[dns-privacy] RFC7626 and risk/threat analysis

[Jim Reid <[e-mail]>]

> On 1 Apr 2021, at 14:04, Stephane Bortzmeyer <[e-mail]> wrote:
> 
> RFC 793 is 39 years old. Let's drop TCP and move to QUIC (the RFCs are
> in the RCF-EDITOR state).
> 
> And I'm too charitable to mention the age of DNS RFCs

You should be above whatabootery* Stephane.

>> Some other risks have changed since 2015 too.
> 
> Please be specific and mention them.

I already did. But here goes again. DoT hadn’t been standardised by then. DoH hadn’t even been invented. Nobody had talked in detail about DoT or other encrypted transports to authoritative servers. [IIRC the initial focus of DoT was stub to resolver traffic.]  8.8.8.8 and the other all-fours resolver services didn’t exist. There wasn’t the prospect of the world’s web browsers doing DoH lookups (and to third-party resolvers in some cases) instead of Do53. There’s now significant disruption to how DNS lookups get performed -- ie more centralisation and consolidation -- which introduce new risks, threats and privacy considerations.

It looks to me the DNS landscape has changed a lot since RFC7626 was published. So the threats and risks have changed too. YMMV.

Besides if RFC7626 hadn’t been OBE, there wouldn’t be an RFC7626-bis. RFC7626 doesn’t mention encrypted transports at all. RFC7626-bis does.

* A Scottish word for raising non-sequiturs: what about...