Re: [Add] Mozilla's DoH resolver policy

[Ben Schwartz <[e-mail]>]

On Tue, Apr 16, 2019 at 12:00 PM Livingood, Jason <
[e-mail]> wrote:

> And for ease of any replies, I have a separate question on CDN
> localization via ECS. The 6th privacy requirement suggests that ECS cannot
> be used unless there is encryption between the resolver and the
> authoritative server, presumably via DoT. This suggests that the privacy
> concern isn't that the network/geographic hint provided by ECS is
> problematic in and of itself, but that it should not be observable along
> the network path used in recursion.
>
> But if TRR-to-auth recursion is not available via DoT, I wonder what the
> recommended mechanism is for providing a more privacy-protective
> network-geographic hint to an authoritative server, in order for example
> for a CDN to dynamically respond with a localized response. Maybe something
> new needs to be standardized? What options do folks suggest?
>

The "exit IP" of a widely-distributed large-scale resolver service is such
a network-geographic hint, with the level of granularity (and privacy)
depending on the scale and architecture of the resolver service.

I think the question of whether we can improve on ECS is interesting, but I
would encourage you to follow up in DPRIVE or DNSOP, rather than this ADD
list, since that question is equally relevant regardless of whether the
query is originated by an application.

Thanks
> Jason
>
> --
> Add mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/add
>