Re: [Add] Mozilla's DoH resolver policy

[Vittorio Bertola <[e-mail]>]

> Il 11 aprile 2019 alle 10.59 Ralf Weber <[e-mail]> ha scritto:
>
> So why not make DNSSEC validation in the resolver a requirement? It 
> doesn’t interfere with local policy and offers significant benefits 
> for the user. Validation in the client would be nicer, but requiring it 
> in the resolver is a good first step.

More generally, while I understand Mozilla's desire to ensure certain standards to their users, I think it would be better to have a broader definition of what a "good resolver" is, both in terms of scope (not just privacy, but DNSSEC etc), in terms of consensus (and the effort is already ongoing in DPRIVE) and in terms of compliance: I don't know Mozilla's plans for auditing their trusted resolvers (are there any?), but it would make more sense to have an independent industry effort that certifies resolvers, rather than having each of them go through multiple accreditation processes for multiple applications, which would raise entry barriers for public resolvers and, again, promote centralization. 

(Unless we imagine that the choice of resolvers and their accreditation criteria will be a competitive factor among applications, but that would IMHO pose a number of issues.)

Ciao,
-- 

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[e-mail]
Office @ Via Treviso 12, 10144 Torino, Italy