Re: [Add] fixing coffee shop brokenness with DoH

[Normen Kowalewski <[e-mail]>]

Hi Joe,

i am not surprised; I have seen many configs / resolv.conf contain dual “own policy rDNS” plus an extra one being public.

Basically, own rDNS preferred, since its local and fastest especially if the namespace i rather limited, and its hopefully also most secured from admin perspective,
but in case own is for some reason screwed, you will use public as the second best choice. 
So in this case, folks accept to relinquish local policies (and the privacy aspect of terminating their queries on a server whose policy they know and accept), in exchange for still being able to at least get to the internet.

I personally believe its wrong to blindly configure stuff like that, because i that policy is in many cases pretty important, ah, well… .

@Paul, can you possibly help me to understand some stats on this that your likely quite familiar with:  
i am looking at slide 6 of the IETF 104 presented measurement here: https://datatracker.ietf.org/meeting/104/materials/slides-104-maprg-dns-observatory-monitoring-global-dns-for-performance-and-security-pawel-foremski-and-oliver-gasser-01 

Is that that is all dns as a whole i guess (IIUC this is a mix of large providers of Authoritative DNS, and large public rDNS)
How would this diagram change if zooming in purely on customer rDNS use? 

BR, Normen  


> On 25. Jul 2019, at 10:49, Joe Abley <[e-mail]> wrote:
> 
> On Jul 24, 2019, at 20:10, Eric Rescorla <[e-mail]> wrote:
> 
>> This also seems like an edge case. The vast majority of clients do not have two independently controlled resolvers..
> 
> Some experiments by APNIC Labs demonstrate a significant population of
> stub resolvers that have google public DNS configured as one of
> multiple independently-operated resolvers. It was more common than I
> was expecting.
> 
> I don't know of any experiments that test the general case (I don't
> *think* APNIC's experiment did, and maybe Google is special), but it
> may make sense to support your statement above with data if it turns
> out to be an important assumption.
> 
> 
> Joe
> 
> -- 
> Add mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/add