Re: [Add] Why so complex? (was Re: some background on split DNS with DNSSEC)

[Ben Schwartz <[e-mail]>]

On Tue, Nov 9, 2021 at 10:26 AM Martin Thomson <[e-mail]> wrote:
...

> The whole thing with checking a public resolver is all in aid of something
> about ensuring that the network resolver is authoritative in some way for
> the names that the PvD claims should point to it.  But this all assumes
> greater and greater trust in the PvD and - by extension - the network.


I don't understand.  The whole point of this is that it _reduces_ trust in
the PvD, by declaring that the client ignores the PvD's instructions unless
it can prove that this is what the owner of the affected domain actually
wants.

If this were a company-mandated policy, why could that policy take the form
> of a resolver identity and a list of names for which that resolver is used
> over all others?


In a company-mandated setting, this is all moot.  The company owns the
device and can configure it precisely how they want, which is probably to
use their own resolver for everything.  I haven't seen demand for complex
client behavior expressions in that context.

I have a lot of issues with the flavortext in this draft, but the core idea
seems potentially valuable.  I would call it "secure resolution hints", a
secure way to prefill DNS resolver caches with nearby authoritative servers
for selected domains.