Re: [Add] Mozilla's DoH resolver policy

[Peter Saint-Andre <[e-mail]>]

On 4/11/19 3:08 AM, Vittorio Bertola wrote:
>> Il 11 aprile 2019 alle 10.59 Ralf Weber <[e-mail]> ha scritto:
>>
>> So why not make DNSSEC validation in the resolver a requirement? It 
>> doesn’t interfere with local policy and offers significant benefits 
>> for the user. Validation in the client would be nicer, but requiring it 
>> in the resolver is a good first step.
> 
> More generally, while I understand Mozilla's desire to ensure certain standards to their users, I think it would be better to have a broader definition of what a "good resolver" is, both in terms of scope (not just privacy, but DNSSEC etc), in terms of consensus (and the effort is already ongoing in DPRIVE) and in terms of compliance: I don't know Mozilla's plans for auditing their trusted resolvers (are there any?), but it would make more sense to have an independent industry effort that certifies resolvers, rather than having each of them go through multiple accreditation processes for multiple applications, which would raise entry barriers for public resolvers and, again, promote centralization. 

We (Mozilla) do not want to encourage centralization, which is why we
have published criteria for becoming a trusted recursive resolver within
Firefox. In our conversations with various stakeholders, we have seen a
desire for the kind of industry-wide effort you mention. Although it's
too early to say whether something like that will come together, we are
very much open to discussions exploring that direction.

Peter