Ballot SC-091: Sunset 3.2.2.5.3 Reverse Address Lookup Validation, proposal of new DNS-based validation using Persistent DCV TXT Record for IP addresses

Outcome

• SC-091 received 24 YES, 0 NO, and 0 ABSTAIN votes from Certificate Issuers, and 2 YES, 0 NO, and 0 ABSTAIN votes from Certificate Consumers.
• The ballot page states that all adoption requirements in Bylaw 2.3(6) were met and quorum under Bylaw 2.3(7) was met.
• The ballot page includes a 30-day IPR review period running from 2025-11-14 to 2025-12-14.
• The supplied evidence does not state that any exclusion notice was filed.

What the ballot does

• Modifies the Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates, based on Version 2.7.1 as stated on the ballot page.
• Sunsets Section 3.2.2.5.3 Reverse Address Lookup.
• Introduces Section 3.2.2.5.8 DNS TXT Record with Persistent Value in the Reverse Namespace as a replacement validation method for IP addresses.
• Adds a definition for Reverse Zone Domain Name.
• Adds a relevant date entry stating that on 2027-03-15 CAs must not rely on Method 3.2.2.5.3 to issue Subscriber Certificates.
• Adds text to Section 3.2.2.5.3 stating that effective 2027-03-15 the CA must not rely on this method and prior validations and validation data gathered using this method must not be used to issue Subscriber Certificates.
• Adds Section 3.2.2.5.8 describing validation of an IP address by converting the IP address to a Reverse Zone Domain Name and verifying a Persistent DCV TXT Record at the _ip-validation-persist label prepended to that reverse zone name.

Stated rationale

• The ballot says Reverse Address Lookup has been recognized as insecure because it relies on PTR records and indirect validation of domains instead of IP addresses.
• The ballot says stale PTR records and crossover risk are primary security concerns with the existing method.
• The ballot says the new method limits validation to direct DNS TXT queries in the .arpa zone associated with an IP address and requires an account-bound credential in the TXT record.
• The ballot says the new method is intended to provide a more direct proof of control over the IP address-associated reverse namespace and reduce the attack surface.

Compliance timing

• The ballot lists implementation of Section 3.2.2.5.8 as effective immediately.
• The ballot lists sunset of Method 3.2.2.5.3 as effective 2027-03-15.
• The redline states that effective 2027-03-15 the CA must not rely on Section 3.2.2.5.3 and must not use prior validations or validation data gathered under that method to issue Subscriber Certificates.