Should someone who proves control of a delegated subdomain be allowed to claim it under a domain another member holds #43

New Issue

2026-09-21T07:18:13Z

cgalo5758 commented

2026-09-21 07:18:13 +00:00

The question

A live claim owns its whole DNS subtree, and the rule is the same for both kinds of claim. For names carved under the operator's shared domain that is right and necessary: members hold no DNS authority there, so the registry is the only thing that can make "your subtree is yours" true. For bring-your-own domains it may be too strict. If one member holds fruits.example.org and a friend holds the delegated subzone apricot.fruits.example.org, the friend can prove control of their name by publishing a DNS record, exactly because the parent delegated it, and the parent can revoke that at the nameserver at any time. DNS already arbitrates. Today the console refuses the child's claim because the parent claimed first, with a generic "unavailable" that explains nothing.

What depends on the answer

Whether two people who can each prove control of what they hold can both use the console, and whether the registry keeps one uniform rule or a kind-aware one.

Options known so far

Keep one rule: a live claim's subtree is exclusive whatever its kind.
Allow a bring-your-own claim to nest inside another live bring-your-own claim when the claimant proves the nested name; keep exclusivity absolute for carved names. Serving already binds a name to the deepest live claim containing it, so only the disjointness check and the re-check on a parent verifying after its child would change.

This touches the same invariant as the open question of whether an unverified claim should reserve its whole subtree or only its root, so the two are decided together.

Decided when

The domains model states the rule per claim kind and the refusal message a nested claimant sees.

Migrated from status/issues.md at b7a0e15

## The question A live claim owns its whole DNS subtree, and the rule is the same for both kinds of claim. For names carved under the operator's shared domain that is right and necessary: members hold no DNS authority there, so the registry is the only thing that can make "your subtree is yours" true. For bring-your-own domains it may be too strict. If one member holds `fruits.example.org` and a friend holds the delegated subzone `apricot.fruits.example.org`, the friend can prove control of their name by publishing a DNS record, exactly because the parent delegated it, and the parent can revoke that at the nameserver at any time. DNS already arbitrates. Today the console refuses the child's claim because the parent claimed first, with a generic "unavailable" that explains nothing. ## What depends on the answer Whether two people who can each prove control of what they hold can both use the console, and whether the registry keeps one uniform rule or a kind-aware one. ## Options known so far - Keep one rule: a live claim's subtree is exclusive whatever its kind. - Allow a bring-your-own claim to nest inside another live bring-your-own claim when the claimant proves the nested name; keep exclusivity absolute for carved names. Serving already binds a name to the deepest live claim containing it, so only the disjointness check and the re-check on a parent verifying after its child would change. This touches the same invariant as the open question of whether an unverified claim should reserve its whole subtree or only its root, so the two are decided together. ## Decided when The domains model states the rule per claim kind and the refusal message a nested claimant sees. Migrated from status/issues.md at b7a0e15

cgalo5758 added the

kind

design

area/domains labels 2026-09-21 07:18:13 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: wiki-cafe/member-console#43