[Add] point of deploying DoH in access network (Re: meeting hum: should the IETF take up this work?)

[神明達哉 <[e-mail]>]

At Wed, 24 Jul 2019 13:15:49 -0400,
Stephane Bortzmeyer <[e-mail]> wrote:

> > I’m also trying to understand why there seems to be resistance to
> > providing ISPs with advice on deploying DoH.
>
> I'm tempted to say that I don't see the point for an access network to
> deploy DoH. If the network is safe, DoH is not really necessary
> (paranoid may use DoT, since the access network can ensure that port
> 853 is clear). If it is not, for instance because the resolver
> modifies the answers, then users will want to bypass it, anyway.
>
> My guess is that DoH operators will be different from access network
> operators.

I've been wondering about this, too.  Although DoH has some other
(potentially) cool features like "push", my understanding is that its
primary and much more important purpose is to hide DNS resolution
attempts in a normal HTTPS connection that is also used for normal,
popular web services.  And (again in my understanding) the point here
is to make it very hard and mostly impossible for an intermediate
player to even block the resolution (because such a player can't do
this without also blocking the "popular web service", which such a
player is assumed to not want/afford to do).  I don't see why a
resolver in "an access network" needs this capability.  Could someone
enlighten me about what I'm missing?

--
JINMEI, Tatuya