| Network Working Group | S. Bortzmeyer |
| Internet-Draft | AFNIC |
| Intended status: Standards Track | January 5, 2018 |
| Expires: July 9, 2018 |
EPP Mapping for DNAME delegation of domain names
draft-bortzmeyer-regext-epp-dname-00
This document describes an Extensible Provisioning Protocol (EPP) extension mapping for the provisioning and management of Domain Name System for domain names stored in a shared central repository. Specified in XML, this mapping extends the EPP domain name mapping to provide the ability to delegate a domain names through DNAME resource records, thus making the new domain an alias of a previous domain.
REMOVE BEFORE PUBLICATION This document should be discussed on the Registration Protocols Extensions (regext) mailing list. The source of this document is kept on a Gitlab at Framagit. A list of open issues is there as well.
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."
This Internet-Draft will expire on July 9, 2018.
Copyright (c) 2018 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
This document describes an extension mapping for version 1.0 of the Extensible Provisioning Protocol (EPP) described in RFC 5730 [RFC5730]. This mapping, an extension of the domain name mapping described in RFC 5731 [RFC5731], is specified using the Extensible Markup Language (XML) 1.0 [W3C.REC-xml-20001006] and XML Schema notation ([W3C.REC-xmlschema-1-20041028] [W3C.REC-xmlschema-2-20041028]).
The EPP core protocol specification [RFC5730] provides a complete description of EPP command and response structures. A thorough understanding of the base protocol specification is necessary to understand the mapping described in this document. Familiarity with the Domain Name System (DNS) described in RFC 1034 [RFC1034] and RFC 1035 [RFC1035] and with the DNS DNAME Resource Record type described in RFC 6672 [RFC6672] is required to understand the DNS concepts described in this document.
The EPP mapping described in this document specifies a mechanism for the provisioning and management of domain names in a shared central repository. Today, most registries allow only delegation of domain names to name servers specified in NS resource records. DNAME [RFC6672] allow another type of delegation, which can be useful for instance for the new AS 112 [RFC7535]. Information exchanged via this mapping can be extracted from the repository and used to publish DNAME resource records.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14, RFC 2119 [RFC2119].
In examples, "C:" represents lines sent by a protocol client, and "S:" represents lines returned by a protocol server. "////" is used to note element values that have been shortened to better fit page boundaries. Indentation and white space in examples is provided only to illustrate element relationships and is not a mandatory feature of this protocol.
XML is case sensitive. Unless stated otherwise, XML specifications and examples provided in this document MUST be interpreted in the character case presented in order to develop a conforming implementation.
dnameDeleg-1.0 is used as an abbreviation for urn:ietf:params:xml:ns:dnameDeleg-1.0.
This extension adds additional elements to the EPP domain name mapping [RFC5731]. Only those new elements are described here.
DNAME information is published by a DNS server to indicate that a child zone is actually an alias of another zone. A DNAME resource record (RR) contains a single field named target. See RFC 6672 [RFC6672] for the specific field format.
It is the server policy to allow DNAME delegations or not. It is also the server policy to allow (or not) a domain to switch between these two types of delegation with a EPP <update>.
The interface relies on the use of the <dnameDeleg:dnameTarget> element for creates, adds, removes, and <domain:info> responses. The data is provided by the client. The server operator MAY issue out-of-band DNS queries to check if the target really exists.
The <dnameDeleg:dnameTarget> element contains a domain name, as described in Section 2.1 of RFC 6672 [RFC6672]. The value of the <dnameDeleg:dnameTarget> element is represented as a string [W3C.REC-xmlschema-2-20041028].
Example use of the dnameDeleg:dnameTarget, for instance for an EPP <create>:
<dnameDeleg:dnameTarget>foo.bar.example</dnameDeleg:dnameTarget>
A detailed description of the EPP syntax and semantics can be found in the EPP core protocol specification [RFC5730]. The command mappings described here are specifically for use in provisioning and managing DNAME delegations via EPP.
EPP provides three commands to retrieve object information: <check> to determine if an object is known to the server, <info> to retrieve detailed information associated with an object, and <transfer> to retrieve object transfer status information.
This extension does not add any elements to the EPP <check> command or <check> response described in the EPP domain mapping [RFC5731]. Note that an EPP client cannot use <check> to find out if a server authorizes DNAME delegation for this domain. TODO see issue #3 to discuss it.
This extension does not add any elements to the EPP <info> command described in the EPP domain mapping [RFC5731]. However, additional elements are defined for the <info> response.
When an <info> command has been processed successfully, the EPP <resData> element MUST contain child elements as described in the EPP domain mapping [RFC5731]. In addition, the EPP <extension> element SHOULD contain a child <dnameDeleg:dnameTarget> element that identifies the extension namespace if the domain object has data associated with this extension and based on server policy. The <dnameDeleg:dnameTarget> element contains a domain name as its value. A server MUST NOT return both a <dnameDeleg:dnameTarget> and a <domain:ns> ([RFC5731], section 3.1.2).
Example <info> Response S:<?xml version="1.0" encoding="UTF-8" standalone="no"?> S:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0" S: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> S: <response> S: <result code="1000"> S: <msg>Command completed successfully</msg> S: </result> S: <resData> S: <domain:infData S: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"> S: <domain:name>example.com</domain:name> S: <domain:roid>EXAMPLE1-REP</domain:roid> S: <domain:status s="ok"/> S: <domain:registrant>jd1234</domain:registrant> S: <domain:contact type="admin">sh8013</domain:contact> S: <domain:contact type="tech">sh8013</domain:contact> S: <domain:clID>ClientX</domain:clID> S: <domain:crID>ClientY</domain:crID> S: <domain:crDate>1999-04-03T22:00:00.0Z</domain:crDate> S: <domain:upID>ClientX</domain:upID> S: <domain:upDate>1999-12-03T09:00:00.0Z</domain:upDate> S: <domain:exDate>2005-04-03T22:00:00.0Z</domain:exDate> S: <domain:trDate>2000-04-08T09:00:00.0Z</domain:trDate> S: <domain:authInfo> S: <domain:pw>2fooBAR</domain:pw> S: </domain:authInfo> S: </domain:infData> S: </resData> S: <extension> S: <dnameDeleg:dnameTarget xmlns:dnameDeleg="urn:ietf:params:xml:ns:dnameDeleg-1.0"> S: foo.bar.example S: </dnameDeleg:dnameTarget> S: </extension> S: <trID> S: <clTRID>ABC-12345</clTRID> S: <svTRID>54322-XYZ</svTRID> S: </trID> S: </response> S:</epp>
An EPP error response MUST be returned if an <info> command cannot be processed for any reason.
This extension does not add any elements to the EPP <transfer> command or <transfer> response described in the EPP domain mapping [RFC5731]. A domain cannot be switched from NS delegation to DNAME delegation (or vice-versa) through a transfer.
EPP provides five commands to transform objects: <create> to create an instance of an object, <delete> to delete an instance of an object, <renew> to extend the validity period of an object, <transfer> to manage object sponsorship changes, and <update> to change information associated with an object.
This extension defines an additional element for the EPP <create> command described in the EPP domain mapping [RFC5731]. No additional elements are defined for the EPP <create> response.
The EPP <create> command provides a transform operation that allows a client to create a domain object. In addition to the EPP command elements described in the EPP domain mapping [RFC5731], the command MUST contain an <extension> element, and the <extension> element MUST contain a child <dnameDeleg:dnameTarget> element that identifies the extension namespace if the client wants to associate data defined in this extension to the domain object. The <dnameDeleg:dnameTarget> has a domain name as value. A client MUST NOT send both a <dnameDeleg:dnameTarget> and <domain:ns> elements. TODO See issue #4 for the error code.
Example <create> Command: C:<?xml version="1.0" encoding="UTF-8" standalone="no"?> C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0" C: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> C: <command> C: <create> C: <domain:create C: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"> C: <domain:name>example.com</domain:name> C: <domain:period unit="y">2</domain:period> C: <domain:registrant>jd1234</domain:registrant> C: <domain:contact type="admin">sh8013</domain:contact> C: <domain:contact type="tech">sh8013</domain:contact> C: <domain:authInfo> C: <domain:pw>2fooBAR</domain:pw> C: </domain:authInfo> C: </domain:create> C: </create> C: <extension> C: <dnameDeleg:dnameTarget xmlns:dnameDeleg="urn:ietf:params:xml:ns:dnameDeleg-1.0">foo.bar.example</dnameDeleg:dnameTarget> C: </extension> C: <clTRID>ABC-12345</clTRID> C: </command> C:</epp>
When a <create> command has been processed successfully, the EPP response is as described in the EPP domain mapping [RFC5731].
This extension does not add any elements to the EPP <delete> command or <delete> response described in the EPP domain mapping [RFC5731].
This extension does not add any elements to the EPP <renew> command or <renew> response described in the EPP domain mapping [RFC5731].
This extension does not add any elements to the EPP <transfer> command or <transfer> response described in the EPP domain mapping [RFC5731].
This extension defines additional elements for the EPP <update> command described in the EPP domain mapping [RFC5731]. No additional elements are defined for the EPP <update> response.
The EPP <update> command provides a transform operation that allows a client to modify the attributes of a domain object. In addition to the EPP command elements described in the EPP domain mapping, the command MUST contain an <extension> element, and the <extension> element MUST contain a child <dnameDeleg:dnameTarget> element that identifies the extension namespace if the client wants to update the domain object with data defined in this extension. The <dnameDeleg:dnameTarget> element has a domain name as its value. If present, it updates the DNAME delegation to the new target, if the domain was already DNAME-delegated, or it switches the domain to a DNAME delegation, if it was previously a NS delegation. A server MAY refuse such a switch, per its policy. In the same way, a RFC 5731 [RFC5731] update with NS information, without the extension decribed here, switches to NS delegation if the domain was previously DNAME-delegated.
Example <update> Command, Adding and Removing: C:<?xml version="1.0" encoding="UTF-8" standalone="no"?> C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0" C: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> C: <command> C: <update> C: <domain:update C: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"> C: <domain:name>example.com</domain:name> C: </domain:update> C: </update> C: <extension> C: <dnameDeleg:dnameTarget xmlns:dnameDeleg="urn:ietf:params:xml:ns:dnameDeleg-1.0">foo.bar.example C: </dnameDeleg:dnameTarget> C: </extension> C: <clTRID>ABC-12345</clTRID> C: </command> C:</epp>
When an extended <update> command has been processed successfully, the EPP response is as described in the EPP domain mapping [RFC5731].
An EPP object mapping is specified in XML Schema notation. The formal syntax presented here is a complete schema representation of the object mapping suitable for automated validation of EPP XML instances. The BEGIN and END tags are not part of the schema; they are used to note the beginning and ending of the schema for URI registration purposes.
BEGIN
<?xml version="1.0" encoding="utf-8"?>
<schema
targetNamespace="urn:ietf:params:xml:ns:dnameDeleg-1.0"
xmlns:dnameDeleg="urn:ietf:params:xml:ns:dnameDeleg-1.0"
xmlns="http://www.w3.org/2001/XMLSchema"
elementFormDefault="qualified">
<annotation>
<documentation>
Extensible Provisioning Protocol v1.0
domain name extension schema
for provisioning DNAME domain names.
</documentation>
</annotation>
<!--
Child element found in EPP commands and response.
-->
<element name="dnameTarget" type="string"/>
</schema>
END
EPP is represented in XML, which provides native support for encoding information using the Unicode character set and its more compact representations including UTF-8 [RFC3629]. Conformant XML processors recognize both UTF-8 and UTF-16 [RFC2781]. Though XML includes provisions to identify and use other character encodings through use of an "encoding" attribute in an <?xml?> declaration, use of UTF-8 is RECOMMENDED in environments where parser encoding support incompatibility exists.
As an extension of the EPP domain mapping [RFC5731], the internationalization requirements in the EPP domain mapping [RFC5731] are followed by this extension. This extension does not override any of the EPP domain mapping [RFC5731] internationalization features.
This document uses URNs to describe XML namespaces and XML schemas conforming to a registry mechanism described in RFC 3688 [RFC3688]. Two URI assignments have been completed by the IANA.
Registration request for the extension namespace:
URI: urn:ietf:params:xml:ns:dnameDeleg-1.0
Registrant Contact: IESG
XML: None. Namespace URIs do not represent an XML specification.
Registration request for the extension XML schema:
URI: urn:ietf:params:xml:schema:dnameDeleg-1.0
Registrant Contact: IESG
XML: See the "Formal Syntax" section of this document.
The mapping extensions described in this document do not provide any security services beyond those described by EPP [RFC5730], the EPP domain name mapping [RFC5731], and protocol layers used by EPP. The security considerations described in these other specifications apply to this specification as well.
As with other domain object transforms, the EPP transform operations described in this document MUST be restricted to the sponsoring client as authenticated using the mechanisms described in Sections 2.9.1.1 and 7 of RFC 5730 [RFC5730]. Any attempt to perform a transform operation on a domain object by any client other than the sponsoring client MUST be rejected with an appropriate EPP authorization error.
The provisioning service described in this document involves the exchange of information that can have an operational impact on the DNS. A trust relationship MUST exist between the EPP client and server, and provisioning of DNAME delegation MUST only be done after the identities of both parties have been confirmed using a strong authentication mechanism.
An EPP client might be acting as an agent for a zone administrator who wants to send DNAME delegation information to be published by the server operator. Man-in-the-middle attacks are thus possible as a result of direct client activity or inadvertent client data manipulation.
Most of the text has been copied from [RFC5910], so thanks to its authors.
| [RFC2119] | Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997. |
| [RFC3688] | Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688, DOI 10.17487/RFC3688, January 2004. |
| [RFC5730] | Hollenbeck, S., "Extensible Provisioning Protocol (EPP)", STD 69, RFC 5730, DOI 10.17487/RFC5730, August 2009. |
| [RFC5731] | Hollenbeck, S., "Extensible Provisioning Protocol (EPP) Domain Name Mapping", STD 69, RFC 5731, DOI 10.17487/RFC5731, August 2009. |
| [RFC6672] | Rose, S. and W. Wijngaards, "DNAME Redirection in the DNS", RFC 6672, DOI 10.17487/RFC6672, June 2012. |
| [W3C.REC-xml-20001006] | Bray, T., Paoli, J., Sperberg-McQueen, M. and E. Maler, "Extensible Markup Language (XML) 1.0 (Second Edition)", World Wide Web Consortium Recommendation REC-xml-20001006, October 2000. |
| [W3C.REC-xmlschema-1-20041028] | Thompson, H., Beech, D., Maloney, M. and N. Mendelsohn, "XML Schema Part 1: Structures Second Edition", World Wide Web Consortium Recommendation REC-xmlschema-1-20041028, October 2004. |
| [W3C.REC-xmlschema-2-20041028] | Biron, P. and A. Malhotra, "XML Schema Part 2: Datatypes Second Edition", World Wide Web Consortium Recommendation REC-xmlschema-2-20041028, October 2004. |
| [RFC1034] | Mockapetris, P., "Domain names - concepts and facilities", STD 13, RFC 1034, DOI 10.17487/RFC1034, November 1987. |
| [RFC1035] | Mockapetris, P., "Domain names - implementation and specification", STD 13, RFC 1035, DOI 10.17487/RFC1035, November 1987. |
| [RFC2781] | Hoffman, P. and F. Yergeau, "UTF-16, an encoding of ISO 10646", RFC 2781, DOI 10.17487/RFC2781, February 2000. |
| [RFC3629] | Yergeau, F., "UTF-8, a transformation format of ISO 10646", STD 63, RFC 3629, DOI 10.17487/RFC3629, November 2003. |
| [RFC5910] | Gould, J. and S. Hollenbeck, "Domain Name System (DNS) Security Extensions Mapping for the Extensible Provisioning Protocol (EPP)", RFC 5910, DOI 10.17487/RFC5910, May 2010. |
| [RFC7535] | Abley, J., Dickson, B., Kumari, W. and G. Michaelson, "AS112 Redirection Using DNAME", RFC 7535, DOI 10.17487/RFC7535, May 2015. |