Re: [Add] Mozilla's DoH resolver policy

[Paul Wouters <[e-mail]>]

On Wed, 10 Apr 2019, Martin Thomson wrote:

> We don't believe that DNSSEC is essential to our primary goals, which are improving privacy of browsing activity.

But I assume it is also not your goal to reduce security for those who
chose mozilla products? You are offering your users a DNS system
override, yet you seem to find it acceptable if that results in a less
secure but more private DNS server being used. That is concerning.

> As a browser, we can't condition our behaviour on whether DNSSEC was present and valid for a variety of reasons (some of which we might discuss separately)

You can but you won't. But I agree there is no need to discuss that
here.

> but we do value resolvers that perform DNSSEC validation.

But you won't value it enough to make it a requirement, even though it
is a core part of the specification of DNS? Again, if you are
reconfiguring a system resource within the application, at the very
least do not reduce security. Requiring DNSSEC validation is a
no-brainer. Those who do not desire such security already can not use
DNSSEC by not sending the DO bit in the query, as you already not do
yourself in the mozilla products. But at this point, you would be
reducing my security and i will have to disable your privacy feature.

> Requiring query minimization is in keeping with the privacy goal,

Don't make this security versus privacy. Enhance privacy without paying
with security.

> whereas DNSSEC requirements would expand the scope more than we were comfortable with.

I understand your discomfort of still not supporting core fundamental
security technologies that prevent DNS spoofing. It should make you
even more uncomfortable that you are redirecting people to other DNS
servers that might actively support DNS spoofing. Having a policy where
you do not want servers to use RPZ DNS filtering, but not require them
to support the DNS protocol parts that can prove they are not
maliciously modifying DNS, is a policy mistake.

Paul