Re: [Add] data integrity and DNSSEC or DoH/DoT

[Stephen Farrell <[e-mail]>]

Hiya,

I agree with the overall thrust of your mail that a fair
analysis of the efficacy of the DNS data integrity services
provided by DoT/DoH vs. what's provided by DNSSEC, in the
real DNS... is complex.

I would quibble with a bunch of things you said but it's
probably better I try resist the temptation, so I'll limit
myself to one, for illustration - I'm not at all trying
to claim this is "the important bit" you missed, just
emphasising the subtlety here:

On 22/08/2019 04:31, Brian Dickson wrote:
> A risk analysis of DNS vs tampering would show the place to attack
> DNS is not on the client side, but rather on the authority side.
Some attackers don't want to be easily noticed, and for
them, it can be better if they tamper more locally.

Again, I'm not disagreeing with your overall message but
rather agreeing about the complexity here. I think a
consequence that follows from that is that anyone making
claims that there is one simple difference between use of
DoH/DoT and DNSSEC is mistaken, and further that it doesn't
really make sense to say one is "better" than the other,
when it comes to providing data integrity.

Personally, when it comes to data integrity of both forms,
I want both and more of both, and I think that is a pretty
defensible conclusion.

Note: the conclusion above only considers data integrity
services. It does not ask anyone to reach a conclusion
about how DoT/DoH might lead to over-concentration of
queries.

Cheers,
S.