<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<br>
<br>
<div class="moz-cite-prefix">On 4/2/2021 1:21 μ.μ., Paul van
Brouwershaven wrote:<br>
</div>
<blockquote type="cite"
cite="mid:DM5PR11MB007332AC798EA954D2C668E3F8B39@DM5PR11MB0073.namprd11.prod.outlook.com">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<style type="text/css" style="display:none;">P {margin-top:0;margin-bottom:0;}</style>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif;
font-size: 12pt; color: rgb(0, 0, 0);">
While that was not the intention, we might want to reconsider
this. </div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif;
font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif;
font-size: 12pt; color: rgb(0, 0, 0);">
I just checked a few domains in the Cisco Umbrella 1 Million and
many of them show the same problem.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif;
font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif;
font-size: 12pt; color: rgb(0, 0, 0);">
But if we accept that an external DNS operator can be trusted,
it might not be an issue. <br>
</div>
</blockquote>
<br>
I believe external DNS operators can be trusted. This has been
established in previous discussions of the Validation Subcommittee
and F2F meetings.<br>
<br>
Dimitris.<br>
<br>
<blockquote type="cite"
cite="mid:DM5PR11MB007332AC798EA954D2C668E3F8B39@DM5PR11MB0073.namprd11.prod.outlook.com">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif;
font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif;
font-size: 12pt; color: rgb(0, 0, 0);">
The difference is that for other methods a provider needs to add
or change DNS records, but for the SOA contact they can use an
email address that is already in place.</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt"
face="Calibri, sans-serif" color="#000000"><b>From:</b>
Dimitris Zacharopoulos (HARICA) <a class="moz-txt-link-rfc2396E" href="mailto:dzacharo@harica.gr"><dzacharo@harica.gr></a><br>
<b>Sent:</b> Thursday, February 4, 2021 11:49<br>
<b>To:</b> CA/B Forum Server Certificate WG Public Discussion
List <a class="moz-txt-link-rfc2396E" href="mailto:servercert-wg@cabforum.org"><servercert-wg@cabforum.org></a>; Paul van
Brouwershaven <a class="moz-txt-link-rfc2396E" href="mailto:Paul.vanBrouwershaven@entrust.com"><Paul.vanBrouwershaven@entrust.com></a><br>
<b>Subject:</b> Re: [Servercert-wg] [EXTERNAL] Update
definition of IP Address Contact in the BRs</font>
<div> </div>
</div>
<div><br>
<br>
<div class="x_moz-cite-prefix">On 4/2/2021 12:28 μ.μ., Dimitris
Zacharopoulos (HARICA) via Servercert-wg wrote:<br>
</div>
<blockquote type="cite"><br>
<br>
<div class="x_moz-cite-prefix">On 4/2/2021 10:31 π.μ., Paul
van Brouwershaven wrote:<br>
</div>
<blockquote type="cite">
<style type="text/css" style="display:none">p
{margin-top:0;
margin-bottom:0}</style>
<div style=""><span
style="font-family:Calibri,Arial,Helvetica,sans-serif;
font-size:12pt; color:rgb(0,0,0)">The problem is that
many DNS providers
</span><span
style="font-family:Calibri,Arial,Helvetica,sans-serif;
font-size:12pt; color:rgb(0,0,0)">default this value to
an address of their own. </span></div>
<div style=""><br>
</div>
<div style=""><span
style="font-family:Calibri,Arial,Helvetica,sans-serif;
font-size:12pt; color:rgb(0,0,0)">Where many
</span><span
style="font-family:Calibri,Arial,Helvetica,sans-serif;
font-size:12pt; color:rgb(0,0,0)">in-addr.arpa
</span><span
style="font-family:Calibri,Arial,Helvetica,sans-serif;
font-size:12pt; color:rgb(0,0,0)">zones are probably
operated by range owner in some automated system, some
smaller ranges might be delegated to a DNS provider.
There are for example almost 3000 zones hosted on AWS
Route 53, some sampling showed that many have the
address '</span><span
style="font-family:Calibri,Arial,Helvetica,sans-serif;
font-size:12pt; color:rgb(0,0,0)"><a
class="x_moz-txt-link-abbreviated"
href="mailto:awsdns-hostmaster@amazon.com"
moz-do-not-send="true">awsdns-hostmaster@amazon.com</a>'
in the SOA record.</span></div>
<div style=""><br>
</div>
</blockquote>
</blockquote>
<br>
In addition to my earlier comment, Paul, your comment appears to
question an existing requirement for Forward Lookup Domain Name
queries. Was your intention to challenge an existing requirement
for the Domain Contact definition?<br>
<br>
<br>
Thanks,<br>
Dimitris.<br>
<br>
</div>
</blockquote>
<br>
</body>
</html>