Subject: [dnsext] RFC 2142 and "organization's top level domain"

From: Dave CROCKER <[email-masked]>
Date: Fri, 10 Sep 2010 17:48:05 -0700

Folks,

I'm trying to resolve an erratum, on RFC 2142, MAILBOX NAMES FOR COMMON 
SERVICES, ROLES AND FUNCTIONS".  The current focus is a narrow matter of 
nomenclature.  Broader issues about a full revision effort for the document are 
worthy, but outside of the current scope.

RFC 2142 uses the phrase "organization's top level domain".  This refers to the 
string that is delegated to the organization and provides the root of any 
sub-tree to the DNS that they create.  Around the world and around the DNS, this 
'root' will have two or more fields, such as bbiw.net or ucl.ac.uk. (And with 
recent TLD rule changes, presumably this now is /one/ or more fields...)

So it would refer to ietf.org, rather than tools.ietf.org or www.ietf.org, and 
ucl.ac.uk, rather than www.ucl.ac.uk or bartlett.ucl.ac.uk, for example.

The construct of a domain name that an organization registers, and for which it 
receives a delegation, is important.  Yet there appears to be no common term for 
it.  RFC 2142 was written quite awhile ago.  It uses a term that is formally 
reasonable, but which has become potentially confusing.  The reference to "top 
level" for a domain name, is now so universally taken to mean a TLD, that it is 
reasonable to assume that the "organizational" qualifier is not sufficient to 
move the reader away from the meaning they are likely to expect.

So the question is what other term to use?

I raised this question to the IETF applications discussion list and we wandered 
over various choices.  Tony Finch came up with one that I'd like to declare the 
winner, unless you folks come up with something better:

    organization's principal domain name

Comments?

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

---

From: Brian Dickson <[email-masked]>
Date: Fri, 10 Sep 2010 22:25:21 -0300

On Fri, Sep 10, 2010 at 9:48 PM, Dave CROCKER <[email-masked]> wrote:

> nomenclature.  Broader issues about a full revision effort for the document
> are worthy, but outside of the current scope.
>
> RFC 2142 uses the phrase "organization's top level domain".  This refers to
> the string that is delegated to the organization and provides the root of
> any sub-tree to the DNS that they create.  Around the world and around the
> DNS, this 'root' will have two or more fields, such as bbiw.net or
> ucl.ac.uk. (And with recent TLD rule changes, presumably this now is /one/
> or more fields...)
>
> So it would refer to ietf.org, rather than tools.ietf.org or www.ietf.org,
> and ucl.ac.uk, rather than www.ucl.ac.uk or bartlett.ucl.ac.uk, for
> example.
>
> The construct of a domain name that an organization registers, and for
> which it receives a delegation, is important.  Yet there appears to be no
> common term for it.  RFC 2142 was written quite awhile ago.  It uses a term
> that is formally reasonable, but which has become potentially confusing.
>  The reference to "top level" for a domain name, is now so universally taken
> to mean a TLD, that it is reasonable to assume that the "organizational"
> qualifier is not sufficient to move the reader away from the meaning they
> are likely to expect.
>
> I raised this question to the IETF applications discussion list and we
> wandered over various choices.  Tony Finch came up with one that I'd like to
> declare the winner, unless you folks come up with something better:
>

I think, in some regards, "organization" is itself ambiguous, in two
regards.
One, is that a large entity could have several internal organizations.
Second, is that some organizations will have multiple domain names, and each
will need to be identified separately, rather than having one "principal
name", if it is meant to refer to the domain name and not, for example, the
administrative contact for all the domains. (If it is the latter, then the
winner works for me.)

In no particular order, are some suggestions for alternatives:

Domain Name Apex, or Domain Apex Name

Autonomous Domain Name (i.e. indicating the demarcation boundary)

Demarcation Name

Zenith

Alpha Name

Prime Name

Canonical Name (not!)

Brian

---

From: Dave CROCKER <[email-masked]>
Date: Fri, 10 Sep 2010 20:13:02 -0700

On 9/10/2010 6:25 PM, Brian Dickson wrote:
> I think, in some regards, "organization" is itself ambiguous, in two regards.

Folks,

Thanks for the quick response(s) (counting private email)...

I should have phrased my note as:

      "The apps folks had extensive discussions and explored various 
alternatives and converged on a term and I would like to know whether the DNS 
community sees a serious problem with using the term "organization's principal 
domain name".

Since I failed to do that, I wound up inviting you folks to re-explore the topic 
more generally, including ground the apps group had already covered.  So I 
should go into some detail about the apps discussion:

1. The requirement is for a term that can be widely used, and particularly by 
regular (non-geek) users.  This imposes a significant burden in making the term 
be relatively natural and friendly for everyday use by everyday people.

2. The apps discussion explored "registered" and "delegated" before getting to 
"principal".  About the first two, it was decided that the use of a DNS term of 
art in a way that might not be sufficiently accurate or precise would be 
ill-advised.  All nodes are delegated; hence that word is not sufficiently 
precise.  "Registered" almost won, but finally caused some discomfort.  So the 
preference was for a term that does not carry DNS technical baggage.

3. Organization is a nicely generic term, although the fact of sub-organizations 
got mentioned in the earlier discussion, too. However it's not clear that that 
really causes any problems.  For whatever organization is being referenced -- 
parent, subsidiary, whatever -- there can be a domain name that it uses that is 
a "root" for that organization.  (Again note that we can't use "root" as a 
choice here.)

4. "Primary" almost won but it tends to suggest that there are competing, 
parallel choices and that's not intended.  Principal can indeed suggest 
competing alternatives, but it also can simply refer to a core term, without 
there needing to be alternatives. The distinction between having only one 
principal domain name and having multiple is covered by prefacing with 'a' when 
there are multiple and 'the' when there is one.

We can, of course, wander over the solution space if folks really want to, but 
again, what I'm most interested in is whether the DNS community sees fundamental 
problems with the phrase.

Thanks!

d/
-- 

   Dave Crocker

---

From: Florian Weimer <[email-masked]>
Date: Mon, 13 Sep 2010 07:59:49 +0000

> Comments?

Just move the RFC to HISTORICAL.

The advice in this RFC on the security mailbox has been interpreted in
a way that in order to receive CERT/CC notices etc., you write to your
organization's postmaster and request addition to the security mail
exploder.  (I've worked for organizations that did not treat security
mailbox mail as on a need-to-know basis, as it is the expectation
nowadays, at least some of them citing the RFC as a rationale.)  I'm
not sure if it was your intent, but the document can be easily read
that way.  Existing practice is rather different, of course.

-- 
Florian Weimer                <[email-masked]>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: +49-721-96201-1
D-76133 Karlsruhe             fax: +49-721-96201-99

---

From: Dave CROCKER <[email-masked]>
Date: Mon, 13 Sep 2010 12:00:25 -0700

> Just move the RFC to HISTORICAL.

And I tried so hard to make clear what the scope of my query was.  Sigh.

So far, I haven't seen any objections to the term.

d/

-- 

   Dave Crocker

---

From: Kevin Darcy <[email-masked]>
Date: Mon, 13 Sep 2010 18:49:08 -0400

On 9/10/2010 8:48 PM, Dave CROCKER wrote:
> Folks,
>
> I'm trying to resolve an erratum, on RFC 2142, MAILBOX NAMES FOR 
> COMMON SERVICES, ROLES AND FUNCTIONS".  The current focus is a narrow 
> matter of nomenclature.  Broader issues about a full revision effort 
> for the document are worthy, but outside of the current scope.
>
> RFC 2142 uses the phrase "organization's top level domain".  This 
> refers to the string that is delegated to the organization and 
> provides the root of any sub-tree to the DNS that they create.  Around 
> the world and around the DNS, this 'root' will have two or more 
> fields, such as bbiw.net or ucl.ac.uk. (And with recent TLD rule 
> changes, presumably this now is /one/ or more fields...)
>
> So it would refer to ietf.org, rather than tools.ietf.org or 
> www.ietf.org, and ucl.ac.uk, rather than www.ucl.ac.uk or 
> bartlett.ucl.ac.uk, for example.
>
> which it receives a delegation, is important.  Yet there appears to be 
> no common term for it.  RFC 2142 was written quite awhile ago.  It 
> uses a term that is formally reasonable, but which has become 
> potentially confusing.  The reference to "top level" for a domain 
> name, is now so universally taken to mean a TLD, that it is reasonable 
> to assume that the "organizational" qualifier is not sufficient to 
> wandered over various choices.  Tony Finch came up with one that I'd 
> like to declare the winner, unless you folks come up with something 
> better:
>
"Principal" is too subjective, in my opinion, since it can be defined as 
"most valuable" or "most important", which is in the eye of the beholder.

Given the context and apparent intent of the RFC, there should be some 
hierarchism in the term, so that [email-masked], for instance, would 
cover all of the subdomains beneath that registered/delegated domain, 
e.g. smtp.example.com, www.example.com, even if "example.com" itself may 
own no A records and thus may not, through, say, a "web"-oriented lens, 
be viewed as "most valuable" -- since it generates no hits, lures no 
eyeballs -- and thus, arguably, is not the "principal" domain name for 
the organization.

But, how to capture that hierarchism, without using the lately-confusing 
term "top level", and without impeding members of the intended audience, 
who don't happen to be DNS experts, with alternative yet bulky verbiage 
about the namespace hierarchy (e.g. "common ancestor", "highest-level 
enclosing", "least-labels enclosing")?

I don't know that it's possible to retain hierarchism without defining 
the relevant words/terms from the DNS realm, but if defining-verbiage 
cannot be avoided, the jargon term "apex" might be shortest and crispest 
one to use, as in "[organization's] apex domain". It would only need to 
be defined *once*, of course, and that would cover all 3 uses of the term.

                 - Kevin

---

From: Tony Finch <[email-masked]>
Date: Tue, 14 Sep 2010 12:16:38 +0100

On 13 Sep 2010, at 23:49, Kevin Darcy <[email-masked]> wrote:
> "highest-level enclosing"

I quite like this suggestion. I agree with your comments about the subjectivity of "principal" and the usefulness of keeping the hierarchy in mind.

>  the jargon term "apex" might be shortest and crispest one to use,                                                                                                                                                      

The problem with that is it suggests that zone cuts match organizational boundaries, which is not always the case.

Tony.
--
f.anthony.n.finch  <[email-masked]>  http://dotat.at/

---

From: Florian Weimer <[email-masked]>
Date: Tue, 14 Sep 2010 14:07:35 +0000

* Dave CROCKER:

> 1. The requirement is for a term that can be widely used, and
> particularly by regular (non-geek) users.  This imposes a significant
> burden in making the term be relatively natural and friendly for
> everyday use by everyday people.

"domain" or "domain name", without further qualification.  In cases
where this leads to ambiguities, there are difficulties which could
only be resolved by formalistic approaches anyway.

> 2. The apps discussion explored "registered" and "delegated" before
> getting to "principal".  About the first two, it was decided that the
> use of a DNS term of art in a way that might not be sufficiently
> accurate or precise would be ill-advised.

It's also inappropriate because authoritaty over the name may not have
been delegated to the organization, or the name may not hot have been
registered, but assigned.

---

From: Andrew Sullivan <[email-masked]>
Date: Tue, 14 Sep 2010 10:17:58 -0400

> be defined *once*, of course, and that would cover all 3 uses of the 

When the discussion came up on the applications list, the original
suggestion included the word "delegated".  As discussion proceeded, it
became clear that some domains weren't delegated, and therefore we
couldn't use that word.

I'm afraid "apex" has the same problem.  The apex of a zone is a
well-defined notion in the DNS (and given the number of slack
definitions we have in the DNS, well-defined terms are to be valued).  

A

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.