
_______________________________________________<br class="">Public mailing list<br class=""><a href="mailto:Public@cabforum.org" class="">Public@cabforum.org</a><br class="">https://cabforum.org/mailman/listinfo/public<br class=""></div></blockquote></div><br class=""></div></body></html>