Ballot SC070: Clarify the use of DTPs for Domain Control Validation

Ballot outcome

• The ballot is considered to have FAILED, with the resolution decided at F2F#64.

Purpose and scope

• Clarify existing language on the use of delegated third parties during domain and IP address control validation.
• Leaves existing language in place and adds specifics for DNS queries, WHOIS lookups, and contact with the Domain Name Registrar or IP Address Registration Authority.
• Adds the same restrictions to CAA checking.

Key requirement changes (as described in the ballot materials)

• CAA DNS queries MUST NOT be delegated to third parties, with an effective date of 2024-05-15.
• The CA MAY delegate performance of Section 3.2 initial identity validation requirements to a Delegated Third Party, except for:
  • Section 3.2.2.4 validation of domain authorization or control
  • Section 3.2.2.5 authentication for an IP address
  • (effective 2024-05-15) Section 3.2.2.8 CAA records
• All DNS queries used to satisfy Section 3.2.2.4, Section 3.2.2.5, and (effective 2024-05-15) Section 3.2.2.8 MUST be made from the CA to authoritative nameservers, without the use of recursive resolvers operated outside the CA audit scope.
• Contact information for Domain Contacts MUST come from the WHOIS record, a DNS SOA record, or direct contact with the Domain Name Registrar of the Base Domain Name, and MUST be obtained directly by the CA, without the use of third-party services operated outside the CA audit scope.
• Contact information for IP Address Contacts MUST be obtained through direct contact with the IP Address Registration Authority, without the use of third-party services operated outside the CA audit scope.

Review and voting process dates (from the ballot page)

• Review period start: 23 February 2024 at 18:00 Eastern Time
• Review period end: 23 March 2024 at 18:00 Eastern Time
• Discussion dates shown on the page: 2024-02-02 to 2024-02-12
• Expected vote for approval dates shown on the page: 2024-02-12 to 2024-02-19