Re: [dane] TLSA RRset and CNAME question
John Gilmore <gnu@toad.com> Thu, 14 March 2013 19:21 UTC
Return-Path: <gnu@toad.com>
X-Original-To: dane@ietfa.amsl.com
Delivered-To: dane@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1519C11E80F2 for <dane@ietfa.amsl.com>; Thu, 14 Mar 2013 12:21:16 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qpCWMveI5o4i for <dane@ietfa.amsl.com>; Thu, 14 Mar 2013 12:21:15 -0700 (PDT)
Received: from new.toad.com (new.toad.com [209.237.225.253]) by ietfa.amsl.com (Postfix) with ESMTP id 92F3611E8192 for <dane@ietf.org>; Thu, 14 Mar 2013 12:21:07 -0700 (PDT)
Received: from new.toad.com (localhost.localdomain [127.0.0.1]) by new.toad.com (8.12.9/8.12.9) with ESMTP id r2EJL6N5008619 for <dane@ietf.org>; Thu, 14 Mar 2013 11:21:06 -0800
Message-Id: <201303141921.r2EJL6N5008619@new.toad.com>
To: dane@ietf.org
In-reply-to: <20130313235308.GD29304@mournblade.imrryr.org>
References: <20130313235308.GD29304@mournblade.imrryr.org>
Comments: In-reply-to Viktor Dukhovni <viktor1dane@dukhovni.org> message dated "Wed, 13 Mar 2013 23:53:08 +0000."
Date: Thu, 14 Mar 2013 11:21:06 -0800
From: John Gilmore <gnu@toad.com>
Subject: Re: [dane] TLSA RRset and CNAME question
X-BeenThere: dane@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: DNS-based Authentication of Named Entities <dane.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dane>, <mailto:dane-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dane>
List-Post: <mailto:dane@ietf.org>
List-Help: <mailto:dane-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dane>, <mailto:dane-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 14 Mar 2013 19:21:16 -0000
> Suppose a query a known signed zone: > > Q: _25._tcp.mail.example.com. IN TLSA ? > > and I receive a signed CNAME referral: > > A: _25._tcp.mail.example.com. IN CNAME 3.1.1._tlsa.example.edu. > Is this a a case of "no TLSA records" or "no usable TLSA records"? This is a case of "no TLSA records". That's a CNAME record, not a TLSA record. If the domain admin wanted to put a TLSA record there, they know how to do that. There is nothing magic about the _25._tcp subdomain names. Using them for a CNAME (or an A record or anything else) does not indicate a desire to use TLSA records. John
- Re: [dane] TLSA RRset and CNAME question Lawrence Conroy
- [dane] TLSA RRset and CNAME question Viktor Dukhovni
- Re: [dane] TLSA RRset and CNAME question James Cloos
- Re: [dane] TLSA RRset and CNAME question John Gilmore
- Re: [dane] TLSA RRset and CNAME question Andrew Sullivan
- Re: [dane] TLSA RRset and CNAME question Viktor Dukhovni
- Re: [dane] TLSA RRset and CNAME question Viktor Dukhovni
- Re: [dane] TLSA RRset and CNAME question Andrew Sullivan