Re: [Add] What to do in this potential working group

[David Conrad <[e-mail]>]

Ted,

Not Jari, but wanted to point out one thing:

On Aug 21, 2019, at 10:36 AM, Ted Hardie <[e-mail]> wrote:
> The second threat model is that a resolver may provide an untrustworthy answer (e.g. captive portal). The use of DoT and DoH can help with this if the client device, application, or user selects a trustworthy resolver** and uses the TLS certificate to verify they have reached that service.


You probably need to define “trustworthy answer” here.  Traditionally, a “trustworthy answer” was the data originally supplied by the zone owner of the domain being looked up. DNSSEC was created to ensure this. However, network operators (e.g., CDNs) playing “stupid DNS tricks”, resolver operators providing filtering, etc. may have changed what is a “trustworthy answer” over the years.

With that said, and assuming you’re using the traditional interpretation of “trustworthy answer”, then DoT/DoH do not ensure a “trustworthy answer.” DoT/DoH provide transport protection. The only way to truly ensure a trustworthy answer is to protect the actual answer. Which is what DNSSEC does.

Regards,
-drc
(Speaking only for myself)