Re: [Add] Mozilla's DoH resolver policy

["Ralf Weber" <[e-mail]>]

Moin!

On 11 Apr 2019, at 11:49, Daniel Stenberg wrote:

> On Thu, 11 Apr 2019, Ralf Weber wrote:
>
>>> To prevent disruptions to the user's browsing.
>> Again why do you think it will get better asking unencrypted? It is a 
>> nice
>> way to find out if someone is using DoH though ;-).
>
> How about not discussing application specific design decisions?
Isn’t that the topic of the mailing list (Applications Doing DNS)?

> I don't think anyone suggests it is better to ask unencryped, but when 
> the DoH server you have configured slowly dies or get DoS'ed or 
> whatever, users will appreciate a "way out". In this specific 
> application being discussed, it has a soft-fail mode that works like 
> this.
Yes and me being a user of that application (though not that function) 
thinks that this is bad. I found it odd that most DoH configurations 
I’ve seen by now are singular in what they give as a target, while 
most OS libraries allow multiple DNS server addresses and fail between 
them. Why are you not doing that with DoH?

The first time I saw more than one DoH server used for configuration was 
in draft-ietf-doh-resolver-associated-doh  ( 
https://datatracker.ietf.org/doc/draft-ietf-doh-resolver-associated-doh/ 
) and I think that this is good.

So long
-Ralf
—--
Ralf Weber