<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 14 Sep 2017, at 12:11 pm, Wayne Thayer via Public <<a href="mailto:public@cabforum.org" class="">public@cabforum.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; font-family: HelveticaNeue; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Thanks Geoff. To be clear, does your proposed language require ‘authentication of an NSEC RRset that proves that no DS RRset is present for this zone’ in order to meet the new condition of the last item, or can an unauthenticated query that returns no DS record be used to meet this condition? If the former, then I wonder if the work to implement this is much different than requiring full support for DNSSEC.</div></div></div></blockquote><div><br class=""></div><div>I don’t think we’re trying to require DNSSEC validation, so an unauthenticated query would be evidence.</div><div><br class=""></div><div>I do draw your attention to RFC 6840, which clarifies some details, in particular section 4.4 explains the need to check that there’s a NS record served by the same servers that deny existence of a DS record.</div><div><br class=""></div><div><br class=""></div><blockquote type="cite" class=""><div class=""><div class="WordSection1" style="page: WordSection1; font-family: HelveticaNeue; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);"><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(181, 196, 223); padding: 3pt 0in 0in;" class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><b class=""><span style="font-size: 12pt;" class="">From:<span class="Apple-converted-space"> </span></span></b><span style="font-size: 12pt;" class="">Public <<a href="mailto:public-bounces@cabforum.org" class="">public-bounces@cabforum.org</a>> on behalf of Geoff Keating via Public <<a href="mailto:public@cabforum.org" class="">public@cabforum.org</a>><br class=""><b class="">Reply-To:<span class="Apple-converted-space"> </span></b>Geoff Keating <<a href="mailto:geoffk@apple.com" class="">geoffk@apple.com</a>>, CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" class="">public@cabforum.org</a>><br class=""><b class="">Date:<span class="Apple-converted-space"> </span></b>Thursday, September 14, 2017 at 10:03 AM<br class=""><b class="">To:<span class="Apple-converted-space"> </span></b>CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" class="">public@cabforum.org</a>><br class=""><b class="">Subject:<span class="Apple-converted-space"> </span></b>[cabfpub] DNSSEC validation for CAA record lookup failure<o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">At the moment the BRs say:<span class="Apple-converted-space"> </span><o:p class=""></o:p></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10pt; font-family: Cambria, serif;" class="">CAs are permitted to treat a record lookup failure as permission to issue if:</span><o:p class=""></o:p></div><ul type="disc" style="margin-bottom: 0in;" class=""><li class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 10pt; font-family: Cambria, serif;" class="">the failure is outside the CA's infrastructure;<o:p class=""></o:p></span></li><li class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 10pt; font-family: Cambria, serif;" class="">the lookup has been retried at least once; and<o:p class=""></o:p></span></li><li class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 10pt; font-family: Cambria, serif;" class="">the domain's zone does not have a DNSSEC validation chain to the ICANN root. <o:p class=""></o:p></span></li></ul></div></div></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">I suggest replacing the last item with “the record being looked up is classified as ‘Insecure’ under RFC 4035 section 4.3, as amended.”<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">The most common case of this will be that the record being looked up is a CAA record for, say,<span class="Apple-converted-space"> </span><a href="http://example.com/" style="color: purple; text-decoration: underline;" class="">example.com</a>; the .com servers have been contacted successfully, producing authenticated NS records for<span class="Apple-converted-space"> </span><a href="http://example.com/" style="color: purple; text-decoration: underline;" class="">example.com</a>, but the<span class="Apple-converted-space"> </span><a href="http://example.com/" style="color: purple; text-decoration: underline;" class="">example.com</a> name servers cannot be contacted; and the .com servers have provided authenticated denial of existence for a DS record for<span class="Apple-converted-space"> </span><a href="http://example.com/" style="color: purple; text-decoration: underline;" class="">example.com</a>. This is covered in RFC 4035 section 5.2, “If the validator authenticates an NSEC RRset that proves that no DS RRset is present for this zone, then there is no authentication path leading from the parent to the child."<o:p class=""></o:p></div></div></div><span style="font-family: HelveticaNeue; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;" class="">_______________________________________________</span><br style="font-family: HelveticaNeue; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><span style="font-family: HelveticaNeue; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;" class="">Public mailing list</span><br style="font-family: HelveticaNeue; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><a href="mailto:Public@cabforum.org" style="color: purple; text-decoration: underline; font-family: HelveticaNeue; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class="">Public@cabforum.org</a><br style="font-family: HelveticaNeue; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><a href="https://cabforum.org/mailman/listinfo/public" style="color: purple; text-decoration: underline; font-family: HelveticaNeue; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class="">https://cabforum.org/mailman/listinfo/public</a><br style="font-family: HelveticaNeue; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""></div></blockquote></div><br class=""></body></html>