Subject: [dane] Comments on -proto, Appendix 1

From: "Richard L. Barnes" <[email-masked]>
Date: Fri, 29 Jul 2011 14:10:37 -0400

Overall, I think this text is really good.  The one thing I would like to see is a little more discussion of the operational meaning of the three example cases.  For example:

1. Both the service and TLSA records are delegated to the CNAME target, allowing the operator of the target to choose the service delivery point and the certificate constraints/assertions.

2. Only the service record is delegated to the CNAME target.  The origin domain holder retains control of TLSA records, enabling him to place constraints on the certificates used by the target operator.  The target operator also provides TLSA information that may be used by the target itself (directly) or by other origin domains delegated to the target domain.

3. Only the service record is delegated to the CNAME target.  The origin domain holder retains control of TLSA records, enabling him to place constraints on the certificates used by the target operator.