<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Some corrections in the description below.
<div class=""><br class="">
<div class="">
<div class="">Cordialement,</div>
<div class="">Erwann Abalea</div>
</div>
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">Le 25 janv. 2017 à 22:31, Ryan Sleevi via Public <<a href="mailto:public@cabforum.org" class="">public@cabforum.org</a>> a écrit :</div>
<br class="Apple-interchange-newline">
<div class="">
<div dir="ltr" class=""><br class="">
<div class="gmail_extra"><br class="">
<div class="gmail_quote">On Wed, Jan 25, 2017 at 1:19 PM, Doug Beattie <span dir="ltr" class="">
<<a href="mailto:doug.beattie@globalsign.com" target="_blank" class="">doug.beattie@globalsign.com</a>></span> wrote:<br class="">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple" class="">
<div class="m_8426246935680148436WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d" class="">Ryan,<u class=""></u><u class=""></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d" class=""><u class=""></u> <u class=""></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d" class="">I believe that my recommendation and your implied functional agreement with it could be wrong. Let me ask the question another way<u class=""></u><u class=""></u></span></p>
<span class="">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d" class=""><u class=""></u> <u class=""></u></span></p>
<p class="m_8426246935680148436MsoListParagraphCxSpFirst" style="margin-left:.75in">
<u class=""></u><span class="">1.<span style="font:7.0pt "Times New Roman"" class="">
</span></span><u class=""></u>If CAA(X) is not empty, R(X) = CAA (X), otherwise<u class=""></u><u class=""></u></p>
</span>
<p class="m_8426246935680148436MsoListParagraphCxSpMiddle" style="margin-left:.75in">
<u class=""></u><span class="">2.<span style="font:7.0pt "Times New Roman"" class="">
</span></span><u class=""></u>If A(X) is not null (i.e, there is a CNAME or DNAME record for X), and R(A(X)) is not empty, then R(X) = R(A(X)), otherwise<u class=""></u><u class=""></u></p>
<span class="">
<p class="m_8426246935680148436MsoListParagraphCxSpMiddle" style="margin-left:.75in">
<u class=""></u><span class="">3.<span style="font:7.0pt "Times New Roman"" class="">
</span></span><u class=""></u>If X is not a Base Domain Name, then R(X) = R(P(X)) and perform check again starting at step 1, otherwise<u class=""></u><u class=""></u></p>
<p class="m_8426246935680148436MsoListParagraphCxSpLast" style="margin-left:.75in">
<u class=""></u><span class="">4.<span style="font:7.0pt "Times New Roman"" class="">
</span></span><u class=""></u>R(X) is empty.<u class=""></u><u class=""></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d" class=""><u class=""></u> <u class=""></u></span></p>
</span>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d" class="">In step 2 if A(X) is null (not a defined state in the above), what happens?
</span></p>
</div>
</div>
</blockquote>
<div class=""><br class="">
</div>
<div class="">I'm surprised to hear you don't think it's a defined state. I'm not sure how you're reading that.</div>
<div class=""> </div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple" class="">
<div class="m_8426246935680148436WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d" class="">Does it proceed with 3 (implied by the definition above), or does it do a CAA check on A(X) – basically start at step 1 with CAA(A(X)) and if empty,
then return to step 3 and finish up with A(X) processing?</span></p>
</div>
</div>
</blockquote>
<div class=""><br class="">
</div>
<div class="">2. If (Cond 1), and (Cond 2), then X, otherwise</div>
<div class="">3. If (Cond 3), then Y, otherwise</div>
<div class="">4. Z</div>
<div class=""><br class="">
</div>
<div class="">"if A(X) is null" is a failure of Cond 1, so yes, it proceeds to 3.</div>
<div class="">"If A(X) is not null", but R(A(X)) is, it's a failure of Cond 2, so yes, it proceeds to 3.</div>
<div class=""><br class="">
</div>
<div class="">If A(X) is null, you proceed to step 3.</div>
<div class="">If R(A(X)) is null, you proceed to step 3.</div>
<div class="">If A(X) is not null and R(A(X)) is not null, you use that value.</div>
<div class=""><br class="">
</div>
<div class="">R(A(X)) is defined recursively - meaning for <a href="http://foo.example.com/" class="">
foo.example.com</a> and <a href="http://bar.example.com/" class="">bar.example.com</a>, where
<a href="http://foo.example.com/" class="">foo.example.com</a> is a CNAME to <a href="http://bar.example.net/" class="">
bar.example.net</a>, and the CAA record is set on ".net", you'd do</div>
<div class=""><br class="">
</div>
<div class="">CAA(<a href="http://foo.example.com/" class="">foo.example.com</a>) - nothing</div>
<div class="">CNAME(<a href="http://foo.example.com/" class="">foo.example.com</a>) -
<a href="http://bar.example.net" class="">bar.example.net</a></div>
</div>
</div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>More precisely, when you’re requesting the CAA record set (or any other record type) for
<a href="http://foo.example.org" class="">foo.example.org</a>, you get the CNAME record (<a href="http://bar.example.net" class="">bar.example.net</a>) if it’s present. That is, send 1 query, get these 2 answers (presence/absence of a CAA, and presence/absence
of a CNAME).</div>
<div>That’s true for DNAME also with a minor exception, but it’s sufficient to require an explicit query.</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div dir="ltr" class="">
<div class="gmail_extra">
<div class="gmail_quote">
<div class="">CAA(<a href="http://bar.example.net/" class="">bar.example.net</a>) - nothing</div>
<div class="">CNAME(<a href="http://bar.example.net/" class="">bar.example.net</a>) - nothing</div>
</div>
</div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>Again, this is one query only, and the result is that there’s no CAA and no CNAME.</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div dir="ltr" class="">
<div class="gmail_extra">
<div class="gmail_quote">
<div class="">CAA(<a href="http://example.net/" class="">example.net</a>) - nothing</div>
<div class="">CNAME(<a href="http://example.net/" class="">example.net</a>) - nothing</div>
</div>
</div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>Again.</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div dir="ltr" class="">
<div class="gmail_extra">
<div class="gmail_quote">
<div class="">CAA(net) - value</div>
<div class=""><br class="">
</div>
<div class="">And return CAA(net)</div>
<div class=""><br class="">
</div>
<div class="">If the CAA record was on com, and <a href="http://example.net/" class="">
example.net</a> was CNAMEd to <a href="http://example.org/" class="">example.org</a>, you'd do</div>
<div class="">CAA(<a href="http://foo.example.com/" class="">foo.example.com</a>) - nothing</div>
<div class="">CNAME(<a href="http://foo.example.com/" class="">foo.example.com</a>) -
<a href="http://bar.example.net/" class="">bar.example.net</a></div>
<div class="">CAA(<a href="http://bar.example.net/" class="">bar.example.net</a>) - nothing</div>
<div class="">CNAME(<a href="http://bar.example.net/" class="">bar.example.net</a>) - nothing</div>
<div class="">CAA(<a href="http://example.net/" class="">example.net</a>) - nothing</div>
<div class="">CNAME(<a href="http://example.net/" class="">example.net</a>) - <a href="http://example.org/" class="">
example.org</a></div>
<div class="">CAA(<a href="http://example.org/" class="">example.org</a>) - nothing</div>
<div class="">CNAME(<a href="http://example.org/" class="">example.org</a>) - nothing</div>
<div class="">CAA(org) - nothing</div>
<div class="">CNAME(org) - nothing</div>
<div class="">CAA(net) - nothing</div>
<div class="">CNAME(net) - nothing</div>
<div class="">CAA(<a href="http://example.com/" class="">example.com</a>) - nothing</div>
<div class="">CNAME(<a href="http://example.com/" class="">example.com</a>) - nothing</div>
<div class="">CAA(com) - value</div>
<div class=""><br class="">
</div>
</div>
</div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div><br class="">
</div>
<div>Extending the examples with a DNAME. A CAA record on « net. », « <a href="http://example.com" class="">example.com</a> » is a DNAME to « <a href="http://example.net" class="">example.net</a> », requesting the relevant CAA record for « <a href="http://foo.example.com" class="">foo.example.com</a> »:</div>
<div><br class="">
</div>
<div>CAA(<a href="http://foo.example.com" class="">foo.example.com</a>) -> <a href="http://foo.example.com" class="">
foo.example.com</a> CNAME <a href="http://foo.example.net" class="">foo.example.net</a>, and
<a href="http://example.com" class="">example.com</a> DNAME <a href="http://example.net" class="">
example.net</a> (that is, you get both the DNAME and CNAME answers, but the DNAME can be ignored)</div>
<div> CAA(<a href="http://foo.example.net" class="">foo.example.net</a>) -> nothing</div>
<div> DNAME(<a href="http://foo.example.net" class="">foo.example.net</a>) -> nothing</div>
<div> CAA(<a href="http://example.net" class="">example.net</a>) -> nothing</div>
<div> DNAME(<a href="http://example.net" class="">example.net</a>) -> nothing</div>
<div> CAA(net) -> value</div>
<div><br class="">
</div>
<div><br class="">
</div>
<div>There’s a degenerate case with DNAME, but since it’s rarely used I don’t think it’s something to take care of. Let’s imagine there’s no CAA record at all, « <a href="http://example.com" class="">example.com</a> » is a DNAME to « <a href="http://example.net" class="">example.net</a> »,
and you’re requesting the relevant CAA record for « <a href="http://foo.bar.example.com" class="">foo.bar.example.com</a> » (with some indentation for the recursive part):</div>
<div><br class="">
</div>
<div>CAA(<a href="http://foo.bar.example.com" class="">foo.bar.example.com</a>) ->
<a href="http://foo.bar.example.com" class="">foo.bar.example.com</a> CNAME <a href="http://foo.bar.example.net" class="">
foo.bar.example.net</a>, <a href="http://example.com" class="">example.com</a> DNAME
<a href="http://example.net" class="">example.net</a></div>
<div> CAA(<a href="http://foo.bar.example.net" class="">foo.bar.example.net</a>) -> nothing</div>
<div> DNAME(<a href="http://foo.bar.example.net" class="">foo.bar.example.net</a>) -> nothing</div>
<div> CAA(<a href="http://bar.example.net" class="">bar.example.net</a>)-> nothing</div>
<div> DNAME(<a href="http://bar.example.net" class="">bar.example.net</a>) -> nothing</div>
<div> CAA(<a href="http://example.net" class="">example.net</a>) -> nothing</div>
<div> DNAME(<a href="http://example.net" class="">example.net</a>) -> nothing</div>
<div> CAA(net) -> nothing</div>
<div>CAA(<a href="http://bar.example.com" class="">bar.example.com</a>) -> <a href="http://bar.example.com" class="">
bar.example.com</a> CNAME <a href="http://bar.example.net" class="">bar.example.net</a>,
<a href="http://example.com" class="">example.com</a> DNAME <a href="http://example.net" class="">
example.net</a></div>
<div> CAA(<a href="http://bar.example.net" class="">bar.example.net</a>) -> nothing</div>
<div> DNAME(<a href="http://bar.example.net" class="">bar.example.net</a>) -> nothing</div>
<div> CAA(<a href="http://example.net" class="">example.net</a>) -> nothing</div>
<div> DNAME(<a href="http://example.net" class="">example.net</a>) -> nothing</div>
<div> CAA(net) -> nothing</div>
<div>CAA(<a href="http://example.com" class="">example.com</a>) -> nothing [*]</div>
<div>DNAME(<a href="http://example.com" class="">example.com</a>) -> <a href="http://example.com" class="">
example.com</a> DNAME <a href="http://example.net" class="">example.net</a></div>
<div></div>
<div> CAA(<a href="http://example.net" class="">example.net</a>) -> nothing</div>
<div> DNAME(<a href="http://example.net" class="">example.net</a>) -> nothing</div>
<div> CAA(net) -> nothing</div>
<div>CAA(com) -> nothing</div>
<div><br class="">
</div>
<div><br class="">
</div>
<div>[*] On some resolvers, this query returns the CNAME+DNAME tuple. I’m not a DNS master, but I suspect the good answer to be the empty answer, justifying the explicit query for DNAMEs.</div>
<div><br class="">
</div>
</div>
<br class="">
</div>
</body>
</html>