Re: [dns-privacy] how can we ADoT? (with github url)

Tony Finch <> Wed, 11 November 2020 21:20 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 60E9C3A1119 for <>; Wed, 11 Nov 2020 13:20:36 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.896
X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id AdxlUhlg86nN for <>; Wed, 11 Nov 2020 13:20:34 -0800 (PST)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 8DCB13A1121 for <>; Wed, 11 Nov 2020 13:20:34 -0800 (PST)
X-Cam-AntiVirus: no malware found
Received: from ([]:46778) by ( []:25) with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) id 1kcxXc-000vqV-Rl (Exim 4.92.3) (return-path <>); Wed, 11 Nov 2020 21:20:32 +0000
Date: Wed, 11 Nov 2020 21:20:32 +0000
From: Tony Finch <>
To: Manu Bretelle <>
cc: DNS Privacy Working Group <>
In-Reply-To: <>
Message-ID: <>
References: <> <>
User-Agent: Alpine 2.20 (DEB 67 2015-01-07)
MIME-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Archived-At: <>
Subject: Re: [dns-privacy] how can we ADoT? (with github url)
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 11 Nov 2020 21:20:36 -0000

Manu Bretelle <> wrote:

> Having this as an ID or possibly a github repo may make it easier to refer
> to/iterate than just this email.


> I had attempted to quickly categorize some of those approaches (albeit a
> much smaller list) in a matrix in [0] but did not follow through since.
> [0]

Ah, I haven't been paying enough attention to meetings so I missed this! I
think I need the speaker notes to understand it properly :-)

Your title "DoT for insecure delegations" is interesting: one of the
problems with what I have written so far is that it is too much a post-hoc
justification for using TLSA records to support ADoT. So I have built
nameserver authentication on top of TLSA on top of DNSSEC.

One of my unstated assumptions is that DoT will be problematic for TLDs,
and (with QNAME minimization) it matters more for leaf zones, so it is
likely to be deployed there first. But DNSSEC is deployed to a much higher
proportion of TLDs than leaf zones, so there's a good chance I'm wrong.

f.anthony.n.finch  <>
Shetland Isles: Southerly 6 to gale 8, decreasing 4 or 5 later in west. Rough
or very rough. Rain or drizzle. Moderate or poor, becoming good later in west.