<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><a name="_MailEndCompose"><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></a></p><div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal style='margin-left:30.5pt'><b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>From:</span></b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'> geoffk@apple.com [mailto:geoffk@apple.com] <br><b>Sent:</b> Tuesday, October 3, 2017 10:07 PM<br><b>To:</b> Doug Beattie <doug.beattie@globalsign.com>; CA/Browser Forum Public Discussion List <public@cabforum.org><br><b>Subject:</b> Re: [cabfpub] CAA look up failures and retry logic<o:p></o:p></span></p></div></div><p class=MsoNormal style='margin-left:30.5pt'><o:p> </o:p></p><p class=MsoNormal style='margin-left:30.5pt'><o:p> </o:p></p><div><p class=MsoNormal style='margin-left:30.5pt'><br><br><o:p></o:p></p><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><p class=MsoNormal style='margin-left:30.5pt'>On Oct 4, 2017, at 12:01 AM, Doug Beattie via Public <<a href="mailto:public@cabforum.org">public@cabforum.org</a>> wrote:<o:p></o:p></p></div></blockquote><p class=MsoNormal style='margin-left:30.5pt'><br><br><o:p></o:p></p><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><div><p class=MsoNormal style='margin-left:30.5pt'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>The BRs say if a lookup has been retried at least once that is permission to issue. Does this mean doing<o:p></o:p></span></p></div><div style='margin-left:.5in'><p class=MsoNormal style='margin-left:30.5pt;text-indent:-.25in'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>-</span><span style='font-size:7.0pt'> <span class=apple-converted-space> </span></span><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>a full CAA lookup, or<span class=apple-converted-space> </span><o:p></o:p></span></p></div><div style='margin-left:.5in'><p class=MsoNormal style='margin-left:30.5pt;text-indent:-.25in'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>-</span><span style='font-size:7.0pt'> <span class=apple-converted-space> </span></span><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>re-doing one failed CAA(X) look-up, or<span class=apple-converted-space> </span><o:p></o:p></span></p></div><div style='margin-left:.5in'><p class=MsoNormal style='margin-left:30.5pt;text-indent:-.25in'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>-</span><span style='font-size:7.0pt'> <span class=apple-converted-space> </span></span><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>redoing every CAA(X) lookup that failed in the course of doing a full CAA validation?<o:p></o:p></span></p></div><div><p class=MsoNormal style='margin-left:30.5pt'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'> <o:p></o:p></span></p></div><div><p class=MsoNormal style='margin-left:30.5pt'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>If we follow the RFC processing logic and we encounter one failed lookup (e.g., SERVFAIL on<span class=apple-converted-space> </span><a href="http://shop.example.com/"><span style='color:#954F72'>shop.example.com</span></a>), then we retry and it fails again, then do we exit the CAA checking and issue because the BRs say we may issue if we retry the lookup, which we just did? Reading the specs this seems to be permitted (we did “a” retry for a failed lookup), common logic says no.<o:p></o:p></span></p></div></div></blockquote><p class=MsoNormal style='margin-left:30.5pt'><o:p> </o:p></p></div><div><p class=MsoNormal style='margin-left:30.5pt'>That’s an interesting point. We could treat a (second) failure as meaning:<o:p></o:p></p></div><div><p class=MsoNormal style='margin-left:30.5pt'>- Assume there is no CAA record here, continue with the algorithm, and maybe find a lower CAA record which denies issuance<o:p></o:p></p></div><div><p class=MsoNormal style='margin-left:30.5pt'>- Assume there is a CAA record here which specifically allows issuance.<o:p></o:p></p></div><div><p class=MsoNormal style='margin-left:30.5pt'><o:p> </o:p></p></div><div><p class=MsoNormal style='margin-left:30.5pt'>I believe the current wording is the second, not the first. I think considering we’re just getting started with mandatory CAA, it’s OK to have this rule at the moment. Switching to the first rule might be a way to tighten things once we’ve gotten some experience.<o:p></o:p></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>We run into a lot of failures when looking up the full host name for CAA records, but then we find CAA records at the Top Level Domain (where most domain administrators put them). If I’m understanding your comments, I’m not sure your second option is good in these cases because the failure would permit issuance without looking harder for a CAA record, but this is a good discussion point. Anyone else have a comment?<o:p></o:p></span></p></div></div></div></body></html>