Re: [dns-privacy] Last Call: <draft-ietf-dprive-rfc7626-bis-03.txt> (DNS Privacy Considerations) to Informational RFC

[Brian Haberman <[e-mail]>]

Hi SM,

On 1/23/20 9:11 AM, S Moonesamy wrote:
> Dear Sara,
> At 05:15 AM 23-01-2020, Sara Dickinson wrote:
>> > Section 3.2 discusses what a user does and use a DNS query related
>> to email as an example.  Is the MUA expected to validated the MX RR or
>> is it the role of the MSA?
>>
>> I think questions of validation are out of scope for this draft.
> 
> Apologies for not explaining this correctly.  The draft is described as
> a document about the use of DNS.  Section 3.2 has the following: "It
> gives information about what the user does ("What are the MX records of
> example.net?" means he probably wants to send email to someone at
> example.net ..."  My question was about that DNS query.  Could you or
> the WG Chairs please explain why the question which I asked is out of
> scope for this draft?
> 

I believe the text in question is:

   The QNAME is the full name sent by the user.  It gives information
   about what the user does ("What are the MX records of example.net?"
   means he probably wants to send email to someone at example.net,
   which may be a domain used by only a few persons and is therefore
   very revealing about communication relationships).

Given that the section is focused on the risk of the data included in
the DNS request, I interpret the above to be describing what privacy
risks exist by simply having the DNS payload be visible to observers. In
this case, an observer can see that a particular IP address is looking
up DNS info for a domain that may only be accessed by a small number people.

The document does not purport to explain how various
applications/services should/could perform any type of "validation" on
the returned information. I am also unclear on where the concept of
validation came out of that text.

Regards,
Brian