Re: [dispatch] Working Group Proposal: DNS Over HTTPS

["John Levine" <[e-mail]>]

In article <[e-mail]> you write:
>Working Group: DNS Over HTTPS (DOH)
>
>DNS queries sometimes experience problems with end-to-end connectivity at times and places where HTTPS flows freely. The use of HTTPS
>provides integrity and confidentiality, and it also allows the transport to interoperate with common HTTP infrastructure and policy.
>
>The WG will standardize how HTTP clients can encode DNS queries and interpret DNS responses.
>
>The WG will use best-practice HTTP semantics.
>
>Specification of how the DNS data may used for new use cases, and the discovery of the DOH servers, are out of scope for the WG.
>
>The WG will begin its work based on draft-hoffman-dispatch-dns-over-https.
>
>The WG will deliver a document describing how to obtain and interpret DNS information using the HTTP protocol, with an IETF Last Call expected in December 2017.

In the discussions to date, the proposal has been to send wire format
queries encapsuated as an appropriate MIME type and get wire format
responses back, to be parsed by the https client.  The design is very
simple.

The main use case I see is that javascript running in browsers can
currently only do implicit A and AAAA queries by looking up URLs.  If
you want to do a SRV or NAPTR or URI lookup, you can't.  So with this
hack, the js application can now do those lookups.

There's also more exotic scenarios where you're trapped behind a
hostile firewall or maybe a captive portal or you want to do queries
that are harder to snoop, but I think that SRV/NAPTR/URI in js is
enough of a use case.

Someone asked what if the https server lies?  DNS caches have always
lied, that's nothing new.  If you don't trust it, you have DNSSEC.

Another suggestion was to turn the queries and responses into easier
to handle json, but that increases the complexity by orders of
magnitude, and would requires an update for every new rrtype or edns
flag.  (If someone wants to build a json proxy on top of this as an
experiment, sure, go ahead.)

As you might gather, I think this is a good idea, and should be
straightforward for us to handle.

R's,
John