<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Oct 4, 2017, at 12:01 AM, Doug Beattie via Public <<a href="mailto:public@cabforum.org" class="">public@cabforum.org</a>> wrote:</div><div class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""></div></div></div></blockquote><br class=""><blockquote type="cite" class=""><div class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">The BRs say if a lookup has been retried at least once that is permission to issue. Does this mean doing</span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif; text-indent: -0.25in;" class=""><span class="">-<span style="font-style: normal; font-variant-caps: normal; font-weight: normal; font-stretch: normal; font-size: 7pt; line-height: normal; font-family: "Times New Roman";" class=""> <span class="Apple-converted-space"> </span></span></span>a full CAA lookup, or<span class="Apple-converted-space"> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif; text-indent: -0.25in;" class=""><span class="">-<span style="font-style: normal; font-variant-caps: normal; font-weight: normal; font-stretch: normal; font-size: 7pt; line-height: normal; font-family: "Times New Roman";" class=""> <span class="Apple-converted-space"> </span></span></span>re-doing one failed CAA(X) look-up, or<span class="Apple-converted-space"> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif; text-indent: -0.25in;" class=""><span class="">-<span style="font-style: normal; font-variant-caps: normal; font-weight: normal; font-stretch: normal; font-size: 7pt; line-height: normal; font-family: "Times New Roman";" class=""> <span class="Apple-converted-space"> </span></span></span>redoing every CAA(X) lookup that failed in the course of doing a full CAA validation?<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">If we follow the RFC processing logic and we encounter one failed lookup (e.g., SERVFAIL on<span class="Apple-converted-space"> </span><a href="http://shop.example.com/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">shop.example.com</a>), then we retry and it fails again, then do we exit the CAA checking and issue because the BRs say we may issue if we retry the lookup, which we just did? Reading the specs this seems to be permitted (we did “a” retry for a failed lookup), common logic says no.<o:p class=""></o:p></div></div></div></blockquote><br class=""></div><div>That’s an interesting point. We could treat a (second) failure as meaning:</div><div>- Assume there is no CAA record here, continue with the algorithm, and maybe find a lower CAA record which denies issuance</div><div>- Assume there is a CAA record here which specifically allows issuance.</div><div><br class=""></div><div>I believe the current wording is the second, not the first. I think considering we’re just getting started with mandatory CAA, it’s OK to have this rule at the moment. Switching to the first rule might be a way to tighten things once we’ve gotten some experience.</div></body></html>