Re: [dns-privacy] Trying to understand DNS resolver 'discovery'

["Konda, Tirumaleswar Reddy" <[e-mail]>]

> -----Original Message-----
> From: Neil Cook <[e-mail]>
> Sent: Wednesday, November 27, 2019 8:25 PM
> To: Stephane Bortzmeyer <[e-mail]>
> Cc: Konda, Tirumaleswar Reddy <[e-mail]>;
> [e-mail]; Phillip Hallam-Baker <[e-mail]>
> Subject: Re: [dns-privacy] Trying to understand DNS resolver 'discovery'
> 
> CAUTION: External email. Do not click links or open attachments unless you
> recognize the sender and know the content is safe.
> 
> 
> 
> > On 27 Nov 2019, at 14:28, Stephane Bortzmeyer <[e-mail]>
> wrote:
> 
> > If you use DoH/DoT, it is because you don't trust the access network.
> 
> It says nothing about whether you trust the access network. You *may* be
> using DoH/DoT because you don’t trust the access network. However, you
> may trust the access network for example, but the resolver it gives you may
> be located somewhere else entirely and your queries may be transiting over
> an untrusted network.

Yes. In addition, Internal attacks have become a reality, please see https://tools.ietf.org/html/draft-arkko-arch-internet-threat-model-01#section-4.2.1. 
Clients should use DoT/DoH in all networks.

-Tiru

> 
> > Relying on it to
> > indicate a DoH/DoT resolver is pointless.
> >
> 
> You’re conflating the lack of trust in the access network with discovery. Yes, if
> you don’t trust the access network then you may not want to use a discovery
> protocol to indicate the best way to contact the resolver over DoT/DoH.
> 
> However what if you have configured a resolver manually using an IP address,
> and want to opportunistically upgrade to DoT/DoH if the resolver supports it?
> 
> Neil