Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators

[Vittorio Bertola <[e-mail]>]

>     Il 21/07/2020 02:43 Eric Rescorla <[e-mail]> ha scritto:
> 
> 
>     So the idea here would be to have a mechanism which enabled Do[TH] but
>     bypassed the CPE, correct? So, it would be something that one deployed
>     at the ISP's recursive and that we just expected the CPE to pass on?
>     It seems like the primary requirement there would be for something which
>     had a very high chance of passing through existing CPE.
> 
> 
>     With that said, I have some concerns about the objective of having the
>     CPE in the user's resolution path.
> 
I just want to note that the mechanism described in the draft I recently posted ( https://datatracker.ietf.org/doc/draft-cook-doh-discovery-trial/?include_text=1 ) only goes through the CPE via Do53 in the discovery phase, then the DoH TLS connection bypasses the CPE and goes directly to the main resolver.

For ISPs and vendors that do filtering and other DNS-based services on the main recursor platform, this would be enough to let the current functionalities continue working.

Also - to a point by Kenji - you can't do that by picking from a finite set of preconfigured filtering options, e.g. "http://family-safe-strict.doh.isp.net ,http://family-safe.doh.isp.net ,http://doh.isp.net ", because current solutions offer complete control to end-users over the filtering configuration for each single device, even to the level of blocking or allowing individual domains if they like. There are people using filtering for purposes unrelated to parental control, for example SMBs blocking access to social media from the office during working hours.

--

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[e-mail] mailto:[e-mail] 
Office @ Via Treviso 12, 10144 Torino, Italy