<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-7">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
While that was not the intention, we might want to reconsider this. </div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I just checked a few domains in the Cisco Umbrella 1 Million and many of them show the same problem.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
But if we accept that an external DNS operator can be trusted, it might not be an issue. </div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The difference is that for other methods a provider needs to add or change DNS records, but for the SOA contact they can use an email address that is already in place.</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Dimitris Zacharopoulos (HARICA) <dzacharo@harica.gr><br>
<b>Sent:</b> Thursday, February 4, 2021 11:49<br>
<b>To:</b> CA/B Forum Server Certificate WG Public Discussion List <servercert-wg@cabforum.org>; Paul van Brouwershaven <Paul.vanBrouwershaven@entrust.com><br>
<b>Subject:</b> Re: [Servercert-wg] [EXTERNAL] Update definition of IP Address Contact in the BRs</font>
<div> </div>
</div>
<div><br>
<br>
<div class="x_moz-cite-prefix">On 4/2/2021 12:28 ì.ì., Dimitris Zacharopoulos (HARICA) via Servercert-wg wrote:<br>
</div>
<blockquote type="cite"><br>
<br>
<div class="x_moz-cite-prefix">On 4/2/2021 10:31 ð.ì., Paul van Brouwershaven wrote:<br>
</div>
<blockquote type="cite"><style type="text/css" style="display:none">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div style=""><span style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">The problem is that many DNS providers
</span><span style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">default this value to an address of their own. </span></div>
<div style=""><br>
</div>
<div style=""><span style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">Where many
</span><span style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">in-addr.arpa
</span><span style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">zones are probably operated by range owner in some automated system, some smaller ranges might be delegated to a DNS provider. There are for example almost
3000 zones hosted on AWS Route 53, some sampling showed that many have the address '</span><span style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)"><a class="x_moz-txt-link-abbreviated" href="mailto:awsdns-hostmaster@amazon.com">awsdns-hostmaster@amazon.com</a>'
in the SOA record.</span></div>
<div style=""><br>
</div>
</blockquote>
</blockquote>
<br>
In addition to my earlier comment, Paul, your comment appears to question an existing requirement for Forward Lookup Domain Name queries. Was your intention to challenge an existing requirement for the Domain Contact definition?<br>
<br>
<br>
Thanks,<br>
Dimitris.<br>
<br>
</div>
</body>
</html>