Re: [Add] What to do in this potential working group

[Ray Bellis <[e-mail]>]

On 21/08/2019 21:41, Stephen Farrell wrote:

> But that wasn't quite what I intended. ISTM clear that having O(1)
> TRRs in the world would be over-concentrated. I think it's maybe
> equally clear that with a different per-LAN recursive (which is
> kinda like today) it'd be extremely hard to authenticate those
> as TRR-like entities - so perhaps O(10^7) is too many TRRs. I do
> think considering "how many TRR-like things would be good" is a
> relevant (research?) question that could affect protocol design
> and implementations and deployments.
> 
> For example, if there's an answer at all and O(100) were that
> answer, that might change how a DoT/DoH client might usefully
> spread it's queries over those vs. if the answer were O(10^4).

There's a possible scaling issue here.

To allow efficient use of CDNs it is necessary for some form of client 
geo-location to occur.   It's already been observed in the Samknows 
report[1] that Cloudflare's lack of support for EDNS-Client-Subnet [2] 
(RFC 7871) leads to suboptimal performance when accessing non-CF hosted 
content.

If every network has a "nearby" recursor (whether that be using normal 
DNS, or DoH) then ECS is not required becase the IP address of the 
recursor serves as a good proxy for that of the client.  In that sense, 
O(10^7) is a good thing.

However, RFC 7871 envisaged that the ECS option would only be exchanged 
between consenting servers.   It also says "it is expected that only a 
few Recursive Resolvers will need to use ECS" and alludes to ECS only be 
exchanged on specific agreement between recursive operators and 
authoritative operators.  At the moment we're about O(5) global DNS 
operators, and O(30) major CDNs.

But, if you're talking about getting to the O(100) scale of TRR 
operators all of whom are receiving queries from clients all over the 
world then that's a lot of bilateral agreements and configurations that 
would need to be set up, and a lot of ECS meta-information buzzing 
around the network.

Ray

[1] https://samknows.com/blog/dns-over-https-performance

[2] Cloudflare use Anycast for their CDN instead of "stupid DNS
     tricks", so they don't need ECS.