<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Mar 28, 2017, at 6:54 AM, Gervase Markham via Public <<a href="mailto:public@cabforum.org" class="">public@cabforum.org</a>> wrote:</div><div class=""><div bgcolor="#FFFFFF" text="#000000" class=""><div class="moz-text-html" lang="x-unicode"><div class="WordSection1"><br class="">
Here's a draft of a ballot to forbid DTPs from doing Domain
Validation, as discussed at the F2F. Again, this is early text,
so comments on both the approach and the wording are very
welcome.<br class="">
<br class="">
Is an Enterprise RA a subset of Delegated Third Party, or a
different thing? The BRs seem a little unclear on this. I think
they are a separate thing, but there are some bits of wording
this ballot modifies or removes that suggest that they are a
subset. Comments?</div></div></div></div></blockquote><br class=""></div><div>I think it would be good to clarify that this does not prevent using contractors or third parties for domain validation, but rather requires the CA not exclude it from their audit scope. For example, a CA might decide to use a service like <a href="https://www.whoisxmlapi.com/" class="">https://www.whoisxmlapi.com/</a> to help get and parse whois data. This is clearly a third party involved in the validation process. The same would be true if the CA uses a service to send emails.</div><div><br class=""></div><div>What is relevant is that the CA takes responsibility for the process.</div><div><br class=""></div><div>Thanks,</div><div>Peter</div></body></html>