Subject: [DNSOP] Publishing Information for Entities Identified by Domain Names

From: Martin Hoffmann <[email-masked]>
Date: Wed, 22 Jan 2020 15:11:55 +0100

Dear DNSOP,

for a project we’ve been working[0] we needed to discover the location
of documents describing certain entities. We decided to pick domain
names as the identifiers and then use the DNS for publication of those
locations. It turned out there isn’t currently a mechanism to actually
do that (other than possibly NAPTR but that seemed overly complex).

We believe that such a mechanism will be useful for other applications,
too, so I submitted a draft for it:

| Name:      draft-hoffmann-dnsop-names-as-identifiers
| Revision:  00
| Title:     Publishing Information for Entities Identified by Domain Names
| URL:       https://www.ietf.org/internet-drafts/draft-hoffmann-dnsop-names-as-identifiers-00.txt
|
| Abstract:
|    This memo describes a mechanism to publish information related to an
|    entity identified through a domain name via the Domain Name System
|    (DNS).  In particular, this mechanism allows publishing the location
|    of topical documents describing the entity and relationships with
|    other entities.  An example application is the publishing of
|    additional requirements for PKI certification authorities.

Is this useful work for the DNSOP working group to explore?

Kind regards,
Martin

[0] https://www.lightest.eu/

---

From: Olli Vanhoja <[email-masked]>
Date: Sat, 25 Jan 2020 20:35:02 +0100

> |    additional requirements for PKI certification authorities.

I'm not sure whether I understand the reason for using DNS. What
prevents you from using HTTP and a path? Linking could be HTTP
redirect?

---

From: "John Levine" <[email-masked]>
Date: 25 Jan 2020 17:41:20 -0500

>do that (other than possibly NAPTR but that seemed overly complex).

You might take a look at RFCs 8552 and 8553.  There is a long history
of publishing stuff in the DNS with scoped identifiers.

R's,
John

---

From: Martin Hoffmann <[email-masked]>
Date: Mon, 27 Jan 2020 10:51:42 +0100

John Levine wrote:
> >for a project we’ve been working[0] we needed to discover the
> >location of documents describing certain entities. We decided to
> >pick domain names as the identifiers and then use the DNS for
> >publication of those locations. It turned out there isn’t currently
> >a mechanism to actually do that (other than possibly NAPTR but that
> >seemed overly complex).  
> 

All the uses mentioned defined so far are about service discovery. This
draft essentially adds a means for information discovery to it. I
didn’t want to pollute the global scope namespace, though, so I
proposed to add one global node name to it and then take it from there.

Kind regards,
Martin

---

From: Martin Hoffmann <[email-masked]>
Date: Mon, 27 Jan 2020 11:20:50 +0100

Olli Vanhoja wrote:
> prevents you from using HTTP and a path?

Using the URI both as an identifier and an information locator makes it
difficult to use an identifier for multiple purposes. It can be done, but
requires more steps and whereas prefixing it with a topic specifier and
using existing DNS records is fairly straightforward and (at least in my
mind) clean. It also allows publication of documents independently of the
owner of the identifier, even use different publication providers for
different topics.

> Linking could be HTTP redirect?

Yes, but then you can’t publish a document anymore.

Kind regards,
Martin

---

From: "John R Levine" <[email-masked]>
Date: 27 Jan 2020 10:22:33 -0500

> All the uses mentioned defined so far are about service discovery.

Not at all.  _dmarc publishes info about mail sending policy, 
_dkim about message validation keys, and all of the TLSA tags are keys for 
TLS certificates.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly