Re: [Add] What to do in this potential working group

[David Conrad <[e-mail]>]

Alec,

On Aug 21, 2019, at 1:24 PM, Alec Muffett <[e-mail]> wrote:
> On Wed, 21 Aug 2019, 19:17 David Conrad, <[e-mail] <mailto:[e-mail]>> wrote:
> Further, you cannot ensure to the end user that the “trusted” resolver operator has not tampered with the data, be it due to court order, internal attack, software bugs, etc.
> But you can assure that it is a response from the resolver which you chose (contracted?) to deal with,  rather than some happenstance resolver.

If your interest is ensuring that the DNS data the client is receiving corresponds with what the authority for the domain inserted into the zone, what you are assuring is essentially meaningless, regardless of which resolver you talk to.  Actually, given TRRs would be concentration points, the situation is arguably worse than if you used a happenstance resolver: what would happen if the TRR you contracted with is subject to a court order under seal that requires that TRR to modify responses for particular domains?  How would you know?

DoH is channel protection. Can we please stop suggesting DoH addresses data integrity?

Regards,
-drc