Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt

[Ted Lemon <[e-mail]>]

On Jul 28, 2020, at 9:49 AM, Stephane Bortzmeyer <[e-mail]> wrote:
> We already have it, it seems, with draft-ietf-dnsop-extended-error,
> which is approved and in the RFC Editor queue (state RFC-EDITOR).

This works if the DoH server that sends the error response is the intended server. However, it doesn’t work when the network is blocking the connection to an off-network DoH server. For that I think you need a TLS alert.

On Jul 28, 2020, at 10:02 AM, Vittorio Bertola <[e-mail]> wrote:
> 
> What is still missing is a standard way for the resolver to communicate a URL to the client in the response, so that the client (if it wants) can use it to retrieve and display a human-readable error message.

That would be an attack surface—now I can intercept your connection and send you to a malware URL (or snooping URL, or whatever). And again would only work if the DoH server sending the response is the one with which the device connecting to it intended to communicate.