diff --git a/docs/draft-ietf-dconn-domainconnect-04.clean.txt b/docs/draft-ietf-dconn-domainconnect-04.clean.txt index 2dbb0d0..253e57a 100644 --- a/docs/draft-ietf-dconn-domainconnect-04.clean.txt +++ b/docs/draft-ietf-dconn-domainconnect-04.clean.txt @@ -69,6 +69,7 @@ Table of Contents 5.2. The Synchronous Flow 6. Domain Connect Objects and Templates 6.1. Template Definition + 6.1.1. Template Property Extensibility 6.2. Template Record 6.3. Template Considerations 6.3.1. Template Scope @@ -121,9 +122,10 @@ Table of Contents 12.1. Registration Procedure for Domain Connect Registries 12.2. Domain Connect Fully Specified Record Types Registry 12.3. Domain Connect Settings Properties Registry - 12.4. Guidance to the DNS Resource Record (RR) TYPEs Registry - 12.5. Underscore "_domainconnect" DNS Node Name - 12.6. Media Type Registration for application/ + 12.4. Domain Connect Template Properties Registry + 12.5. Guidance to the DNS Resource Record (RR) TYPEs Registry + 12.6. Underscore "_domainconnect" DNS Node Name + 12.7. Media Type Registration for application/ domainconnect-template+json Implementation Status Acknowledgements @@ -299,6 +301,18 @@ Table of Contents dc-host-list = domain-name *( *SP "," *SP domain-name ) ; comma-separated list of domain names + dc-template-property = dc-unprefixed-property / dc-vnd-property + ; any template-definition property name + + dc-unprefixed-property = ( ALPHA / DIGIT ) *( ALPHA / DIGIT ) + ; reserved for this specification and for + ; standards-track extensions; managed by the + ; IANA Domain Connect Template Properties registry + + dc-vnd-property = "vnd." 1*ALPHA *( "." 1*ALPHA ) + ; "vnd." tree for vendor/private template + ; properties + ; ---- Other parameter rules ---- dc-sig = 1*( ALPHA / DIGIT / "+" / "/" / "=" ) @@ -750,7 +764,7 @@ Table of Contents The template JSON structure defined in this section is identified by the media type "application/domainconnect-template+json" (see - Section 12.6). + Section 12.7). +=============+========+===================+========================+ |Data Element |Type |Key |Description | @@ -817,6 +831,23 @@ Table of Contents | | | |fractional part, and no | | | | |exponent part. | +-------------+--------+-------------------+------------------------+ + |*Template |Integer |templateSpecVersion|(OPTIONAL) The version | + |Specification| | |of the Domain Connect | + |Version* | | |template specification | + | | | |that the template | + | | | |conforms to. This | + | | | |identifies the template | + | | | |format and processing | + | | | |rules defined by this | + | | | |document and its | + | | | |successors. | + | | | |The value MUST conform | + | | | |to the dc-version syntax| + | | | |(see Section 3). For | + | | | |templates conforming to | + | | | |this document, the value| + | | | |is "1". | + +-------------+--------+-------------------+------------------------+ |*Logo* |String |logoUrl |(OPTIONAL) A graphical | | | | |logo representing the | | | | |Service Provider and/or | @@ -965,6 +996,22 @@ Table of Contents | | | |qualified domain name. | | | | |The default is "false". | +-------------+--------+-------------------+------------------------+ + |*Critical |Array of|crit |(OPTIONAL) A list of the| + |Properties* |String | |names of template | + | | | |properties that an | + | | | |implementation is | + | | | |required to understand | + | | | |and process for the | + | | | |template to be applied | + | | | |correctly. | + | | | |Each entry MUST conform | + | | | |to the dc-template- | + | | | |property syntax (see | + | | | |Section 3). | + | | | |When present, the "crit"| + | | | |property MUST NOT be | + | | | |empty. | + +-------------+--------+-------------------+------------------------+ |*Template |Array of|records |(REQUIRED) A list of | |Records* |Template| |records for the | | |Records | |template. | @@ -972,6 +1019,52 @@ Table of Contents Table 1: properties of the template definition +6.1.1. Template Property Extensibility + + The set of template-definition properties defined above MAY be + extended. To keep template definitions forward-compatible and to + avoid name collisions between this specification, future standards- + track extensions, and vendor-specific additions, the property name + space is partitioned as follows: + + * Property names without any prefix are reserved for this + specification and for future standards-track extensions that + normatively require this document as their base. Such names are + managed through the IANA "Domain Connect Template Properties" + registry (see Section 12.4). Implementations MUST NOT introduce + private or vendor-specific properties using unprefixed names. + + * Property names beginning with "vnd." are reserved for vendor- + specific and private use. A vendor SHOULD further namespace such + properties with a vendor identifier (e.g. "vnd.example.fooBar"), + and such names MAY be registered in the IANA "Domain Connect + Template Properties" registry (see Section 12.4). Properties + using this prefix MUST NOT be assumed to be interoperable across + implementations, and the property name MUST conform to the dc-vnd- + property syntax (see Section 3). + + Both DNS Providers and Service Providers process template + definitions. An implementation of either role MUST ignore any + template property it does not recognise; the mere presence of an + unrecognised property MUST NOT cause the template to be rejected. + This applies equally to unprefixed properties added by later + revisions of this specification and to "vnd." properties. An + implementation MUST NOT rely on the semantics of a "vnd." property. + + The "crit" property (see Section 6.1) overrides this default for the + properties it lists: if an implementation does not understand and + cannot process one or more of those properties, it MUST reject the + template and MUST NOT apply it. A listed name that does not + correspond to a property present in the template definition, is by + definition understood. + + The "templateSpecVersion" property (see Section 6.1) identifies the + version of the template specification the template conforms to. An + implementation that does not support the indicated template + specification version MUST reject the template and MUST NOT apply it. + A template that omits "templateSpecVersion" is processed as if it + declared version "1". + 6.2. Template Record Each template record is an entry that contains a type and several @@ -1771,7 +1864,7 @@ Table of Contents "Accept" request header of "application/domainconnect-template+json". When the DNS Provider returns the full template object in the response body, it MUST set the "Content-Type" response header to - "application/domainconnect-template+json" (see Section 12.6). A DNS + "application/domainconnect-template+json" (see Section 12.7). A DNS Provider that does not return the full template object responds as described above. @@ -2942,8 +3035,7 @@ Table of Contents Settings Properties" under the "Domain Connect Protocol" registry group. - Registration policy: Specification Required (see [RFC8126]), - following the procedure in Section 12.1. + Registration policy: Specification Required (see [RFC8126]). Each entry in the registry MUST include: @@ -3012,7 +3104,118 @@ Table of Contents Table 10: Initial Domain Connect Settings Properties -12.4. Guidance to the DNS Resource Record (RR) TYPEs Registry +12.4. Domain Connect Template Properties Registry + + IANA is requested to create a new registry named "Domain Connect + Template Properties" under the "Domain Connect Protocol" registry + group (see Section 12.3). + + Registration policy: + + * For property names without any prefix: RFC Required (see + [RFC8126]). + + * For property names beginning with "vnd.": Specification Required + (see [RFC8126]). + + Each entry in the registry MUST include: + + * *Property name*: the JSON key of the property as it appears in the + template definition. The value MUST conform to the dc-template- + property syntax (see Section 3). + + * *Status*: the lifecycle state of the registration. The following + values are defined; IANA MAY define additional values as needed: + + - "Active": the property is currently in use and its definition + is normative. + + - "Deprecated": the property SHOULD NOT be used in new templates; + it MAY appear in existing templates for backwards + compatibility. + + - "Reserved": the property appears in earlier versions of the + Domain Connect specification (see [DC-SPEC]) and is reserved + for back-compatibility. It MUST NOT be redefined in a manner + incompatible with [DC-SPEC]. See Section 3, Paragraph 13. + + * *Kind*: the nature of the defining document. The value MUST be + one of: "IETF Standard" for properties defined in a standards- + track RFC, "Informational" for properties defined in an + Informational RFC, or "Other" for any other specification. + + * *Reference*: the document that defines the property. + + The following properties from this specification constitute the + initial contents of the registry: + + +=======================+============+===============+=============+ + | *Property Name* | *Status* | *Kind* | *Reference* | + +=======================+============+===============+=============+ + | "providerId" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "providerName" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "serviceId" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "serviceName" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "version" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "templateSpecVersion" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "logoUrl" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "description" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "variableDescription" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "syncBlock" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "shared" | Deprecated | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "sharedProviderName" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "sharedServiceName" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "syncPubKeyDomain" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "syncRedirectDomain" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "multiInstance" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "warnPhishing" | Deprecated | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "hostRequired" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "crit" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "records" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + + Table 11: Initial Domain Connect Template Properties + +12.5. Guidance to the DNS Resource Record (RR) TYPEs Registry To avoid collisions between newly assigned DNS RR TYPE mnemonics and the record type names used by Domain Connect, IANA is requested to @@ -3044,7 +3247,7 @@ Table of Contents This records, on the DNS side, the obligation to consult the "Domain Connect Fully Specified Record Types" registry described above. -12.5. Underscore "_domainconnect" DNS Node Name +12.6. Underscore "_domainconnect" DNS Node Name Per [RFC8552], please add the following entry to the "Underscored and Globally Scoped DNS Node Names" registry: @@ -3055,10 +3258,10 @@ Table of Contents | TXT | _domainconnect | This document. | +---------+----------------+----------------+ - Table 11: IANA Registration for + Table 12: IANA Registration for _domainconnect -12.6. Media Type Registration for application/domainconnect- +12.7. Media Type Registration for application/domainconnect- template+json IANA is requested to register the following media type in the "Media @@ -3163,6 +3366,19 @@ Change History This section is to be removed before publishing as an RFC. +Change from draft-ietf-dconn-domainconnect-03 to -04 + + * Added Template Property Extensibility and the "crit" property to + Template Definition. + + * Added the "templateSpecVersion" property to Template Definition. + + * Added the IANA "Domain Connect Template Properties" registry in + Domain Connect Template Properties Registry. + + * Added dc-template-property, dc-unprefixed-property, and dc-vnd- + property to Terminology. + Change from draft-ietf-dconn-domainconnect-02 to -03 * Classified template record types as Fully Specified, Computed, or diff --git a/docs/draft-ietf-dconn-domainconnect-04.html b/docs/draft-ietf-dconn-domainconnect-04.html index b5d7041..18348ee 100644 --- a/docs/draft-ietf-dconn-domainconnect-04.html +++ b/docs/draft-ietf-dconn-domainconnect-04.html @@ -1358,6 +1358,11 @@

The following additional ABNF rules are defined in this document and used normatively throughout.

-
+
; ---- Identifier rules ----
 
@@ -1837,6 +1845,18 @@ 

 dc-host-list   =  domain-name *( *SP "," *SP domain-name )
                 ; comma-separated list of domain names
 
+dc-template-property =  dc-unprefixed-property / dc-vnd-property
+                ; any template-definition property name
+
+dc-unprefixed-property =  ( ALPHA / DIGIT ) *( ALPHA / DIGIT )
+                ; reserved for this specification and for
+                ; standards-track extensions; managed by the
+                ; IANA Domain Connect Template Properties registry
+
+dc-vnd-property =  "vnd." 1*ALPHA *( "." 1*ALPHA )
+                ; "vnd." tree for vendor/private template
+                ; properties
+
 ; ---- Other parameter rules ----
 
 dc-sig         =  1*( ALPHA / DIGIT / "+" / "/" / "=" )
@@ -2303,9 +2323,9 @@ 

 
A template is defined as a standard JSON data structure containing the following data. Field values MUST be defined unless otherwise indicated.
-

The template JSON structure defined in this section is identified by the media type "application/domainconnect-template+json" (see Section 12.6).

+

The template JSON structure defined in this section is identified by the media type "application/domainconnect-template+json" (see Section 12.7).

-
+
+ + + + + + + + + + + +
Table 1: @@ -2360,6 +2380,14 @@

version (OPTIONAL) If present this represents a version of the template and SHOULD be changed with each update of the template content. This opaque value is mainly informational to improve communication and transparency between providers.
The value MUST conform to the dc-version syntax (see Section 3).
This is a strict subset of the "JSON number": a positive integer with no leading zeros, no fractional part, and no exponent part.
+ Template Specification Version +IntegertemplateSpecVersion(OPTIONAL) The version of the Domain Connect template specification that the template conforms to. This identifies the template format and processing rules defined by this document and its successors.
The value MUST conform to the dc-version syntax (see Section 3). For templates conforming to this document, the value is "1".
Logo @@ -2456,6 +2484,14 @@

hostRequired (OPTIONAL) When "true", indicates that the template is designed to work only when both "domain" and "host" apply parameters are provided, for example when the template contains a CNAME record targeted at the fully qualified domain name.
The default is "false".
+ Critical Properties +Array of Stringcrit(OPTIONAL) A list of the names of template properties that an implementation is required to understand and process for the template to be applied correctly.
Each entry MUST conform to the dc-template-property syntax (see Section 3).
When present, the "crit" property MUST NOT be empty.
Template Records @@ -2467,6 +2503,31 @@

+
+
+

+6.1.1. Template Property Extensibility +

+
+

The set of template-definition properties defined above MAY be extended. To keep template definitions forward-compatible and to avoid name collisions between this specification, future standards-track extensions, and vendor-specific additions, the property name space is partitioned as follows:

+
+
    +
  • Property names without any prefix are reserved for this specification and for future standards-track extensions that normatively require this document as their base. Such names are managed through the IANA "Domain Connect Template Properties" registry (see Section 12.4). Implementations MUST NOT introduce private or vendor-specific properties using unprefixed names. +
    • +
  • Property names beginning with "vnd." are reserved for vendor-specific and private use. A vendor SHOULD further namespace such properties with a vendor identifier (e.g. "vnd.example.fooBar"), and such names MAY be registered in the IANA "Domain Connect Template Properties" registry (see Section 12.4). Properties using this prefix MUST NOT be assumed to be interoperable across implementations, and the property name MUST conform to the dc-vnd-property syntax (see Section 3). +
    • +
+
+

Both DNS Providers and Service Providers process template definitions. An implementation of either role MUST ignore any template property it does not recognise; the mere presence of an unrecognised property MUST NOT cause the template to be rejected. This applies equally to unprefixed properties added by later revisions of this specification and to "vnd." properties. An implementation MUST NOT rely on the semantics of a "vnd." property.

+
+
+

The "crit" property (see Section 6.1) overrides this default for the properties it lists: if an implementation does not understand and cannot process one or more of those properties, it MUST reject the template and MUST NOT apply it. A listed name that does not correspond to a property present in the template definition, is by definition understood.

+
+
+

The "templateSpecVersion" property (see Section 6.1) identifies the version of the template specification the template conforms to. An implementation that does not support the indicated template specification version MUST reject the template and MUST NOT apply it. A template that omits "templateSpecVersion" is processed as if it declared version "1".

+
+
+
@@ -3858,7 +3919,7 @@

Returning a status of 200 without a body indicates the template is supported. The DNS Provider MAY disclose the version of the template in a JSON object with field "version" (see: version field (Section 6.1) or the full JSON object of deployed template.

-

The Service Provider MAY use HTTP content negotiation (see [RFC9110]) to request the full template object, for example by sending an "Accept" request header of "application/domainconnect-template+json". When the DNS Provider returns the full template object in the response body, it MUST set the "Content-Type" response header to "application/domainconnect-template+json" (see Section 12.6). A DNS Provider that does not return the full template object responds as described above.

+

The Service Provider MAY use HTTP content negotiation (see [RFC9110]) to request the full template object, for example by sending an "Accept" request header of "application/domainconnect-template+json". When the DNS Provider returns the full template object in the response body, it MUST set the "Content-Type" response header to "application/domainconnect-template+json" (see Section 12.7). A DNS Provider that does not return the full template object responds as described above.

Returning a status of 404 indicates the template is not supported.

@@ -5222,8 +5283,8 @@

IANA is requested to create a new registry named "Domain Connect Settings Properties" under the "Domain Connect Protocol" registry group.

-
-

Registration policy: Specification Required (see [RFC8126]), following the procedure in Section 12.1.

+
+

Registration policy: Specification Required (see [RFC8126]).

Each entry in the registry MUST include:

@@ -5417,47 +5478,285 @@

-
+
+

+12.4. Domain Connect Template Properties Registry +

+
+

IANA is requested to create a new registry named "Domain Connect Template Properties" under the "Domain Connect Protocol" registry group (see Section 12.3).

+
+
+

Registration policy:

+
+
    +
  • For property names without any prefix: RFC Required (see [RFC8126]). +
    • +
  • For property names beginning with "vnd.": Specification Required (see [RFC8126]). +
    • +
+
+

Each entry in the registry MUST include:

+
+
    +
  • + Property name: the JSON key of the property as it appears in the template definition. The value MUST conform to the dc-template-property syntax (see Section 3). +
    • +
  • +
    +

    Status: the lifecycle state of the registration. The following values are defined; IANA MAY define additional values as needed:

    +
    +
      +
    • + "Active": the property is currently in use and its definition is normative. +
      • +
    • + "Deprecated": the property SHOULD NOT be used in new templates; it MAY appear in existing templates for backwards compatibility. +
      • +
    • + "Reserved": the property appears in earlier versions of the Domain Connect specification (see [DC-SPEC]) and is reserved for back-compatibility. It MUST NOT be redefined in a manner incompatible with [DC-SPEC]. See Section 3, Paragraph 13. +
      • +
    +
    • +
  • + Kind: the nature of the defining document. The value MUST be one of: "IETF Standard" for properties defined in a standards-track RFC, "Informational" for properties defined in an Informational RFC, or "Other" for any other specification. +
    • +
  • + Reference: the document that defines the property. +
    • +
+
+

The following properties from this specification constitute the initial contents of the registry:

+
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+Table 11: +Initial Domain Connect Template Properties +
+ Property Name + + Status + + Kind + + Reference +
+ "providerId" +ActiveIETF StandardThis document
+ "providerName" +ActiveIETF StandardThis document
+ "serviceId" +ActiveIETF StandardThis document
+ "serviceName" +ActiveIETF StandardThis document
+ "version" +ActiveIETF StandardThis document
+ "templateSpecVersion" +ActiveIETF StandardThis document
+ "logoUrl" +ActiveIETF StandardThis document
+ "description" +ActiveIETF StandardThis document
+ "variableDescription" +ActiveIETF StandardThis document
+ "syncBlock" +ActiveIETF StandardThis document
+ "shared" +DeprecatedIETF StandardThis document
+ "sharedProviderName" +ActiveIETF StandardThis document
+ "sharedServiceName" +ActiveIETF StandardThis document
+ "syncPubKeyDomain" +ActiveIETF StandardThis document
+ "syncRedirectDomain" +ActiveIETF StandardThis document
+ "multiInstance" +ActiveIETF StandardThis document
+ "warnPhishing" +DeprecatedIETF StandardThis document
+ "hostRequired" +ActiveIETF StandardThis document
+ "crit" +ActiveIETF StandardThis document
+ "records" +ActiveIETF StandardThis document
+
+
+
+
+

-12.4. Guidance to the DNS Resource Record (RR) TYPEs Registry +12.5. Guidance to the DNS Resource Record (RR) TYPEs Registry

-
-

To avoid collisions between newly assigned DNS RR TYPE mnemonics and the record type names used by Domain Connect, IANA is requested to add the following note to the registration procedure of the "Resource Record (RR) TYPEs" registry within the "Domain Name System (DNS) Parameters" registry group (see [RFC6895]):

+
+

To avoid collisions between newly assigned DNS RR TYPE mnemonics and the record type names used by Domain Connect, IANA is requested to add the following note to the registration procedure of the "Resource Record (RR) TYPEs" registry within the "Domain Name System (DNS) Parameters" registry group (see [RFC6895]):

-
-
-

When evaluating a request to assign a new RR TYPE mnemonic, the designated experts SHOULD consult the "Domain Connect Fully Specified Record Types" registry. If the requested mnemonic matches the name of an entry in that registry whose DNS RR TYPE field is "N/A", the designated experts SHOULD flag the potential conflict and consult the designated experts of the "Domain Connect Fully Specified Record Types" registry before completing the assignment.

+
+
+

When evaluating a request to assign a new RR TYPE mnemonic, the designated experts SHOULD consult the "Domain Connect Fully Specified Record Types" registry. If the requested mnemonic matches the name of an entry in that registry whose DNS RR TYPE field is "N/A", the designated experts SHOULD flag the potential conflict and consult the designated experts of the "Domain Connect Fully Specified Record Types" registry before completing the assignment.

-
-

This coupling ensures that a Domain Connect record type name that does not (yet) correspond to a DNS RR TYPE - such as a "Computed" type - is not inadvertently assigned a conflicting meaning in the DNS RR TYPEs registry.

+
+

This coupling ensures that a Domain Connect record type name that does not (yet) correspond to a DNS RR TYPE - such as a "Computed" type - is not inadvertently assigned a conflicting meaning in the DNS RR TYPEs registry.

-
-

In addition, IANA is requested to update the "Reference" of the "Resource Record (RR) TYPEs" registry to cite this document alongside the existing references:

+
+

In addition, IANA is requested to update the "Reference" of the "Resource Record (RR) TYPEs" registry to cite this document alongside the existing references:

-
-
-

OLD: [RFC6895][RFC1035]
NEW: [RFC6895][RFC1035][This document]

+
+
+

OLD: [RFC6895][RFC1035]
NEW: [RFC6895][RFC1035][This document]

-
-

This records, on the DNS side, the obligation to consult the "Domain Connect Fully Specified Record Types" registry described above.

+
+

This records, on the DNS side, the obligation to consult the "Domain Connect Fully Specified Record Types" registry described above.

-
+

-12.5. Underscore "_domainconnect" DNS Node Name +12.6. Underscore "_domainconnect" DNS Node Name

-
-

Per [RFC8552], please add the following entry to the "Underscored and Globally Scoped DNS Node Names" registry:

+
+

Per [RFC8552], please add the following entry to the "Underscored and Globally Scoped DNS Node Names" registry:

-
- +
+
@@ -5479,142 +5778,142 @@

-
+

-12.6. Media Type Registration for application/domainconnect-template+json +12.7. Media Type Registration for application/domainconnect-template+json

-
-

IANA is requested to register the following media type in the "Media Types" registry, per [RFC6838].

+
+

IANA is requested to register the following media type in the "Media Types" registry, per [RFC6838].

-
-
-
Type name:
-
-
-
-

application

+
+
+
Type name:
+
+
+
+

application

-
Subtype name:
-
-
-
-

domainconnect-template+json

+
Subtype name:
+
+
+
+

domainconnect-template+json

-
Required parameters:
-
-
-
-

N/A

+
Required parameters:
+
+
+
+

N/A

-
Optional parameters:
-
-
-
-

N/A

+
Optional parameters:
+
+
+
+

N/A

-
Encoding considerations:
-
-
-
-

binary; the content is a JSON [RFC8259] document encoded in UTF-8.

+
Encoding considerations:
+
+
+
+

binary; the content is a JSON [RFC8259] document encoded in UTF-8.

-
Security considerations:
-
-
-
-

See Section 11 of this document.

+
Security considerations:
+
+
+
+

See Section 11 of this document.

-
Interoperability considerations:
-
-
-
-

See this document.

+
Interoperability considerations:
+
+
+
+

See this document.

-
Published specification:
-
-
-
-

This document (see Section 6.1).

+
Published specification:
+
+
+
+

This document (see Section 6.1).

-
Applications that use this media type:
-
-
-
-

Domain Connect Service Providers and DNS Providers.

+
Applications that use this media type:
+
+
+
+

Domain Connect Service Providers and DNS Providers.

-
Fragment identifier considerations:
-
-
-
-

The "+json" structured syntax suffix is defined in [RFC6839]; see also [RFC8259].

+
Fragment identifier considerations:
+
+
+
+

The "+json" structured syntax suffix is defined in [RFC6839]; see also [RFC8259].

-
Additional information:
-
-
-
-
-
Deprecated alias names for this type:
-
-
-
-

N/A

+
Additional information:
+
+
+
+
+
Deprecated alias names for this type:
+
+
+
+

N/A

-
Magic number(s):
-
-
-
-

N/A

+
Magic number(s):
+
+
+
+

N/A

-
File extension(s):
-
-
-
-

N/A

+
File extension(s):
+
+
+
+

N/A

-
Macintosh file type code(s):
-
-
-
-

N/A

+
Macintosh file type code(s):
+
+
+
+

N/A

@@ -5624,47 +5923,47 @@

-
Person email address to contact for further information:
-
-
-
-

IETF DCONN Working Group <mailto:dconn@ietf.org>

+
Person email address to contact for further information:
+
+
+
+

IETF DCONN Working Group <mailto:dconn@ietf.org>

-
Intended usage:
-
-
-
-

COMMON

+
Intended usage:
+
+
+
+

COMMON

-
Restrictions on usage:
-
-
-
-

N/A

+
Restrictions on usage:
+
+
+
+

N/A

-
Author:
-
-
-
-

IETF DCONN Working Group

+
Author:
+
+
+
+

IETF DCONN Working Group

-
Change controller:
-
-
-
-

IETF

+
Change controller:
+
+
+
+

IETF

@@ -5775,193 +6074,210 @@

-
+

Change History

This section is to be removed before publishing as an RFC.

-
+

-Change from draft-ietf-dconn-domainconnect-02 to -03 +Change from draft-ietf-dconn-domainconnect-03 to -04

+
+
+
+
+

+Change from draft-ietf-dconn-domainconnect-02 to -03 +

+
-
-
-

-Change from draft-ietf-dconn-domainconnect-01 to -02 +
+
+

+Change from draft-ietf-dconn-domainconnect-01 to -02

    -
  • Removed the Asynchronous OAuth Flow from this document; the synchronous flow is now the sole protocol flow defined here. The asynchronous flow is reserved for a companion extension specification. +
  • Removed the Asynchronous OAuth Flow from this document; the synchronous flow is now the sole protocol flow defined here. The asynchronous flow is reserved for a companion extension specification.
-
-
-

-Change from draft-ietf-dconn-domainconnect-00 to -01 +
+
+

+Change from draft-ietf-dconn-domainconnect-00 to -01

-
-
+
+

Change from draft-kowalik-domainconnect-02 to draft-ietf-dconn-domainconnect-00

    -
  • DCONN WG adoption. No other changes. +
  • DCONN WG adoption. No other changes.
-
-
+
+

Change from -01 to -02

    -
  • Draft refresh from expire. No content changes. +
  • Draft refresh from expire. No content changes.
-
-
+
+

Change from -00 to -01

    -
  • Changed term Root Domain to Zone Apex to align with [RFC8499]. +
  • Changed term Root Domain to Zone Apex to align with [RFC8499].
    • -
  • Removed example provider names from Service Providers and DNS Providers terminology +
  • Removed example provider names from Service Providers and DNS Providers terminology
    • -
  • Added Use Cases +
  • Added Use Cases
    • -
  • Added Trust Model +
  • Added Trust Model
    • -
  • Added sequence diagrams for synchronous and asynchronous flows instead of UX mocks +
  • Added sequence diagrams for synchronous and asynchronous flows instead of UX mocks
    • -
  • Reviewed use of normative language +
  • Reviewed use of normative language
    • -
  • Cleaned up usage of terminology +
  • Cleaned up usage of terminology
    • -
  • Variable substitution description updated +
  • Variable substitution description updated
    • -
  • All URLs are now normatively defined with URI templates +
  • All URLs are now normatively defined with URI templates
-
-
+
+

Change from draft-kowalik-regext-domainconnect-00 to draft-kowalik-domainconnect-00

    -
  • Added possibility to specify any DNS record type in a generic manner. +
  • Added possibility to specify any DNS record type in a generic manner.
    • -
  • Added possibility to define variables for numeric fields. +
  • Added possibility to define variables for numeric fields.
    • -
  • Added IANA registration for _domainconnect record as per [RFC8552] +
  • Added IANA registration for _domainconnect record as per [RFC8552]
-
-
+
+

Change from draft-carney-regext-domainconnect-03 to draft-kowalik-regext-domainconnect-00

    -
  • Version synchronized with 2.2 version rev. 66 of the public Domain Connect specification. +
  • Version synchronized with 2.2 version rev. 66 of the public Domain Connect specification.
-
-
+
+

Change from -02 to -03

    -
  • Added width/height JSON values returned by DNS Provider Discovery. +
  • Added width/height JSON values returned by DNS Provider Discovery.
    • -
  • Corrected text of GET method for getting the authorization token. +
  • Corrected text of GET method for getting the authorization token.
    • -
  • Added clarifying text to Group ID description parameter of the apply template POST method. Quite a few minor edits and clarifications that were found during implementation, especially in the Implementation Considerations section. +
  • Added clarifying text to Group ID description parameter of the apply template POST method. Quite a few minor edits and clarifications that were found during implementation, especially in the Implementation Considerations section.
-
-
+
+

Change from -01 to -02

    -
  • Added new GET method for Service Providers to determine if the DNS Provider supports a specific template. Some other minor edits for clarification. +
  • Added new GET method for Service Providers to determine if the DNS Provider supports a specific template. Some other minor edits for clarification.
-
-
+
+

Change from draft-carney-regext-domainconnect-00 to -01

    -
  • Minor edits and clarifications found during implementation. +
  • Minor edits and clarifications found during implementation.
diff --git a/docs/draft-ietf-dconn-domainconnect-04.pdf b/docs/draft-ietf-dconn-domainconnect-04.pdf index 6e85776..47792b2 100644 Binary files a/docs/draft-ietf-dconn-domainconnect-04.pdf and b/docs/draft-ietf-dconn-domainconnect-04.pdf differ diff --git a/docs/draft-ietf-dconn-domainconnect-04.txt b/docs/draft-ietf-dconn-domainconnect-04.txt index 98e49a6..b91d536 100644 --- a/docs/draft-ietf-dconn-domainconnect-04.txt +++ b/docs/draft-ietf-dconn-domainconnect-04.txt @@ -71,41 +71,41 @@ Table of Contents 2.2. Use Cases out of scope . . . . . . . . . . . . . . . . . 5 4. Protocol design . . . . . . . . . . . . . . . . . . . . . . . 11 4.1. Templates . . . . . . . . . . . . . . . . . . . . . . . . 11 - 4.2. Trust Model . . . . . . . . . . . . . . . . . . . . . . . 11 + 4.2. Trust Model . . . . . . . . . . . . . . . . . . . . . . . 12 5. Protocol Flows Overview . . . . . . . . . . . . . . . . . . . 12 5.1. General information . . . . . . . . . . . . . . . . . . . 12 - 5.2. The Synchronous Flow . . . . . . . . . . . . . . . . . . 12 + 5.2. The Synchronous Flow . . . . . . . . . . . . . . . . . . 13 6. Domain Connect Objects and Templates . . . . . . . . . . . . 16 - 6.1. Template Definition . . . . . . . . . . . . . . . . . . . 16 - 6.2. Template Record . . . . . . . . . . . . . . . . . . . . . 21 - 6.3. Template Considerations . . . . . . . . . . . . . . . . . 28 - 6.3.1. Template Scope . . . . . . . . . . . . . . . . . . . 28 - 6.3.2. Sub Domains . . . . . . . . . . . . . . . . . . . . . 28 - 6.3.3. Variable Scope Minimisation . . . . . . . . . . . . . 29 - 6.4. Public Key Publication . . . . . . . . . . . . . . . . . 29 - 7. DNS Provider Discovery . . . . . . . . . . . . . . . . . . . 32 - 7.1. "_domainconnect" Resource Record . . . . . . . . . . . . 32 - 7.1.1. Deployment considerations . . . . . . . . . . . . . . 33 - 7.2. Settings End-Point . . . . . . . . . . . . . . . . . . . 33 - 8. Applying Domain Connect . . . . . . . . . . . . . . . . . . . 37 - 8.1. Endpoints . . . . . . . . . . . . . . . . . . . . . . . . 37 - 8.2. Query Supported Template . . . . . . . . . . . . . . . . 38 - 8.3. Synchronous Flow . . . . . . . . . . . . . . . . . . . . 40 - 8.3.1. Apply Template URL . . . . . . . . . . . . . . . . . 40 - 8.3.2. Parameters/properties . . . . . . . . . . . . . . . . 40 - 8.3.3. Template Apply Request . . . . . . . . . . . . . . . 44 - 8.3.4. Signature Verification . . . . . . . . . . . . . . . 45 - 8.3.5. Template Apply Response . . . . . . . . . . . . . . . 45 - 8.3.6. Template Apply Error Response . . . . . . . . . . . . 46 - 8.4. Verification of Changes . . . . . . . . . . . . . . . . . 47 - 9. Resolving Template Variables . . . . . . . . . . . . . . . . 47 - 9.1. Variables . . . . . . . . . . . . . . . . . . . . . . . . 47 - 9.1.1. Variable Syntax . . . . . . . . . . . . . . . . . . . 48 - 9.1.2. Special and Built-In Variables . . . . . . . . . . . 48 - 9.2. Variable substitution . . . . . . . . . . . . . . . . . . 48 - 9.2.1. Input Values . . . . . . . . . . . . . . . . . . . . 48 - 9.2.2. Processing . . . . . . . . . . . . . . . . . . . . . 49 - 9.3. Host Name Rendering . . . . . . . . . . . . . . . . . . . 49 + 6.1. Template Definition . . . . . . . . . . . . . . . . . . . 17 + 6.1.1. Template Property Extensibility . . . . . . . . . . . 22 + 6.2. Template Record . . . . . . . . . . . . . . . . . . . . . 23 + 6.3. Template Considerations . . . . . . . . . . . . . . . . . 30 + 6.3.1. Template Scope . . . . . . . . . . . . . . . . . . . 30 + 6.3.2. Sub Domains . . . . . . . . . . . . . . . . . . . . . 30 + 6.3.3. Variable Scope Minimisation . . . . . . . . . . . . . 31 + 6.4. Public Key Publication . . . . . . . . . . . . . . . . . 31 + 7. DNS Provider Discovery . . . . . . . . . . . . . . . . . . . 34 + 7.1. "_domainconnect" Resource Record . . . . . . . . . . . . 34 + 7.1.1. Deployment considerations . . . . . . . . . . . . . . 35 + 7.2. Settings End-Point . . . . . . . . . . . . . . . . . . . 35 + 8. Applying Domain Connect . . . . . . . . . . . . . . . . . . . 39 + 8.1. Endpoints . . . . . . . . . . . . . . . . . . . . . . . . 39 + 8.2. Query Supported Template . . . . . . . . . . . . . . . . 40 + 8.3. Synchronous Flow . . . . . . . . . . . . . . . . . . . . 42 + 8.3.1. Apply Template URL . . . . . . . . . . . . . . . . . 42 + 8.3.2. Parameters/properties . . . . . . . . . . . . . . . . 42 + 8.3.3. Template Apply Request . . . . . . . . . . . . . . . 46 + 8.3.4. Signature Verification . . . . . . . . . . . . . . . 47 + 8.3.5. Template Apply Response . . . . . . . . . . . . . . . 47 + 8.3.6. Template Apply Error Response . . . . . . . . . . . . 48 + 8.4. Verification of Changes . . . . . . . . . . . . . . . . . 49 + 9. Resolving Template Variables . . . . . . . . . . . . . . . . 49 + 9.1. Variables . . . . . . . . . . . . . . . . . . . . . . . . 49 + 9.1.1. Variable Syntax . . . . . . . . . . . . . . . . . . . 50 + 9.1.2. Special and Built-In Variables . . . . . . . . . . . 50 + 9.2. Variable substitution . . . . . . . . . . . . . . . . . . 50 + 9.2.1. Input Values . . . . . . . . . . . . . . . . . . . . 50 + 9.2.2. Processing . . . . . . . . . . . . . . . . . . . . . 51 @@ -114,50 +114,50 @@ Kowalik, et al. Expires 4 January 2027 [Page 2] Internet-Draft Domain Connect July 2026 - 9.3.1. Input Values . . . . . . . . . . . . . . . . . . . . 49 - 9.3.2. Processing . . . . . . . . . . . . . . . . . . . . . 50 - 9.3.3. Examples of host processing . . . . . . . . . . . . . 50 - 9.4. SPF Record Merging . . . . . . . . . . . . . . . . . . . 51 - 10. Template Application . . . . . . . . . . . . . . . . . . . . 52 - 10.1. Template State in DNS Providers system . . . . . . . . . 52 - 10.2. Steps to Apply a Template . . . . . . . . . . . . . . . 53 - 10.3. Group Filtering . . . . . . . . . . . . . . . . . . . . 54 - 10.3.1. Group Filtering and Template State . . . . . . . . . 55 - 10.4. Conflict Detection . . . . . . . . . . . . . . . . . . . 55 - 10.4.1. Conflict Detection Special Handling . . . . . . . . 56 - 10.5. Calculating Conflict Resolution . . . . . . . . . . . . 57 - 10.6. User Authorization of Changes . . . . . . . . . . . . . 58 - 10.7. Template Application . . . . . . . . . . . . . . . . . . 59 - 10.8. Examples . . . . . . . . . . . . . . . . . . . . . . . . 59 - 11. Security Considerations . . . . . . . . . . . . . . . . . . . 59 - 11.1. Template Variable Phishing . . . . . . . . . . . . . . . 59 - 11.2. Untrusted DNS Provider Discovery Records . . . . . . . . 60 - 11.3. Underscored Host Names . . . . . . . . . . . . . . . . . 61 - 12. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 61 - 12.1. Registration Procedure for Domain Connect Registries . . 61 - 12.2. Domain Connect Fully Specified Record Types Registry . . 62 - 12.3. Domain Connect Settings Properties Registry . . . . . . 65 - 12.4. Guidance to the DNS Resource Record (RR) TYPEs - Registry . . . . . . . . . . . . . . . . . . . . . . . . 66 - 12.5. Underscore "_domainconnect" DNS Node Name . . . . . . . 67 - 12.6. Media Type Registration for application/ - domainconnect-template+json . . . . . . . . . . . . . . 67 - Implementation Status . . . . . . . . . . . . . . . . . . . . . . 68 - Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 69 - Change History . . . . . . . . . . . . . . . . . . . . . . . . . 69 - Normative References . . . . . . . . . . . . . . . . . . . . . . 73 - Informative References . . . . . . . . . . . . . . . . . . . . . 75 - Appendix A. Examples . . . . . . . . . . . . . . . . . . . . . . 75 - A.1. Example Template . . . . . . . . . . . . . . . . . . . . 75 - A.2. Example Records: Single static host record . . . . . . . 76 - A.3. Example Records: Single variable host record for A . . . 77 - A.4. Example Records: Generic Record Type CAA . . . . . . . . 77 + 9.3. Host Name Rendering . . . . . . . . . . . . . . . . . . . 51 + 9.3.1. Input Values . . . . . . . . . . . . . . . . . . . . 51 + 9.3.2. Processing . . . . . . . . . . . . . . . . . . . . . 52 + 9.3.3. Examples of host processing . . . . . . . . . . . . . 52 + 9.4. SPF Record Merging . . . . . . . . . . . . . . . . . . . 53 + 10. Template Application . . . . . . . . . . . . . . . . . . . . 54 + 10.1. Template State in DNS Providers system . . . . . . . . . 54 + 10.2. Steps to Apply a Template . . . . . . . . . . . . . . . 55 + 10.3. Group Filtering . . . . . . . . . . . . . . . . . . . . 56 + 10.3.1. Group Filtering and Template State . . . . . . . . . 57 + 10.4. Conflict Detection . . . . . . . . . . . . . . . . . . . 57 + 10.4.1. Conflict Detection Special Handling . . . . . . . . 58 + 10.5. Calculating Conflict Resolution . . . . . . . . . . . . 59 + 10.6. User Authorization of Changes . . . . . . . . . . . . . 60 + 10.7. Template Application . . . . . . . . . . . . . . . . . . 61 + 10.8. Examples . . . . . . . . . . . . . . . . . . . . . . . . 61 + 11. Security Considerations . . . . . . . . . . . . . . . . . . . 61 + 11.1. Template Variable Phishing . . . . . . . . . . . . . . . 61 + 11.2. Untrusted DNS Provider Discovery Records . . . . . . . . 62 + 11.3. Underscored Host Names . . . . . . . . . . . . . . . . . 63 + 12. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 63 + 12.1. Registration Procedure for Domain Connect Registries . . 63 + 12.2. Domain Connect Fully Specified Record Types Registry . . 64 + 12.3. Domain Connect Settings Properties Registry . . . . . . 67 + 12.4. Domain Connect Template Properties Registry . . . . . . 68 + 12.5. Guidance to the DNS Resource Record (RR) TYPEs + Registry . . . . . . . . . . . . . . . . . . . . . . . . 70 + 12.6. Underscore "_domainconnect" DNS Node Name . . . . . . . 71 + 12.7. Media Type Registration for application/ + domainconnect-template+json . . . . . . . . . . . . . . 71 + Implementation Status . . . . . . . . . . . . . . . . . . . . . . 72 + Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 73 + Change History . . . . . . . . . . . . . . . . . . . . . . . . . 73 + Normative References . . . . . . . . . . . . . . . . . . . . . . 77 + Informative References . . . . . . . . . . . . . . . . . . . . . 79 + Appendix A. Examples . . . . . . . . . . . . . . . . . . . . . . 80 + A.1. Example Template . . . . . . . . . . . . . . . . . . . . 80 + A.2. Example Records: Single static host record . . . . . . . 81 + A.3. Example Records: Single variable host record for A . . . 82 + A.4. Example Records: Generic Record Type CAA . . . . . . . . 82 A.5. Example: Template application to DNS Zone and Conflict - Resolution . . . . . . . . . . . . . . . . . . . . . . . 78 - A.6. Example: SPF Record Merging . . . . . . . . . . . . . . . 80 - Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 81 - - + Resolution . . . . . . . . . . . . . . . . . . . . . . . 83 + A.6. Example: SPF Record Merging . . . . . . . . . . . . . . . 85 + Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 86 @@ -352,6 +352,18 @@ Internet-Draft Domain Connect July 2026 dc-host-list = domain-name *( *SP "," *SP domain-name ) ; comma-separated list of domain names + dc-template-property = dc-unprefixed-property / dc-vnd-property + ; any template-definition property name + + dc-unprefixed-property = ( ALPHA / DIGIT ) *( ALPHA / DIGIT ) + ; reserved for this specification and for + ; standards-track extensions; managed by the + ; IANA Domain Connect Template Properties registry + + dc-vnd-property = "vnd." 1*ALPHA *( "." 1*ALPHA ) + ; "vnd." tree for vendor/private template + ; properties + ; ---- Other parameter rules ---- dc-sig = 1*( ALPHA / DIGIT / "+" / "/" / "=" ) @@ -375,6 +387,13 @@ Internet-Draft Domain Connect July 2026 ; Assignable code points per RFC 9839 Section 4.3; ; used for providerName and serviceName + + +Kowalik, et al. Expires 4 January 2027 [Page 7] + +Internet-Draft Domain Connect July 2026 + + dc-description-text = 0*2048unicode-assignable ; a string of at most 2048 Unicode ; Assignable code points per RFC 9839 Section 4.3; @@ -386,14 +405,6 @@ Internet-Draft Domain Connect July 2026 ; a strict subset of JSON number (RFC 8259 ; Section 6); used for template version - - - -Kowalik, et al. Expires 4 January 2027 [Page 7] - -Internet-Draft Domain Connect July 2026 - - ; ---- Variable expression rules ---- variable-expression = named-variable / template-apex-var @@ -432,6 +443,13 @@ Internet-Draft Domain Connect July 2026 UALPHA = %x41-5A ; A-Z (uppercase letter) + + +Kowalik, et al. Expires 4 January 2027 [Page 8] + +Internet-Draft Domain Connect July 2026 + + dc-essential = "Always" / "OnApply" ; default is "Always" @@ -442,14 +460,6 @@ Internet-Draft Domain Connect July 2026 ; non-empty printable ASCII (U+0021..U+007E); ; no variable expressions permitted - - - -Kowalik, et al. Expires 4 January 2027 [Page 8] - -Internet-Draft Domain Connect July 2026 - - ; -- property value field -- dc-prop-value = *( dc-prop-char / dc-rdata-escape ) @@ -488,6 +498,14 @@ Internet-Draft Domain Connect July 2026 ; non-negative integer seconds, resolved dc-uint16-tmpl = ( %x30-39 *4DIGIT ) / named-variable + + + +Kowalik, et al. Expires 4 January 2027 [Page 9] + +Internet-Draft Domain Connect July 2026 + + ; 0-65535 literal, or a sole %-variable dc-uint16-value = %x30-39 *4DIGIT @@ -499,13 +517,6 @@ Internet-Draft Domain Connect July 2026 dc-srv-protocol = "_tcp" / "_udp" / "_sctp" / "_dccp" ; underscore-prefixed transport per RFC 2782 - - -Kowalik, et al. Expires 4 January 2027 [Page 9] - -Internet-Draft Domain Connect July 2026 - - dc-srv-service = dc-underscore-label ; underscore-prefixed service name per RFC 6335 @@ -539,6 +550,18 @@ Internet-Draft Domain Connect July 2026 Provider and DNS Provider. Fully Specified Record Type: A DNS resource record type for which + + + + + + + +Kowalik, et al. Expires 4 January 2027 [Page 10] + +Internet-Draft Domain Connect July 2026 + + this document, or a specification registered in the IANA "Domain Connect Fully Specified Record Types" registry (see Section 12.2), defines a breakdown of the record's RDATA into individual, @@ -553,15 +576,6 @@ Internet-Draft Domain Connect July 2026 Record Type's own name. Generic Record Type: Any DNS resource record type, identified by its - - - - -Kowalik, et al. Expires 4 January 2027 [Page 10] - -Internet-Draft Domain Connect July 2026 - - IANA RR TYPE mnemonic or by the "TYPE" form of [RFC3597], whose RDATA is carried opaquely in the "data" field in DNS presentation format. @@ -597,6 +611,13 @@ Internet-Draft Domain Connect July 2026 in DNS change based on the implementation and/or user of the service (e.g. the IP address of a service, a user id, etc.). + + +Kowalik, et al. Expires 4 January 2027 [Page 11] + +Internet-Draft Domain Connect July 2026 + + The template is defined by the Service Provider and manually onboarded with the DNS Provider. This is an out-of-band process between the Service Provider and the DNS Provider and not covered by @@ -609,15 +630,6 @@ Internet-Draft Domain Connect July 2026 checks before enacting any DNS zone changes, and present proposed changes to the user in a human-readable form. - - - - -Kowalik, et al. Expires 4 January 2027 [Page 11] - -Internet-Draft Domain Connect July 2026 - - Service Providers are not assumed to be trusted by default. A malicious actor may attempt to exploit user trust by impersonating a legitimate Service Provider. Trust between DNS Providers and Service @@ -650,6 +662,18 @@ Internet-Draft Domain Connect July 2026 flow. The DNS Provider presents a consent UX to the user and applies the template within the same interaction session. + + + + + + + +Kowalik, et al. Expires 4 January 2027 [Page 12] + +Internet-Draft Domain Connect July 2026 + + [DC-SPEC] also defines an asynchronous flow based on OAuth. Other flows may be defined in the future. Therefore, although it is RECOMMENDED to cover the synchronous flow, implementers MAY decide @@ -665,15 +689,6 @@ Internet-Draft Domain Connect July 2026 and explicitly consent to the changes within a single interaction session. - - - - -Kowalik, et al. Expires 4 January 2027 [Page 12] - -Internet-Draft Domain Connect July 2026 - - The term "synchronous" refers to this user-interaction model - not to immediate DNS propagation. The DNS Provider commits to applying the template upon user consent, but the changes MAY be queued internally @@ -707,6 +722,14 @@ Internet-Draft Domain Connect July 2026 | |----------------->| | | | | | | 7 Responds template| | + + + +Kowalik, et al. Expires 4 January 2027 [Page 13] + +Internet-Draft Domain Connect July 2026 + + | support status | | | |<-----------------| | | | | | @@ -722,14 +745,6 @@ Internet-Draft Domain Connect July 2026 !_____/ | | ! ! 10 Lookup URL | ! ! signature keys (DNS) ! - - - -Kowalik, et al. Expires 4 January 2027 [Page 13] - -Internet-Draft Domain Connect July 2026 - - ! |<-----------------| ! ! | | ! ! | |----. ! @@ -763,6 +778,14 @@ Internet-Draft Domain Connect July 2026 | | | | | 18 Redirect/ Close window | | |<- - - - - - - - -| | + + + +Kowalik, et al. Expires 4 January 2027 [Page 14] + +Internet-Draft Domain Connect July 2026 + + | | | | | | 19 Query DNS records | | |---------------------------------------->| @@ -777,15 +800,6 @@ Internet-Draft Domain Connect July 2026 Steps: - - - - -Kowalik, et al. Expires 4 January 2027 [Page 14] - -Internet-Draft Domain Connect July 2026 - - 1. *User Provides Domain Name*: The user initiates the process by providing their domain name to the Service Provider. @@ -818,6 +832,16 @@ Internet-Draft Domain Connect July 2026 9. *User Navigates to DNS Provider*: The user navigates the link and user agent is directed to the DNS Provider's website. + + + + + +Kowalik, et al. Expires 4 January 2027 [Page 15] + +Internet-Draft Domain Connect July 2026 + + 10. *DNS Provider Performs URL Lookup and Signature Key Verification (if required)*: If the template requires signing, the DNS Provider looks up the URL signature keys in DNS. @@ -835,13 +859,6 @@ Internet-Draft Domain Connect July 2026 Provider verifies that the user is authorized to make change to the domain's DNS zone. - - -Kowalik, et al. Expires 4 January 2027 [Page 15] - -Internet-Draft Domain Connect July 2026 - - 15. *DNS Provider Requests Consent for DNS Changes*: The DNS Provider asks the user for consent to apply the changes to the DNS zone. @@ -869,6 +886,18 @@ Internet-Draft Domain Connect July 2026 6. Domain Connect Objects and Templates + + + + + + + +Kowalik, et al. Expires 4 January 2027 [Page 16] + +Internet-Draft Domain Connect July 2026 + + 6.1. Template Definition A template is defined as a standard JSON data structure containing @@ -877,7 +906,7 @@ Internet-Draft Domain Connect July 2026 The template JSON structure defined in this section is identified by the media type "application/domainconnect-template+json" (see - Section 12.6). + Section 12.7). +=============+========+===================+========================+ |Data Element |Type |Key |Description | @@ -890,14 +919,6 @@ Internet-Draft Domain Connect July 2026 | | | |to identify the Service | | | | |Provider. | | | | |The value MUST conform | - - - -Kowalik, et al. Expires 4 January 2027 [Page 16] - -Internet-Draft Domain Connect July 2026 - - | | | |to the dc-id syntax (see| | | | |Section 3). | | | | |To ensure non- | @@ -925,6 +946,14 @@ Internet-Draft Domain Connect July 2026 | | | |Section 3). | +-------------+--------+-------------------+------------------------+ |*Service |String |serviceName |(REQUIRED) The name of | + + + +Kowalik, et al. Expires 4 January 2027 [Page 17] + +Internet-Draft Domain Connect July 2026 + + |Name* | | |the service, suitable | | | | |for display to the user.| | | | |The value MUST conform | @@ -946,24 +975,41 @@ Internet-Draft Domain Connect July 2026 | | | |to the dc-version syntax| | | | |(see Section 3). | | | | |This is a strict subset | - - - -Kowalik, et al. Expires 4 January 2027 [Page 17] - -Internet-Draft Domain Connect July 2026 - - | | | |of the "JSON number": a | | | | |positive integer with no| | | | |leading zeros, no | | | | |fractional part, and no | | | | |exponent part. | +-------------+--------+-------------------+------------------------+ + |*Template |Integer |templateSpecVersion|(OPTIONAL) The version | + |Specification| | |of the Domain Connect | + |Version* | | |template specification | + | | | |that the template | + | | | |conforms to. This | + | | | |identifies the template | + | | | |format and processing | + | | | |rules defined by this | + | | | |document and its | + | | | |successors. | + | | | |The value MUST conform | + | | | |to the dc-version syntax| + | | | |(see Section 3). For | + | | | |templates conforming to | + | | | |this document, the value| + | | | |is "1". | + +-------------+--------+-------------------+------------------------+ |*Logo* |String |logoUrl |(OPTIONAL) A graphical | | | | |logo representing the | | | | |Service Provider and/or | | | | |Service for use in any | + + + +Kowalik, et al. Expires 4 January 2027 [Page 18] + +Internet-Draft Domain Connect July 2026 + + | | | |web-based flow. If | | | | |present this MAY be | | | | |displayed to the user on| @@ -1002,14 +1048,6 @@ Internet-Draft Domain Connect July 2026 |Block* | | |indicates that this | | | | |template does not | | | | |support the synchronous | - - - -Kowalik, et al. Expires 4 January 2027 [Page 18] - -Internet-Draft Domain Connect July 2026 - - | | | |flow. The DNS Provider | | | | |MUST refuse a | | | | |synchronous apply | @@ -1020,6 +1058,14 @@ Internet-Draft Domain Connect July 2026 | | | |The default is "false". | +-------------+--------+-------------------+------------------------+ |*Shared* |Boolean |shared |(OPTIONAL) This flag has| + + + +Kowalik, et al. Expires 4 January 2027 [Page 19] + +Internet-Draft Domain Connect July 2026 + + | | | |been deprecated. It | | | | |used to indicate that | | | | |the template allowed a | @@ -1058,14 +1104,6 @@ Internet-Draft Domain Connect July 2026 | | | |record is published. | | | | |When present, this field| | | | |signals that digital | - - - -Kowalik, et al. Expires 4 January 2027 [Page 19] - -Internet-Draft Domain Connect July 2026 - - | | | |signing is required for | | | | |synchronous apply | | | | |requests. | @@ -1076,6 +1114,14 @@ Internet-Draft Domain Connect July 2026 |*Synchronous |String |syncRedirectDomain |(OPTIONAL) A comma- | |Redirect | | |separated list of domain| |Domains* | | |names to which the DNS | + + + +Kowalik, et al. Expires 4 January 2027 [Page 20] + +Internet-Draft Domain Connect July 2026 + + | | | |Provider is permitted to| | | | |send the post-apply | | | | |redirect in the | @@ -1114,14 +1160,6 @@ Internet-Draft Domain Connect July 2026 |*Host |Boolean |hostRequired |(OPTIONAL) When "true", | |Required* | | |indicates that the | | | | |template is designed to | - - - -Kowalik, et al. Expires 4 January 2027 [Page 20] - -Internet-Draft Domain Connect July 2026 - - | | | |work only when both | | | | |"domain" and "host" | | | | |apply parameters are | @@ -1132,6 +1170,30 @@ Internet-Draft Domain Connect July 2026 | | | |qualified domain name. | | | | |The default is "false". | +-------------+--------+-------------------+------------------------+ + + + +Kowalik, et al. Expires 4 January 2027 [Page 21] + +Internet-Draft Domain Connect July 2026 + + + |*Critical |Array of|crit |(OPTIONAL) A list of the| + |Properties* |String | |names of template | + | | | |properties that an | + | | | |implementation is | + | | | |required to understand | + | | | |and process for the | + | | | |template to be applied | + | | | |correctly. | + | | | |Each entry MUST conform | + | | | |to the dc-template- | + | | | |property syntax (see | + | | | |Section 3). | + | | | |When present, the "crit"| + | | | |property MUST NOT be | + | | | |empty. | + +-------------+--------+-------------------+------------------------+ |*Template |Array of|records |(REQUIRED) A list of | |Records* |Template| |records for the | | |Records | |template. | @@ -1139,6 +1201,61 @@ Internet-Draft Domain Connect July 2026 Table 1: properties of the template definition +6.1.1. Template Property Extensibility + + The set of template-definition properties defined above MAY be + extended. To keep template definitions forward-compatible and to + avoid name collisions between this specification, future standards- + track extensions, and vendor-specific additions, the property name + space is partitioned as follows: + + * Property names without any prefix are reserved for this + specification and for future standards-track extensions that + normatively require this document as their base. Such names are + managed through the IANA "Domain Connect Template Properties" + registry (see Section 12.4). Implementations MUST NOT introduce + private or vendor-specific properties using unprefixed names. + + * Property names beginning with "vnd." are reserved for vendor- + specific and private use. A vendor SHOULD further namespace such + properties with a vendor identifier (e.g. "vnd.example.fooBar"), + and such names MAY be registered in the IANA "Domain Connect + Template Properties" registry (see Section 12.4). Properties + using this prefix MUST NOT be assumed to be interoperable across + implementations, and the property name MUST conform to the dc-vnd- + property syntax (see Section 3). + + + + + +Kowalik, et al. Expires 4 January 2027 [Page 22] + +Internet-Draft Domain Connect July 2026 + + + Both DNS Providers and Service Providers process template + definitions. An implementation of either role MUST ignore any + template property it does not recognise; the mere presence of an + unrecognised property MUST NOT cause the template to be rejected. + This applies equally to unprefixed properties added by later + revisions of this specification and to "vnd." properties. An + implementation MUST NOT rely on the semantics of a "vnd." property. + + The "crit" property (see Section 6.1) overrides this default for the + properties it lists: if an implementation does not understand and + cannot process one or more of those properties, it MUST reject the + template and MUST NOT apply it. A listed name that does not + correspond to a property present in the template definition, is by + definition understood. + + The "templateSpecVersion" property (see Section 6.1) identifies the + version of the template specification the template conforms to. An + implementation that does not support the indicated template + specification version MUST reject the template and MUST NOT apply it. + A template that omits "templateSpecVersion" is processed as if it + declared version "1". + 6.2. Template Record Each template record is an entry that contains a type and several @@ -1164,20 +1281,20 @@ Internet-Draft Domain Connect July 2026 Record types fall into three classes (see Section 3): - Fully Specified Record Types - A, AAAA, CNAME, MX, TXT, SRV, NS - - whose RDATA is broken into dedicated template fields. The - complete set is managed by the IANA "Domain Connect Fully - Specified Record Types" registry (see Section 12.2). - -Kowalik, et al. Expires 4 January 2027 [Page 21] +Kowalik, et al. Expires 4 January 2027 [Page 23] Internet-Draft Domain Connect July 2026 + Fully Specified Record Types - A, AAAA, CNAME, MX, TXT, SRV, NS - + whose RDATA is broken into dedicated template fields. The + complete set is managed by the IANA "Domain Connect Fully + Specified Record Types" registry (see Section 12.2). + Computed Record Types - which instruct the DNS Provider to derive DNS records by a defined computation rather than write a verbatim record. "SPFM" is the Computed Record Type defined in this @@ -1220,20 +1337,21 @@ Internet-Draft Domain Connect July 2026 If the DNS Provider is not implementing applied template state in DNS this is ignored. - Always (default) - record MUST be applied and kept with the - template - - OnApply - record MUST be applied but can be later removed without - dropping the whole template -Kowalik, et al. Expires 4 January 2027 [Page 22] +Kowalik, et al. Expires 4 January 2027 [Page 24] Internet-Draft Domain Connect July 2026 + Always (default) - record MUST be applied and kept with the + template + + OnApply - record MUST be applied but can be later removed without + dropping the whole template + The value MUST conform to the dc-essential syntax (see Section 3). If omitted, the value MUST be assumed to be "Always". @@ -1277,19 +1395,17 @@ Internet-Draft Domain Connect July 2026 "Points To": JSON key: "pointsTo" - Type: "String" - - The pointsTo location for A, AAAA, CNAME, NS and MX records. - - - -Kowalik, et al. Expires 4 January 2027 [Page 23] +Kowalik, et al. Expires 4 January 2027 [Page 25] Internet-Draft Domain Connect July 2026 + Type: "String" + + The pointsTo location for A, AAAA, CNAME, NS and MX records. + When used in a template definition, the value MUST conform to the "dc-pointsto-tmpl" syntax for "CNAME"/"MX" and to the "dc- pointsto-nat-tmpl" syntax for A/AAAA/NS (see Section 3). @@ -1334,18 +1450,18 @@ Internet-Draft Domain Connect July 2026 trailing " character MAY be omitted even if space character is present in the value. - "data" MUST NOT be present in a template record for any Fully - Specified or Computed Record Type, which use type-specific data - fields defined in this specification. - -Kowalik, et al. Expires 4 January 2027 [Page 24] +Kowalik, et al. Expires 4 January 2027 [Page 26] Internet-Draft Domain Connect July 2026 + "data" MUST NOT be present in a template record for any Fully + Specified or Computed Record Type, which use type-specific data + fields defined in this specification. + For a Generic Record Type, this field contains the canonical presentation format of the record, following [RFC3597] generic or type-specific encoding. @@ -1390,18 +1506,18 @@ Internet-Draft Domain Connect July 2026 Support of variables in this field is OPTIONAL for DNS Provider. "Weight": - JSON key: "weight" - - Type: "Int" or string representation of "Int" - -Kowalik, et al. Expires 4 January 2027 [Page 25] +Kowalik, et al. Expires 4 January 2027 [Page 27] Internet-Draft Domain Connect July 2026 + JSON key: "weight" + + Type: "Int" or string representation of "Int" + The weight for the SRV record. When used in a template definition, the value MUST conform to the @@ -1447,17 +1563,16 @@ Internet-Draft Domain Connect July 2026 The symbolic service name for the SRV record. - The value MUST conform to the dc-srv-service syntax (see - Section 3). - - -Kowalik, et al. Expires 4 January 2027 [Page 26] +Kowalik, et al. Expires 4 January 2027 [Page 28] Internet-Draft Domain Connect July 2026 + The value MUST conform to the dc-srv-service syntax (see + Section 3). + "Target": JSON key: "target" @@ -1506,10 +1621,7 @@ Internet-Draft Domain Connect July 2026 - - - -Kowalik, et al. Expires 4 January 2027 [Page 27] +Kowalik, et al. Expires 4 January 2027 [Page 29] Internet-Draft Domain Connect July 2026 @@ -1565,7 +1677,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 28] +Kowalik, et al. Expires 4 January 2027 [Page 30] Internet-Draft Domain Connect July 2026 @@ -1621,7 +1733,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 29] +Kowalik, et al. Expires 4 January 2027 [Page 31] Internet-Draft Domain Connect July 2026 @@ -1677,7 +1789,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 30] +Kowalik, et al. Expires 4 January 2027 [Page 32] Internet-Draft Domain Connect July 2026 @@ -1733,7 +1845,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 31] +Kowalik, et al. Expires 4 January 2027 [Page 33] Internet-Draft Domain Connect July 2026 @@ -1789,7 +1901,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 32] +Kowalik, et al. Expires 4 January 2027 [Page 34] Internet-Draft Domain Connect July 2026 @@ -1845,7 +1957,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 33] +Kowalik, et al. Expires 4 January 2027 [Page 35] Internet-Draft Domain Connect July 2026 @@ -1901,7 +2013,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 34] +Kowalik, et al. Expires 4 January 2027 [Page 36] Internet-Draft Domain Connect July 2026 @@ -1957,7 +2069,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 35] +Kowalik, et al. Expires 4 January 2027 [Page 37] Internet-Draft Domain Connect July 2026 @@ -2013,7 +2125,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 36] +Kowalik, et al. Expires 4 January 2027 [Page 38] Internet-Draft Domain Connect July 2026 @@ -2069,7 +2181,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 37] +Kowalik, et al. Expires 4 January 2027 [Page 39] Internet-Draft Domain Connect July 2026 @@ -2125,7 +2237,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 38] +Kowalik, et al. Expires 4 January 2027 [Page 40] Internet-Draft Domain Connect July 2026 @@ -2165,7 +2277,7 @@ Internet-Draft Domain Connect July 2026 "Accept" request header of "application/domainconnect-template+json". When the DNS Provider returns the full template object in the response body, it MUST set the "Content-Type" response header to - "application/domainconnect-template+json" (see Section 12.6). A DNS + "application/domainconnect-template+json" (see Section 12.7). A DNS Provider that does not return the full template object responds as described above. @@ -2181,7 +2293,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 39] +Kowalik, et al. Expires 4 January 2027 [Page 41] Internet-Draft Domain Connect July 2026 @@ -2237,7 +2349,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 40] +Kowalik, et al. Expires 4 January 2027 [Page 42] Internet-Draft Domain Connect July 2026 @@ -2293,7 +2405,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 41] +Kowalik, et al. Expires 4 January 2027 [Page 43] Internet-Draft Domain Connect July 2026 @@ -2349,7 +2461,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 42] +Kowalik, et al. Expires 4 January 2027 [Page 44] Internet-Draft Domain Connect July 2026 @@ -2405,7 +2517,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 43] +Kowalik, et al. Expires 4 January 2027 [Page 45] Internet-Draft Domain Connect July 2026 @@ -2461,7 +2573,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 44] +Kowalik, et al. Expires 4 January 2027 [Page 46] Internet-Draft Domain Connect July 2026 @@ -2517,7 +2629,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 45] +Kowalik, et al. Expires 4 January 2027 [Page 47] Internet-Draft Domain Connect July 2026 @@ -2573,7 +2685,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 46] +Kowalik, et al. Expires 4 January 2027 [Page 48] Internet-Draft Domain Connect July 2026 @@ -2629,7 +2741,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 47] +Kowalik, et al. Expires 4 January 2027 [Page 49] Internet-Draft Domain Connect July 2026 @@ -2685,7 +2797,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 48] +Kowalik, et al. Expires 4 January 2027 [Page 50] Internet-Draft Domain Connect July 2026 @@ -2741,7 +2853,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 49] +Kowalik, et al. Expires 4 January 2027 [Page 51] Internet-Draft Domain Connect July 2026 @@ -2797,7 +2909,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 50] +Kowalik, et al. Expires 4 January 2027 [Page 52] Internet-Draft Domain Connect July 2026 @@ -2853,7 +2965,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 51] +Kowalik, et al. Expires 4 January 2027 [Page 53] Internet-Draft Domain Connect July 2026 @@ -2909,7 +3021,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 52] +Kowalik, et al. Expires 4 January 2027 [Page 54] Internet-Draft Domain Connect July 2026 @@ -2965,7 +3077,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 53] +Kowalik, et al. Expires 4 January 2027 [Page 55] Internet-Draft Domain Connect July 2026 @@ -3021,7 +3133,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 54] +Kowalik, et al. Expires 4 January 2027 [Page 56] Internet-Draft Domain Connect July 2026 @@ -3077,7 +3189,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 55] +Kowalik, et al. Expires 4 January 2027 [Page 57] Internet-Draft Domain Connect July 2026 @@ -3133,7 +3245,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 56] +Kowalik, et al. Expires 4 January 2027 [Page 58] Internet-Draft Domain Connect July 2026 @@ -3189,7 +3301,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 57] +Kowalik, et al. Expires 4 January 2027 [Page 59] Internet-Draft Domain Connect July 2026 @@ -3245,7 +3357,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 58] +Kowalik, et al. Expires 4 January 2027 [Page 60] Internet-Draft Domain Connect July 2026 @@ -3301,7 +3413,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 59] +Kowalik, et al. Expires 4 January 2027 [Page 61] Internet-Draft Domain Connect July 2026 @@ -3357,7 +3469,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 60] +Kowalik, et al. Expires 4 January 2027 [Page 62] Internet-Draft Domain Connect July 2026 @@ -3413,7 +3525,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 61] +Kowalik, et al. Expires 4 January 2027 [Page 63] Internet-Draft Domain Connect July 2026 @@ -3469,7 +3581,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 62] +Kowalik, et al. Expires 4 January 2027 [Page 64] Internet-Draft Domain Connect July 2026 @@ -3525,7 +3637,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 63] +Kowalik, et al. Expires 4 January 2027 [Page 65] Internet-Draft Domain Connect July 2026 @@ -3581,7 +3693,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 64] +Kowalik, et al. Expires 4 January 2027 [Page 66] Internet-Draft Domain Connect July 2026 @@ -3592,8 +3704,7 @@ Internet-Draft Domain Connect July 2026 Settings Properties" under the "Domain Connect Protocol" registry group. - Registration policy: Specification Required (see [RFC8126]), - following the procedure in Section 12.1. + Registration policy: Specification Required (see [RFC8126]). Each entry in the registry MUST include: @@ -3633,18 +3744,16 @@ Internet-Draft Domain Connect July 2026 Reference: The document that defines the property, preferably including a URI from which a copy can be retrieved. + The following properties from this specification constitute the + initial contents of the registry: - -Kowalik, et al. Expires 4 January 2027 [Page 65] +Kowalik, et al. Expires 4 January 2027 [Page 67] Internet-Draft Domain Connect July 2026 - The following properties from this specification constitute the - initial contents of the registry: - +=======================+==========+===============+===============+ | *Property Name* | *Status* | *Kind* | *Reference* | +=======================+==========+===============+===============+ @@ -3671,7 +3780,133 @@ Internet-Draft Domain Connect July 2026 Table 10: Initial Domain Connect Settings Properties -12.4. Guidance to the DNS Resource Record (RR) TYPEs Registry +12.4. Domain Connect Template Properties Registry + + IANA is requested to create a new registry named "Domain Connect + Template Properties" under the "Domain Connect Protocol" registry + group (see Section 12.3). + + Registration policy: + + * For property names without any prefix: RFC Required (see + [RFC8126]). + + * For property names beginning with "vnd.": Specification Required + (see [RFC8126]). + + Each entry in the registry MUST include: + + * *Property name*: the JSON key of the property as it appears in the + template definition. The value MUST conform to the dc-template- + property syntax (see Section 3). + + * *Status*: the lifecycle state of the registration. The following + values are defined; IANA MAY define additional values as needed: + + + +Kowalik, et al. Expires 4 January 2027 [Page 68] + +Internet-Draft Domain Connect July 2026 + + + - "Active": the property is currently in use and its definition + is normative. + + - "Deprecated": the property SHOULD NOT be used in new templates; + it MAY appear in existing templates for backwards + compatibility. + + - "Reserved": the property appears in earlier versions of the + Domain Connect specification (see [DC-SPEC]) and is reserved + for back-compatibility. It MUST NOT be redefined in a manner + incompatible with [DC-SPEC]. See Section 3, Paragraph 13. + + * *Kind*: the nature of the defining document. The value MUST be + one of: "IETF Standard" for properties defined in a standards- + track RFC, "Informational" for properties defined in an + Informational RFC, or "Other" for any other specification. + + * *Reference*: the document that defines the property. + + The following properties from this specification constitute the + initial contents of the registry: + + +=======================+============+===============+=============+ + | *Property Name* | *Status* | *Kind* | *Reference* | + +=======================+============+===============+=============+ + | "providerId" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "providerName" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "serviceId" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "serviceName" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "version" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "templateSpecVersion" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "logoUrl" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "description" | Active | IETF Standard | This | + | | | | document | + + + +Kowalik, et al. Expires 4 January 2027 [Page 69] + +Internet-Draft Domain Connect July 2026 + + + +-----------------------+------------+---------------+-------------+ + | "variableDescription" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "syncBlock" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "shared" | Deprecated | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "sharedProviderName" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "sharedServiceName" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "syncPubKeyDomain" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "syncRedirectDomain" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "multiInstance" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "warnPhishing" | Deprecated | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "hostRequired" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "crit" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + | "records" | Active | IETF Standard | This | + | | | | document | + +-----------------------+------------+---------------+-------------+ + + Table 11: Initial Domain Connect Template Properties + +12.5. Guidance to the DNS Resource Record (RR) TYPEs Registry To avoid collisions between newly assigned DNS RR TYPE mnemonics and the record type names used by Domain Connect, IANA is requested to @@ -3679,6 +3914,14 @@ Internet-Draft Domain Connect July 2026 Record (RR) TYPEs" registry within the "Domain Name System (DNS) Parameters" registry group (see [RFC6895]): + + + +Kowalik, et al. Expires 4 January 2027 [Page 70] + +Internet-Draft Domain Connect July 2026 + + | When evaluating a request to assign a new RR TYPE mnemonic, the | designated experts SHOULD consult the "Domain Connect Fully | Specified Record Types" registry. If the requested mnemonic @@ -3688,16 +3931,6 @@ Internet-Draft Domain Connect July 2026 | Fully Specified Record Types" registry before completing the | assignment. - - - - - -Kowalik, et al. Expires 4 January 2027 [Page 66] - -Internet-Draft Domain Connect July 2026 - - This coupling ensures that a Domain Connect record type name that does not (yet) correspond to a DNS RR TYPE - such as a "Computed" type - is not inadvertently assigned a conflicting meaning in the DNS @@ -3713,7 +3946,7 @@ Internet-Draft Domain Connect July 2026 This records, on the DNS side, the obligation to consult the "Domain Connect Fully Specified Record Types" registry described above. -12.5. Underscore "_domainconnect" DNS Node Name +12.6. Underscore "_domainconnect" DNS Node Name Per [RFC8552], please add the following entry to the "Underscored and Globally Scoped DNS Node Names" registry: @@ -3724,10 +3957,10 @@ Internet-Draft Domain Connect July 2026 | TXT | _domainconnect | This document. | +---------+----------------+----------------+ - Table 11: IANA Registration for + Table 12: IANA Registration for _domainconnect -12.6. Media Type Registration for application/domainconnect- +12.7. Media Type Registration for application/domainconnect- template+json IANA is requested to register the following media type in the "Media @@ -3737,22 +3970,22 @@ Internet-Draft Domain Connect July 2026 Subtype name: domainconnect-template+json - Required parameters: N/A - Optional parameters: N/A - Encoding considerations: binary; the content is a JSON [RFC8259] - document encoded in UTF-8. - Security considerations: See Section 11 of this document. +Kowalik, et al. Expires 4 January 2027 [Page 71] + +Internet-Draft Domain Connect July 2026 + Required parameters: N/A + Optional parameters: N/A -Kowalik, et al. Expires 4 January 2027 [Page 67] - -Internet-Draft Domain Connect July 2026 + Encoding considerations: binary; the content is a JSON [RFC8259] + document encoded in UTF-8. + Security considerations: See Section 11 of this document. Interoperability considerations: See this document. @@ -3794,21 +4027,19 @@ Open Source * Server library (Python):https://github.com/Domain-Connect/ DomainConnectApplyZone -Proprietary implementations - - * ~20 providers, incl. GoDaddy, IONOS, Cloudflare, Squarespace - Domains (former Google), Wordpress.com or Plesk - - * 35% of the .com zone (May'24) +Kowalik, et al. Expires 4 January 2027 [Page 72] + +Internet-Draft Domain Connect July 2026 +Proprietary implementations -Kowalik, et al. Expires 4 January 2027 [Page 68] - -Internet-Draft Domain Connect July 2026 + * ~20 providers, incl. GoDaddy, IONOS, Cloudflare, Squarespace + Domains (former Google), Wordpress.com or Plesk + * 35% of the .com zone (May'24) Service Providers @@ -3849,6 +4080,27 @@ Change History This section is to be removed before publishing as an RFC. +Change from draft-ietf-dconn-domainconnect-03 to -04 + + + + +Kowalik, et al. Expires 4 January 2027 [Page 73] + +Internet-Draft Domain Connect July 2026 + + + * Added Template Property Extensibility and the "crit" property to + Template Definition. + + * Added the "templateSpecVersion" property to Template Definition. + + * Added the IANA "Domain Connect Template Properties" registry in + Domain Connect Template Properties Registry. + + * Added dc-template-property, dc-unprefixed-property, and dc-vnd- + property to Terminology. + Change from draft-ietf-dconn-domainconnect-02 to -03 * Classified template record types as Fully Specified, Computed, or @@ -3858,14 +4110,6 @@ Change from draft-ietf-dconn-domainconnect-02 to -03 Registries section (designated-expert assignment and review process) governing all Domain Connect registries. - - - -Kowalik, et al. Expires 4 January 2027 [Page 69] - -Internet-Draft Domain Connect July 2026 - - * Coupled the "Domain Connect Fully Specified Record Types" registry to the IANA DNS Resource Record (RR) TYPEs registry as a bidirectional maintenance contract (following the pattern set by @@ -3894,6 +4138,14 @@ Internet-Draft Domain Connect July 2026 * Added Identical Records to Conflict Detection and shared-record retention to Calculating Conflict Resolution. + + + +Kowalik, et al. Expires 4 January 2027 [Page 74] + +Internet-Draft Domain Connect July 2026 + + * Added examples illustrating an optional path segment in the "_domainconnect" TXT record content and in the settings-response URL prefixes in DNS Provider Discovery. @@ -3914,14 +4166,6 @@ Change from draft-ietf-dconn-domainconnect-01 to -02 Change from draft-ietf-dconn-domainconnect-00 to -01 - - - -Kowalik, et al. Expires 4 January 2027 [Page 70] - -Internet-Draft Domain Connect July 2026 - - * Added comprehensive ABNF grammar to the Terminology section covering all protocol identifiers, domain name forms (including IDN), template fields, OAuth parameters, and signing artifacts; @@ -3949,6 +4193,15 @@ Internet-Draft Domain Connect July 2026 response and added IANA "Domain Connect Settings Properties" registry. + + + + +Kowalik, et al. Expires 4 January 2027 [Page 75] + +Internet-Draft Domain Connect July 2026 + + * Removed non-normative sections (Public Template Repository, General Considerations, Extensions/Exclusions); replaced all occurrences of "browser" with "user agent". @@ -3971,13 +4224,6 @@ Change from -00 to -01 * Removed example provider names from Service Providers and DNS Providers terminology - - -Kowalik, et al. Expires 4 January 2027 [Page 71] - -Internet-Draft Domain Connect July 2026 - - * Added Use Cases * Added Trust Model @@ -4003,6 +4249,15 @@ domainconnect-00 * Added IANA registration for _domainconnect record as per [RFC8552] + + + + +Kowalik, et al. Expires 4 January 2027 [Page 76] + +Internet-Draft Domain Connect July 2026 + + Change from draft-carney-regext-domainconnect-03 to draft-kowalik- regext-domainconnect-00 @@ -4026,14 +4281,6 @@ Change from -01 to -02 Provider supports a specific template. Some other minor edits for clarification. - - - -Kowalik, et al. Expires 4 January 2027 [Page 72] - -Internet-Draft Domain Connect July 2026 - - Change from draft-carney-regext-domainconnect-00 to -01 * Minor edits and clarifications found during implementation. @@ -4060,6 +4307,13 @@ Normative References RFC 8174, May 2017, . + + +Kowalik, et al. Expires 4 January 2027 [Page 77] + +Internet-Draft Domain Connect July 2026 + + [RFC7208] Kitterman, S., "Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1", IETF, DOI 10.17487/RFC7208, RFC 7208, April 2014, @@ -4083,13 +4337,6 @@ Normative References IETF, DOI 10.17487/RFC8552, BCP 222, RFC 8552, March 2019, . - - -Kowalik, et al. Expires 4 January 2027 [Page 73] - -Internet-Draft Domain Connect July 2026 - - [RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform Resource Identifier (URI): Generic Syntax", IETF, STD 66, DOI 10.17487/RFC3986, BCP 66, RFC 3986, January 2005, @@ -4116,6 +4363,13 @@ Internet-Draft Domain Connect July 2026 DOI 10.17487/RFC6570, RFC 6570, March 2012, . + + +Kowalik, et al. Expires 4 January 2027 [Page 78] + +Internet-Draft Domain Connect July 2026 + + [RFC5234] Overell, P. and D. Crocker, "Augmented BNF for Syntax Specifications: ABNF", IETF, STD 68, DOI 10.17487/RFC5234, BCP 68, RFC 5234, January 2008, @@ -4139,13 +4393,6 @@ Internet-Draft Domain Connect July 2026 Subsets", IETF, DOI 10.17487/RFC9839, RFC 9839, August 2025, . - - -Kowalik, et al. Expires 4 January 2027 [Page 74] - -Internet-Draft Domain Connect July 2026 - - [RFC8126] Cotton, M., Leiba, B., and T. Narten, "Guidelines for Writing an IANA Considerations Section in RFCs", IETF, DOI 10.17487/RFC8126, BCP 26, RFC 8126, June 2017, @@ -4171,6 +4418,14 @@ Informative References Terminology", IETF, DOI 10.17487/RFC8499, RFC 8499, January 2019, . + + + +Kowalik, et al. Expires 4 January 2027 [Page 79] + +Internet-Draft Domain Connect July 2026 + + [RFC6839] Hansen, T. and A. Melnikov, "Additional Media Type Structured Syntax Suffixes", IETF, DOI 10.17487/RFC6839, RFC 6839, January 2013, @@ -4197,7 +4452,32 @@ A.1. Example Template -Kowalik, et al. Expires 4 January 2027 [Page 75] + + + + + + + + + + + + + + + + + + + + + + + + + +Kowalik, et al. Expires 4 January 2027 [Page 80] Internet-Draft Domain Connect July 2026 @@ -4253,7 +4533,7 @@ A.2. Example Records: Single static host record -Kowalik, et al. Expires 4 January 2027 [Page 76] +Kowalik, et al. Expires 4 January 2027 [Page 81] Internet-Draft Domain Connect July 2026 @@ -4309,7 +4589,7 @@ A.4. Example Records: Generic Record Type CAA -Kowalik, et al. Expires 4 January 2027 [Page 77] +Kowalik, et al. Expires 4 January 2027 [Page 82] Internet-Draft Domain Connect July 2026 @@ -4365,7 +4645,7 @@ A.5. Example: Template application to DNS Zone and Conflict Resolution -Kowalik, et al. Expires 4 January 2027 [Page 78] +Kowalik, et al. Expires 4 January 2027 [Page 83] Internet-Draft Domain Connect July 2026 @@ -4421,7 +4701,7 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 79] +Kowalik, et al. Expires 4 January 2027 [Page 84] Internet-Draft Domain Connect July 2026 @@ -4477,7 +4757,7 @@ A.6. Example: SPF Record Merging -Kowalik, et al. Expires 4 January 2027 [Page 80] +Kowalik, et al. Expires 4 January 2027 [Page 85] Internet-Draft Domain Connect July 2026 @@ -4533,7 +4813,7 @@ Authors' Addresses -Kowalik, et al. Expires 4 January 2027 [Page 81] +Kowalik, et al. Expires 4 January 2027 [Page 86] Internet-Draft Domain Connect July 2026 @@ -4589,4 +4869,4 @@ Internet-Draft Domain Connect July 2026 -Kowalik, et al. Expires 4 January 2027 [Page 82] +Kowalik, et al. Expires 4 January 2027 [Page 87] diff --git a/docs/draft-ietf-dconn-domainconnect-04.xml b/docs/draft-ietf-dconn-domainconnect-04.xml index 28cc6d5..8ff095a 100644 --- a/docs/draft-ietf-dconn-domainconnect-04.xml +++ b/docs/draft-ietf-dconn-domainconnect-04.xml @@ -126,7 +126,7 @@ The following additional ABNF rules are defined in this document and used normatively throughout. -The template JSON structure defined in this section is identified by the media type "application/domainconnect-template+json" (see ). -

-Table 11: +Table 12: IANA Registration for _domainconnect
properties of the template definition
Data ElementTypeKeyDescription
Service Provider IdStringproviderId(REQUIRED) The unique identifier of the Service Provider that created this template. This is used in the URLs to identify the Service Provider.
The value MUST conform to the dc-id syntax (see ).
To ensure non-coordinated uniqueness, this SHOULD be the domain name of the Service Provider (e.g. exampleservice.example).
Service Provider NameStringproviderName(REQUIRED) The name of the Service Provider, suitable for display to the user.
The value MUST conform to the dc-display-name syntax (see ).
Service IdStringserviceId(REQUIRED) The name or identifier of the template. This is used in URLs to identify the template.
The value MUST conform to the dc-id syntax (see ).
Service NameStringserviceName(REQUIRED) The name of the service, suitable for display to the user.
The value MUST conform to the dc-display-name syntax (see ).
VersionIntegerversion(OPTIONAL) If present this represents a version of the template and SHOULD be changed with each update of the template content. This opaque value is mainly informational to improve communication and transparency between providers.
The value MUST conform to the dc-version syntax (see ).
This is a strict subset of the "JSON number": a positive integer with no leading zeros, no fractional part, and no exponent part.
LogoStringlogoUrl(OPTIONAL) A graphical logo representing the Service Provider and/or Service for use in any web-based flow. If present this MAY be displayed to the user on the DNS Provider consent UX.
When present, the value MUST be a valid URI with scheme "https".
DescriptionStringdescription(OPTIONAL) A textual description of what this template does, intended for developer reference. This value is not intended for display to the end user.
The value MUST conform to the dc-description-text syntax (see ).
Variable DescriptionStringvariableDescription(OPTIONAL) A textual description of the template variables, intended for developer reference. This value is not intended for display to the end user.
The value MUST conform to the dc-description-text syntax (see ).
Synchronous BlockBooleansyncBlock(OPTIONAL) When "true", indicates that this template does not support the synchronous flow. The DNS Provider MUST refuse a synchronous apply request for this template and MUST return an appropriate error to the user.
The default is "false".
SharedBooleanshared(OPTIONAL) This flag has been deprecated. It used to indicate that the template allowed a dynamic "providerName" on the query string. It is replaced with the "sharedProviderName" flag in v2.2 of the spec.
Shared Provider NameBooleansharedProviderName(OPTIONAL) When "true", indicates that the caller MAY supply an additional "providerName" parameter at apply time.
The default is "false".
For backward compatibility with DNS Providers prior to v2.2, it is RECOMMENDED that the deprecated "shared" flag also be set.
Shared Service NameBooleansharedServiceName(OPTIONAL) When "true", indicates that the caller MAY supply an additional "serviceName" parameter at apply time.
The default is "false".
Synchronous Public Key DomainStringsyncPubKeyDomain(OPTIONAL) The domain name under which the Service Provider's public signing key TXT record is published. When present, this field signals that digital signing is required for synchronous apply requests.
The value MUST conform to the dc-pubkey-domain syntax (see ).
Synchronous Redirect DomainsStringsyncRedirectDomain(OPTIONAL) A comma-separated list of domain names to which the DNS Provider is permitted to send the post-apply redirect in the synchronous flow.
The value MUST conform to the "dc-host-list" syntax (see ).
Multiple InstanceBooleanmultiInstance(OPTIONAL) When "true", indicates that the template is designed to be applied multiple times to the same domain and host.
The default is "false".
Warn PhishingBooleanwarnPhishing(DEPRECATED) This flag is deprecated and its code point is reserved (see ). Phishing warnings are now the default behavior in the absence of other security mechanisms (see ). This flag MUST NOT be relied upon and MUST NOT be set in new templates. A DNS Provider MUST NOT treat the absence of this flag as a signal that a template is not susceptible to phishing.
Host RequiredBooleanhostRequired(OPTIONAL) When "true", indicates that the template is designed to work only when both "domain" and "host" apply parameters are provided, for example when the template contains a CNAME record targeted at the fully qualified domain name.
The default is "false".
Template RecordsArray of Template Recordsrecords(REQUIRED) A list of records for the template.
+properties of the template definition
Data ElementTypeKeyDescription
Service Provider IdStringproviderId(REQUIRED) The unique identifier of the Service Provider that created this template. This is used in the URLs to identify the Service Provider.
The value MUST conform to the dc-id syntax (see ).
To ensure non-coordinated uniqueness, this SHOULD be the domain name of the Service Provider (e.g. exampleservice.example).
Service Provider NameStringproviderName(REQUIRED) The name of the Service Provider, suitable for display to the user.
The value MUST conform to the dc-display-name syntax (see ).
Service IdStringserviceId(REQUIRED) The name or identifier of the template. This is used in URLs to identify the template.
The value MUST conform to the dc-id syntax (see ).
Service NameStringserviceName(REQUIRED) The name of the service, suitable for display to the user.
The value MUST conform to the dc-display-name syntax (see ).
VersionIntegerversion(OPTIONAL) If present this represents a version of the template and SHOULD be changed with each update of the template content. This opaque value is mainly informational to improve communication and transparency between providers.
The value MUST conform to the dc-version syntax (see ).
This is a strict subset of the "JSON number": a positive integer with no leading zeros, no fractional part, and no exponent part.
Template Specification VersionIntegertemplateSpecVersion(OPTIONAL) The version of the Domain Connect template specification that the template conforms to. This identifies the template format and processing rules defined by this document and its successors.
The value MUST conform to the dc-version syntax (see ). For templates conforming to this document, the value is "1".
LogoStringlogoUrl(OPTIONAL) A graphical logo representing the Service Provider and/or Service for use in any web-based flow. If present this MAY be displayed to the user on the DNS Provider consent UX.
When present, the value MUST be a valid URI with scheme "https".
DescriptionStringdescription(OPTIONAL) A textual description of what this template does, intended for developer reference. This value is not intended for display to the end user.
The value MUST conform to the dc-description-text syntax (see ).
Variable DescriptionStringvariableDescription(OPTIONAL) A textual description of the template variables, intended for developer reference. This value is not intended for display to the end user.
The value MUST conform to the dc-description-text syntax (see ).
Synchronous BlockBooleansyncBlock(OPTIONAL) When "true", indicates that this template does not support the synchronous flow. The DNS Provider MUST refuse a synchronous apply request for this template and MUST return an appropriate error to the user.
The default is "false".
SharedBooleanshared(OPTIONAL) This flag has been deprecated. It used to indicate that the template allowed a dynamic "providerName" on the query string. It is replaced with the "sharedProviderName" flag in v2.2 of the spec.
Shared Provider NameBooleansharedProviderName(OPTIONAL) When "true", indicates that the caller MAY supply an additional "providerName" parameter at apply time.
The default is "false".
For backward compatibility with DNS Providers prior to v2.2, it is RECOMMENDED that the deprecated "shared" flag also be set.
Shared Service NameBooleansharedServiceName(OPTIONAL) When "true", indicates that the caller MAY supply an additional "serviceName" parameter at apply time.
The default is "false".
Synchronous Public Key DomainStringsyncPubKeyDomain(OPTIONAL) The domain name under which the Service Provider's public signing key TXT record is published. When present, this field signals that digital signing is required for synchronous apply requests.
The value MUST conform to the dc-pubkey-domain syntax (see ).
Synchronous Redirect DomainsStringsyncRedirectDomain(OPTIONAL) A comma-separated list of domain names to which the DNS Provider is permitted to send the post-apply redirect in the synchronous flow.
The value MUST conform to the "dc-host-list" syntax (see ).
Multiple InstanceBooleanmultiInstance(OPTIONAL) When "true", indicates that the template is designed to be applied multiple times to the same domain and host.
The default is "false".
Warn PhishingBooleanwarnPhishing(DEPRECATED) This flag is deprecated and its code point is reserved (see ). Phishing warnings are now the default behavior in the absence of other security mechanisms (see ). This flag MUST NOT be relied upon and MUST NOT be set in new templates. A DNS Provider MUST NOT treat the absence of this flag as a signal that a template is not susceptible to phishing.
Host RequiredBooleanhostRequired(OPTIONAL) When "true", indicates that the template is designed to work only when both "domain" and "host" apply parameters are provided, for example when the template contains a CNAME record targeted at the fully qualified domain name.
The default is "false".
Critical PropertiesArray of Stringcrit(OPTIONAL) A list of the names of template properties that an implementation is required to understand and process for the template to be applied correctly.
Each entry MUST conform to the dc-template-property syntax (see ).
When present, the "crit" property MUST NOT be empty.
Template RecordsArray of Template Recordsrecords(REQUIRED) A list of records for the template.
+ +
Template Property Extensibility + +The set of template-definition properties defined above MAY be extended. To keep template definitions forward-compatible and to avoid name collisions between this specification, future standards-track extensions, and vendor-specific additions, the property name space is partitioned as follows: + +
  • Property names without any prefix are reserved for this specification and for future standards-track extensions that normatively require this document as their base. Such names are managed through the IANA "Domain Connect Template Properties" registry (see ). Implementations MUST NOT introduce private or vendor-specific properties using unprefixed names.
    • +
  • Property names beginning with "vnd." are reserved for vendor-specific and private use. A vendor SHOULD further namespace such properties with a vendor identifier (e.g. "vnd.example.fooBar"), and such names MAY be registered in the IANA "Domain Connect Template Properties" registry (see ). Properties using this prefix MUST NOT be assumed to be interoperable across implementations, and the property name MUST conform to the dc-vnd-property syntax (see ).
    • +
+ +Both DNS Providers and Service Providers process template definitions. An implementation of either role MUST ignore any template property it does not recognise; the mere presence of an unrecognised property MUST NOT cause the template to be rejected. This applies equally to unprefixed properties added by later revisions of this specification and to "vnd." properties. An implementation MUST NOT rely on the semantics of a "vnd." property. + +The "crit" property (see ) overrides this default for the properties it lists: if an implementation does not understand and cannot process one or more of those properties, it MUST reject the template and MUST NOT apply it. A listed name that does not correspond to a property present in the template definition, is by definition understood. + +The "templateSpecVersion" property (see ) identifies the version of the template specification the template conforms to. An implementation that does not support the indicated template specification version MUST reject the template and MUST NOT apply it. A template that omits "templateSpecVersion" is processed as if it declared version "1". +
Template Record @@ -1399,7 +1426,7 @@ r2.example.com. TXT v=spf1 include:_spf.newsletter.example ~all IANA is requested to create a new registry named "Domain Connect Settings Properties" under the "Domain Connect Protocol" registry group. -Registration policy: Specification Required (see ), following the procedure in . +Registration policy: Specification Required (see ). Each entry in the registry MUST include: @@ -1427,54 +1454,82 @@ r2.example.com. TXT v=spf1 include:_spf.newsletter.example ~all Initial Domain Connect Settings Properties
Property NameStatusKindReference
"providerId"ActiveIETF StandardThis document
"providerName"ActiveIETF StandardThis document
"providerDisplayName"ActiveIETF StandardThis document
"urlSyncUX"ActiveIETF StandardThis document
"urlAsyncUX"ReservedOther
"urlAPI"ActiveIETF StandardThis document
"width"ReservedOther
"height"ReservedOther
"urlControlPanel"ReservedOther
"nameServers"ActiveIETF StandardThis document
+
Domain Connect Template Properties Registry + +IANA is requested to create a new registry named "Domain Connect Template Properties" under the "Domain Connect Protocol" registry group (see ). + +Registration policy: + +
  • For property names without any prefix: RFC Required (see ).
    • +
  • For property names beginning with "vnd.": Specification Required (see ).
    • +
+ +Each entry in the registry MUST include: + +
  • Property name: the JSON key of the property as it appears in the template definition. The value MUST conform to the dc-template-property syntax (see ).
    • +
  • Status: the lifecycle state of the registration. The following values are defined; IANA MAY define additional values as needed: +
    • "Active": the property is currently in use and its definition is normative.
      • +
    • "Deprecated": the property SHOULD NOT be used in new templates; it MAY appear in existing templates for backwards compatibility.
      • +
    • "Reserved": the property appears in earlier versions of the Domain Connect specification (see ) and is reserved for back-compatibility. It MUST NOT be redefined in a manner incompatible with . See .
      • +
    +
    • +
  • Kind: the nature of the defining document. The value MUST be one of: "IETF Standard" for properties defined in a standards-track RFC, "Informational" for properties defined in an Informational RFC, or "Other" for any other specification.
    • +
  • Reference: the document that defines the property.
    • +
+ +The following properties from this specification constitute the initial contents of the registry: + +Initial Domain Connect Template Properties
Property NameStatusKindReference
"providerId"ActiveIETF StandardThis document
"providerName"ActiveIETF StandardThis document
"serviceId"ActiveIETF StandardThis document
"serviceName"ActiveIETF StandardThis document
"version"ActiveIETF StandardThis document
"templateSpecVersion"ActiveIETF StandardThis document
"logoUrl"ActiveIETF StandardThis document
"description"ActiveIETF StandardThis document
"variableDescription"ActiveIETF StandardThis document
"syncBlock"ActiveIETF StandardThis document
"shared"DeprecatedIETF StandardThis document
"sharedProviderName"ActiveIETF StandardThis document
"sharedServiceName"ActiveIETF StandardThis document
"syncPubKeyDomain"ActiveIETF StandardThis document
"syncRedirectDomain"ActiveIETF StandardThis document
"multiInstance"ActiveIETF StandardThis document
"warnPhishing"DeprecatedIETF StandardThis document
"hostRequired"ActiveIETF StandardThis document
"crit"ActiveIETF StandardThis document
"records"ActiveIETF StandardThis document
+
+
Guidance to the DNS Resource Record (RR) TYPEs Registry -To avoid collisions between newly assigned DNS RR TYPE mnemonics and the record type names used by Domain Connect, IANA is requested to add the following note to the registration procedure of the "Resource Record (RR) TYPEs" registry within the "Domain Name System (DNS) Parameters" registry group (see ): +To avoid collisions between newly assigned DNS RR TYPE mnemonics and the record type names used by Domain Connect, IANA is requested to add the following note to the registration procedure of the "Resource Record (RR) TYPEs" registry within the "Domain Name System (DNS) Parameters" registry group (see ): -
When evaluating a request to assign a new RR TYPE mnemonic, the designated experts SHOULD consult the "Domain Connect Fully Specified Record Types" registry. If the requested mnemonic matches the name of an entry in that registry whose DNS RR TYPE field is "N/A", the designated experts SHOULD flag the potential conflict and consult the designated experts of the "Domain Connect Fully Specified Record Types" registry before completing the assignment. +
When evaluating a request to assign a new RR TYPE mnemonic, the designated experts SHOULD consult the "Domain Connect Fully Specified Record Types" registry. If the requested mnemonic matches the name of an entry in that registry whose DNS RR TYPE field is "N/A", the designated experts SHOULD flag the potential conflict and consult the designated experts of the "Domain Connect Fully Specified Record Types" registry before completing the assignment.
-This coupling ensures that a Domain Connect record type name that does not (yet) correspond to a DNS RR TYPE - such as a "Computed" type - is not inadvertently assigned a conflicting meaning in the DNS RR TYPEs registry. +This coupling ensures that a Domain Connect record type name that does not (yet) correspond to a DNS RR TYPE - such as a "Computed" type - is not inadvertently assigned a conflicting meaning in the DNS RR TYPEs registry. -In addition, IANA is requested to update the "Reference" of the "Resource Record (RR) TYPEs" registry to cite this document alongside the existing references: +In addition, IANA is requested to update the "Reference" of the "Resource Record (RR) TYPEs" registry to cite this document alongside the existing references: -
OLD: [RFC6895][RFC1035]
NEW: [RFC6895][RFC1035][This document] +
OLD: [RFC6895][RFC1035]
NEW: [RFC6895][RFC1035][This document]
-This records, on the DNS side, the obligation to consult the "Domain Connect Fully Specified Record Types" registry described above. +This records, on the DNS side, the obligation to consult the "Domain Connect Fully Specified Record Types" registry described above.
Underscore "_domainconnect" DNS Node Name -Per , please add the following entry to the "Underscored and Globally Scoped DNS Node Names" registry: +Per , please add the following entry to the "Underscored and Globally Scoped DNS Node Names" registry: -IANA Registration for _domainconnect
RR Type_NODE NAMEReference
TXT_domainconnectThis document.
+IANA Registration for _domainconnect
RR Type_NODE NAMEReference
TXT_domainconnectThis document.
Media Type Registration for application/domainconnect-template+json -IANA is requested to register the following media type in the "Media Types" registry, per . - -
Type name:
application -
Subtype name:
domainconnect-template+json -
Required parameters:
N/A -
Optional parameters:
N/A -
Encoding considerations:
binary; the content is a JSON document encoded in UTF-8. -
Security considerations:
See of this document. -
Interoperability considerations:
See this document. -
Published specification:
This document (see ). -
Applications that use this media type:
Domain Connect Service Providers and DNS Providers. -
Fragment identifier considerations:
The "+json" structured syntax suffix is defined in ; see also . -
Additional information:
Deprecated alias names for this type:
N/A -
Magic number(s):
N/A -
File extension(s):
N/A -
Macintosh file type code(s):
N/A +IANA is requested to register the following media type in the "Media Types" registry, per . + +
Type name:
application +
Subtype name:
domainconnect-template+json +
Required parameters:
N/A +
Optional parameters:
N/A +
Encoding considerations:
binary; the content is a JSON document encoded in UTF-8. +
Security considerations:
See of this document. +
Interoperability considerations:
See this document. +
Published specification:
This document (see ). +
Applications that use this media type:
Domain Connect Service Providers and DNS Providers. +
Fragment identifier considerations:
The "+json" structured syntax suffix is defined in ; see also . +
Additional information:
Deprecated alias names for this type:
N/A +
Magic number(s):
N/A +
File extension(s):
N/A +
Macintosh file type code(s):
N/A
-
Person email address to contact for further information:
IETF DCONN Working Group <> -
Intended usage:
COMMON -
Restrictions on usage:
N/A -
Author:
IETF DCONN Working Group -
Change controller:
IETF +
Person email address to contact for further information:
IETF DCONN Working Group <> +
Intended usage:
COMMON +
Restrictions on usage:
N/A +
Author:
IETF DCONN Working Group +
Change controller:
IETF
@@ -1526,11 +1581,20 @@ r2.example.com. TXT v=spf1 include:_spf.newsletter.example ~all
  • Arnt Gulbrandsen
    • -
    Change History +
    Change History + +
    Change from draft-ietf-dconn-domainconnect-03 to -04 + +
    • Added and the "crit" property to .
      • +
    • Added the "templateSpecVersion" property to .
      • +
    • Added the IANA "Domain Connect Template Properties" registry in .
      • +
    • Added dc-template-property, dc-unprefixed-property, and dc-vnd-property to .
      • +
    +
    -
    Change from draft-ietf-dconn-domainconnect-02 to -03 +
    Change from draft-ietf-dconn-domainconnect-02 to -03 -
    • Classified template record types as Fully Specified, Computed, or Generic.
      • +
      • Classified template record types as Fully Specified, Computed, or Generic.
      • Added a shared section (designated-expert assignment and review process) governing all Domain Connect registries.
      • Coupled the "Domain Connect Fully Specified Record Types" registry to the IANA DNS Resource Record (RR) TYPEs registry as a bidirectional maintenance contract (following the pattern set by RFC 9108 for that registry).
      • Added to .
        • @@ -1547,15 +1611,15 @@ r2.example.com. TXT v=spf1 include:_spf.newsletter.example ~all
    -
    Change from draft-ietf-dconn-domainconnect-01 to -02 +
    Change from draft-ietf-dconn-domainconnect-01 to -02 -
    • Removed the Asynchronous OAuth Flow from this document; the synchronous flow is now the sole protocol flow defined here. The asynchronous flow is reserved for a companion extension specification.
      • +
      • Removed the Asynchronous OAuth Flow from this document; the synchronous flow is now the sole protocol flow defined here. The asynchronous flow is reserved for a companion extension specification.
    -
    Change from draft-ietf-dconn-domainconnect-00 to -01 +
    Change from draft-ietf-dconn-domainconnect-00 to -01 -
    • Added comprehensive ABNF grammar to the Terminology section covering all protocol identifiers, domain name forms (including IDN), template fields, OAuth parameters, and signing artifacts; replaced informal prose constraints throughout parameter tables and field definitions with normative ABNF references.
      • +
      • Added comprehensive ABNF grammar to the Terminology section covering all protocol identifiers, domain name forms (including IDN), template fields, OAuth parameters, and signing artifacts; replaced informal prose constraints throughout parameter tables and field definitions with normative ABNF references.
      • Restructured : added , Essential Records, Steps to Apply a Template, and focused , subsections; moved UX and runtime-processing rules into their appropriate sections; moved before in the document structure.
      • Restructured request signing into , , and
      • Replaced Sync Apply Interaction with a normative Request/Response/Error structure; rewrote as normative text.
        • @@ -1566,21 +1630,21 @@ r2.example.com. TXT v=spf1 include:_spf.newsletter.example ~all
    -
    Change from draft-kowalik-domainconnect-02 to draft-ietf-dconn-domainconnect-00 +
    Change from draft-kowalik-domainconnect-02 to draft-ietf-dconn-domainconnect-00 -
    • DCONN WG adoption. No other changes.
      • +
      • DCONN WG adoption. No other changes.
    -
    Change from -01 to -02 +
    Change from -01 to -02 -
    • Draft refresh from expire. No content changes.
      • +
      • Draft refresh from expire. No content changes.
    -
    Change from -00 to -01 +
    Change from -00 to -01 -
    • Changed term Root Domain to Zone Apex to align with .
      • +
      • Changed term Root Domain to Zone Apex to align with .
      • Removed example provider names from Service Providers and DNS Providers terminology
      • Added Use Cases
      • Added Trust Model
        • @@ -1592,37 +1656,37 @@ r2.example.com. TXT v=spf1 include:_spf.newsletter.example ~all
    -
    Change from draft-kowalik-regext-domainconnect-00 to draft-kowalik-domainconnect-00 +
    Change from draft-kowalik-regext-domainconnect-00 to draft-kowalik-domainconnect-00 -
    • Added possibility to specify any DNS record type in a generic manner.
      • +
      • Added possibility to specify any DNS record type in a generic manner.
      • Added possibility to define variables for numeric fields.
      • Added IANA registration for _domainconnect record as per
    -
    Change from draft-carney-regext-domainconnect-03 to draft-kowalik-regext-domainconnect-00 +
    Change from draft-carney-regext-domainconnect-03 to draft-kowalik-regext-domainconnect-00 -
    • Version synchronized with 2.2 version rev. 66 of the public Domain Connect specification.
      • +
      • Version synchronized with 2.2 version rev. 66 of the public Domain Connect specification.
    -
    Change from -02 to -03 +
    Change from -02 to -03 -
    • Added width/height JSON values returned by DNS Provider Discovery.
      • +
      • Added width/height JSON values returned by DNS Provider Discovery.
      • Corrected text of GET method for getting the authorization token.
      • Added clarifying text to Group ID description parameter of the apply template POST method. Quite a few minor edits and clarifications that were found during implementation, especially in the Implementation Considerations section.
    -
    Change from -01 to -02 +
    Change from -01 to -02 -
    • Added new GET method for Service Providers to determine if the DNS Provider supports a specific template. Some other minor edits for clarification.
      • +
      • Added new GET method for Service Providers to determine if the DNS Provider supports a specific template. Some other minor edits for clarification.
    -
    Change from draft-carney-regext-domainconnect-00 to -01 +
    Change from draft-carney-regext-domainconnect-00 to -01 -
    • Minor edits and clarifications found during implementation.
      • +
      • Minor edits and clarifications found during implementation.
    diff --git a/draft-ietf-dconn-domainconnect-04.adoc b/draft-ietf-dconn-domainconnect-04.adoc index a9f29aa..22a395d 100644 --- a/draft-ietf-dconn-domainconnect-04.adoc +++ b/draft-ietf-dconn-domainconnect-04.adoc @@ -140,6 +140,18 @@ dc-id-list = dc-id *( "," dc-id ) dc-host-list = domain-name *( *SP "," *SP domain-name ) ; comma-separated list of domain names +dc-template-property = dc-unprefixed-property / dc-vnd-property + ; any template-definition property name + +dc-unprefixed-property = ( ALPHA / DIGIT ) *( ALPHA / DIGIT ) + ; reserved for this specification and for + ; standards-track extensions; managed by the + ; IANA Domain Connect Template Properties registry + +dc-vnd-property = "vnd." 1*ALPHA *( "." 1*ALPHA ) + ; "vnd." tree for vendor/private template + ; properties + ; ---- Other parameter rules ---- dc-sig = 1*( ALPHA / DIGIT / "+" / "/" / "=" ) @@ -507,6 +519,13 @@ The value MUST conform to the `dc-version` syntax (see <>). + This is a strict subset of the `"JSON number"`: a positive integer with no leading zeros, no fractional part, and no exponent part. +|*Template Specification Version* +|Integer +|templateSpecVersion +|(OPTIONAL) The version of the Domain Connect template specification that the template conforms to. This identifies the template format and processing rules defined by this document and its successors. + + +The value MUST conform to the `dc-version` syntax (see <>). For templates conforming to this document, the value is `"1"`. + |*Logo* |String |logoUrl @@ -594,12 +613,35 @@ The default is `"false"`. The default is `"false"`. +|*Critical Properties* +|Array of String +|crit +|(OPTIONAL) A list of the names of template properties that an implementation is required to understand and process for the template to be applied correctly. + + +Each entry MUST conform to the `dc-template-property` syntax (see <>). + + +When present, the `"crit"` property MUST NOT be empty. + |*Template Records* |Array of Template Records |records |(REQUIRED) A list of records for the template. |======================================================================= +[[template-property-extensibility]] +==== Template Property Extensibility + +The set of template-definition properties defined above MAY be extended. To keep template definitions forward-compatible and to avoid name collisions between this specification, future standards-track extensions, and vendor-specific additions, the property name space is partitioned as follows: + +* Property names without any prefix are reserved for this specification and for future standards-track extensions that normatively require this document as their base. Such names are managed through the IANA "Domain Connect Template Properties" registry (see <>). Implementations MUST NOT introduce private or vendor-specific properties using unprefixed names. +* Property names beginning with `"vnd."` are reserved for vendor-specific and private use. A vendor SHOULD further namespace such properties with a vendor identifier (e.g. `"vnd.example.fooBar"`), and such names MAY be registered in the IANA "Domain Connect Template Properties" registry (see <>). Properties using this prefix MUST NOT be assumed to be interoperable across implementations, and the property name MUST conform to the `dc-vnd-property` syntax (see <>). + +Both DNS Providers and Service Providers process template definitions. An implementation of either role MUST ignore any template property it does not recognise; the mere presence of an unrecognised property MUST NOT cause the template to be rejected. This applies equally to unprefixed properties added by later revisions of this specification and to `"vnd."` properties. An implementation MUST NOT rely on the semantics of a `"vnd."` property. + +The `"crit"` property (see <>) overrides this default for the properties it lists: if an implementation does not understand and cannot process one or more of those properties, it MUST reject the template and MUST NOT apply it. A listed name that does not correspond to a property present in the template definition, is by definition understood. + +The `"templateSpecVersion"` property (see <>) identifies the version of the template specification the template conforms to. An implementation that does not support the indicated template specification version MUST reject the template and MUST NOT apply it. A template that omits `"templateSpecVersion"` is processed as if it declared version `"1"`. + [[template-record]] === Template Record @@ -2079,7 +2121,7 @@ The following types from this specification constitute the initial contents of t IANA is requested to create a new registry named "Domain Connect Settings Properties" under the "Domain Connect Protocol" registry group. -Registration policy: Specification Required (see <>), following the procedure in <>. +Registration policy: Specification Required (see <>). Each entry in the registry MUST include: @@ -2158,6 +2200,136 @@ The following properties from this specification constitute the initial contents |This document |======================================================================= +[[iana-template-properties]] +=== Domain Connect Template Properties Registry + +IANA is requested to create a new registry named "Domain Connect Template Properties" under the "Domain Connect Protocol" registry group (see <>). + +Registration policy: + +* For property names without any prefix: RFC Required (see <>). +* For property names beginning with `"vnd."`: Specification Required (see <>). + +Each entry in the registry MUST include: + +* *Property name*: the JSON key of the property as it appears in the template definition. The value MUST conform to the `dc-template-property` syntax (see <>). +* *Status*: the lifecycle state of the registration. The following values are defined; IANA MAY define additional values as needed: +** `"Active"`: the property is currently in use and its definition is normative. +** `"Deprecated"`: the property SHOULD NOT be used in new templates; it MAY appear in existing templates for backwards compatibility. +** `"Reserved"`: the property appears in earlier versions of the Domain Connect specification (see <>) and is reserved for back-compatibility. It MUST NOT be redefined in a manner incompatible with <>. See <>. +* *Kind*: the nature of the defining document. The value MUST be one of: `"IETF Standard"` for properties defined in a standards-track RFC, `"Informational"` for properties defined in an Informational RFC, or `"Other"` for any other specification. +* *Reference*: the document that defines the property. + + +The following properties from this specification constitute the initial contents of the registry: + +[cols=",,,"options="header",title="Initial Domain Connect Template Properties"] +|======================================================================= +|*Property Name* +|*Status* +|*Kind* +|*Reference* + +|`"providerId"` +|Active +|IETF Standard +|This document + +|`"providerName"` +|Active +|IETF Standard +|This document + +|`"serviceId"` +|Active +|IETF Standard +|This document + +|`"serviceName"` +|Active +|IETF Standard +|This document + +|`"version"` +|Active +|IETF Standard +|This document + +|`"templateSpecVersion"` +|Active +|IETF Standard +|This document + +|`"logoUrl"` +|Active +|IETF Standard +|This document + +|`"description"` +|Active +|IETF Standard +|This document + +|`"variableDescription"` +|Active +|IETF Standard +|This document + +|`"syncBlock"` +|Active +|IETF Standard +|This document + +|`"shared"` +|Deprecated +|IETF Standard +|This document + +|`"sharedProviderName"` +|Active +|IETF Standard +|This document + +|`"sharedServiceName"` +|Active +|IETF Standard +|This document + +|`"syncPubKeyDomain"` +|Active +|IETF Standard +|This document + +|`"syncRedirectDomain"` +|Active +|IETF Standard +|This document + +|`"multiInstance"` +|Active +|IETF Standard +|This document + +|`"warnPhishing"` +|Deprecated +|IETF Standard +|This document + +|`"hostRequired"` +|Active +|IETF Standard +|This document + +|`"crit"` +|Active +|IETF Standard +|This document + +|`"records"` +|Active +|IETF Standard +|This document +|======================================================================= [[iana-rrtype-guidance]] === Guidance to the DNS Resource Record (RR) TYPEs Registry @@ -2275,6 +2447,13 @@ The authors wish to thank the following persons for their feedback and suggestio [removeInRFC=true,toc=include,numbered=false] == Change History +[toc=exclude,numbered=false] +=== Change from draft-ietf-dconn-domainconnect-03 to -04 +- Added <> and the `"crit"` property to <>. +- Added the `"templateSpecVersion"` property to <>. +- Added the IANA "Domain Connect Template Properties" registry in <>. +- Added `dc-template-property`, `dc-unprefixed-property`, and `dc-vnd-property` to <>. + [toc=exclude,numbered=false] === Change from draft-ietf-dconn-domainconnect-02 to -03 - Classified template record types as Fully Specified, Computed, or Generic.