Re: [Add] questions about the Examples section of svcb-dns-02

[Peter van Dijk <[e-mail]>]

Hi Ben,

thanks for that. Sadly, I still needed help from two other people to
understand how DoT over 853 came out of this set. (One of them
commented on your commit too.)

(For those reading along still confused, it's this bit:

        SVCB 1 @ alpn=h2,h3 dohpath=/dns-query{?dns}

Because it does not say 'no-default-alpn', it actually means
'alpn=dot,h2,h3' where the dot bit ignores the dohpath.)

I think this could be even more explicit in the draft (I'm happy to
think about some words for that) but I really wonder if the space
savings are worth the confusion at all.

On Wed, 2021-04-07 at 20:36 -0400, Ben Schwartz wrote:
> Thanks for the questions!  I've adjusted the text [1] to make the examples clearer.
> 
> DoT is the "default ALPN" in this draft, so unless it is explicitly removed (by no-default-alpn), it is present, and uses port 853 unless "port-..." is specified.  This is good for compactness but can be surprising, which is why I used that example.
> 
> I removed the "echconfig" from the examples, as that is not the focus of this draft (and isn't even mentioned in the text).
> 
> [1] https://github.com/bemasc/svcb-dns/commit/f61c70ed02b550613fdbb37d3171ab1e6d359e2c
> 
> On Wed, Apr 7, 2021 at 4:32 PM Peter van Dijk <[e-mail]> wrote:
> > Hello Ben, and rest of WG,
> > 
> > https://tools.ietf.org/html/draft-schwartz-svcb-dns-02#section-8 has an
> > example RRset for a resolver, containing 3 SVCB RRs. This example is
> > very useful!
> > 
> > However, I have a few questions/comments about it:
> > 
> > (1) Can you reorder the bullet list to match the order in the RRset?
> > (i.e. put the TLS one second)
> > 
> > (2) I see one SVCB record (with priority 2) advertising a DoT server
> > (by leaving out the ALPN). It has port=8530. Yet, the text above says
> > there's DoT on 853 and 8530. Where does 853 come into play, if the
> > prio=2 SVCB record says port=8530?
> > 
> > (3) All three example RRs have an echconfig parameter. While I
> > understand it makes sense for an operator to be consistent in doing ECH
> > over all their offerings, it somewhat looks like everybody is expected
> > to do echconfig - perhaps it would be clearer to not have echconfig on
> > all three? Then, maybe clarify that it would in fact be better to have
> > it always, but say that the svcb-dns protocol does not demand it.
> > 
> > 
> > For (2) it's entirely possible I'm missing something - please let me
> > know. Thanks!
> > 

Kind regards,
-- 
Peter van Dijk
PowerDNS.COM BV - https://www.powerdns.com/