<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">At the moment the BRs say:<div class=""><br class=""></div><div class="">
<div class="page" title="Page 24">
<div class="layoutArea">
<div class="column"><p class=""><span style="font-size: 10.000000pt; font-family: 'Cambria'" class="">CAs are permitted to treat a record lookup failure as permission to issue if:
</span></p>
<ul class="">
<li style="font-size: 10.000000pt; font-family: 'Cambria'" class=""><p class=""><span style="font-size: 10pt;" class="">the failure is outside the CA's infrastructure;
</span></p>
</li>
<li style="font-size: 10.000000pt; font-family: 'Cambria'" class=""><p class=""><span style="font-size: 10pt;" class="">the lookup has been retried at least once; and
</span></p>
</li>
<li style="font-size: 10.000000pt; font-family: 'Cambria'" class=""><p class=""><span style="font-size: 10pt;" class="">the domain's zone does not have a DNSSEC validation chain to the ICANN root. </span></p>
</li>
</ul>
</div>
</div>
</div></div><div class="">I suggest replacing the last item with “the record being looked up is classified as ‘Insecure’ under RFC 4035 section 4.3, as amended.”</div><div class=""><br class=""></div><div class="">The most common case of this will be that the record being looked up is a CAA record for, say, <a href="http://example.com" class="">example.com</a>; the .com servers have been contacted successfully, producing authenticated NS records for <a href="http://example.com" class="">example.com</a>, but the <a href="http://example.com" class="">example.com</a> name servers cannot be contacted; and the .com servers have provided authenticated denial of existence for a DS record for <a href="http://example.com" class="">example.com</a>. This is covered in RFC 4035 section 5.2, “If the validator authenticates an NSEC RRset that proves that no DS RRset is present for this zone, then there is no authentication path leading from the parent to the child."</div></body></html>