Re: [Add] draft-ietf-add-resolver-info-09

[Steffen Nurpmeso <[e-mail]>]

tirumal reddy wrote in
 <[e-mail]>:
 |On Thu, 15 Feb 2024 at 06:02, Mark Andrews <[e-mail]> wrote:
 |> Why is it necessary to change the standard processing of queries for
 |> RESINFO when we already have a signal (AA=1) about whether the answer
 |> is coming from elsewhere or not ?
 |
 |It is introduced to handle a scenario where SUDN is used to discover the
 |encrypted resolver, and if the discovered resolver does not support
 |RESINFO, it will forward the query upstream. An attacker might provide a
 |RESINFO response with AA=1. The proposed mechanism aims to help the client
 |identify whether the response is coming from the discovered encrypted
 |resolver.

By the way i am really not worth being noted for anything
acknowledgeable regarding the work of this WG.  At all.
If you have another iteration of the document, i would prefer if
you would simply scratch my name from your work.
It is solely your work, for sure.
And the above is possibly very smart: my DNS work was two decades
ago, and i could not even tell whether i have ever seen authority
section entries being passed through or not.

My main topics are simplicity so small teams can still exist
competetively as was true over two decades ago (ie, with knowing
the entire picture, not by delegating to "trusted" external
modules in uncounted numbers), when there were <3000 RFCs.

As such i very much appreciated RFC 8499, but i alone from my
superficial out-of-interest reading have 17 DNS-related RFCs
added locally since then, plus the draft of yours and whatever
else from this WG.

And a different way to get the TLS trust (or, rather, use existing
ways of various kind eg rpki, ikev2, or simply public keys as is
done by DKIM (certificates are a bit larger, but with the TCP that
is more and more needed per se, or QUIC; or even the permanent
HTTP proxying of everything, that is "no problem")) away from CA
pools, to DNS/TLS + DNSSEC zone records.  Thank you for that, too!

Ciao, and greetings from Germany,

--steffen
|
|Der Kragenbaer,                The moon bear,
|der holt sich munter           he cheerfully and one by one
|einen nach dem anderen runter  wa.ks himself off
|(By Robert Gernhardt)