Re: [Add] Participation

[Brian Dickson <[e-mail]>]

On Sat, Aug 17, 2019 at 5:39 PM Rob Sayre <[e-mail]> wrote:

> On Sat, Aug 17, 2019 at 2:33 PM Ralf Weber <[e-mail]> wrote:
>
>> As said before DNSSEC and DoH/DoT are complementary and solve different
>> problems.
>>
> [...]

>
>
But I think people are looking for a way to break DoH/DoT, in a
> well-meaning way.
>

I'm not sure if you are counting me in the population of "people", but if
so, you are WAY wrong, or at least mistaken on intent.

I'm looking for ways of breaking involuntary change of DNS resolver choice.
This applies to both managed and unmanaged devices, hosts, virtual hosts,
infrastructure, and those of any partner companies, sister companies,
subsidiaries, outsource companies, or customers.

That the target (ie new choice of) DNS resolver might happen to be doing
DoH is completely irrelevant. What matters is that the resolver is changed,
not the protocol being used.

Incidentally, I am strongly in favor of upgrading all DNS client
connections-to-resolvers in our larger ecosystem, to be DoT.

If it is not possible to convince browsers to do DoT, the alternative may
be in-host proxy services that do DoH to DoT conversion. Those are nearly
trivial to implement.

Mostly choosing DoT over DoH is about not adding any HTTP junk to DNS
resolution on the server side. Our DNS servers do not do HTTP anything. We
want the greatest amount of flexibility in choice of servers, and the
smallest available attack surface.

Adding TLS to a regular DNS server (which is what DoT amounts to) is the
simplest option.

This is the exact opposite of wanting to break DoH/DoT.

Wanting to continue to operate infrastructure for DNS resolution, and
maintain (or add) existing DNS-based toolsets, is a significant driver in
this philosophy.

When you operate DNS infrastructure at scale, and offer DNS services at
scale as well, any attempt by any software vendor to interfere with that,
regardless of motivation or intention, is going to provoke a strong
negative response, and justifiably so.

So, in short, please stop what folks like I am doing, as being
anti-encryption or anti-DoH/DoT, because it isn't.

Brian