Subject: Re: [dane] DNS wildcards (was: Starting WGLC on: draft-ietf-dane-use-cases-02)

From: =JeffH <[email-masked]>
Date: Fri, 13 May 2011 09:33:40 -0700

Andrew Sullivan <[email-masked]> said..
 >
 > I'm slightly uneasy with the requirement about wild cards and CNAME
 > (and why not DNAME?) at the end of section 4.  It's a little glib from
 > my point of view, and I'm not actually sure what is supposed to be
 > entailed.  For instance, once answer to "be compatible with" is "use
 > wildcards or use DANE, but not both."  Is that ok?  This is perhaps my
 > most serious issue.  I think I'd prefer to see text along the
 > following lines instead:
 >
 >    Wild Cards and DNS redirection: The mechanism for distributing DANE
 >       information must not be susceptible to subversion in the face of
 >       DNS wild card labels (*) and redirection chains (such as those
 >       resulting from CNAME or DNAME records).  In the case of wild
 >       card labels, it is desirable that the mechanism work when the
 >       owner name is a wild card, so that it may cover any wild card
 >       expansion [note: is that what's intended?  ajs].  In the case of
 >       redirection chains, it is desirable that the mechanism work when
 >       the owner name is the result of following redirection chains.
 >

this seems like a reasonable re-statement of that functional requirement -- 
does it correctly state was is intended/desired behavior ?

=JeffH