Re: [dnsext] Re: need new flag bit in EDNS, "do me no favours" (DMNF)

[Andreas Gustafsson <[e-mail]>]

Paul Vixie wrote:
> > From: Colm MacCárthaigh <[e-mail]>
> > Why doesn't that belong better in HTTP? The HTTP WG is probably better
> > placed to define whatever a "web error" is.
> 
> if you get an nxdomain you won't be connecting to any web server anywhere.

Maybe this can't be solved by the HTTP WG, but it could be solved by
the web browser vendors.

First of all, any improvement in "user experience" that the proponents
of web error redirection are claiming as a justification for doing DNS
rewriting can just as easily be implemented in the browser.  One
difference, of course, is that any ad revenue resulting from the
"improved experience" would then go to the browser vendor rather than
the ISP.

Second, browser vendors are in a position to defend against unwanted
DNS rewrites, by making the browsers bypass the system resolver and
directly query a recursive DNS server operated by the vendor or a
third party.  If enough browsers did this, NXDOMAIN rewriting in the
DNS would not longer be profitable.

Third, browser vendors could help raise awareness and exert pressure.
Imagine browsers detecting rewrites and displaying alerts along these
lines:

    [Insert browser name here] has detected that your computer is
    using a DNS server that tampers with the results of DNS lookups.
    Most likely, this is an attempt by your Internet Service Provider
    to replace the error message that would normally be displayed
    when you enter an incorrect URL with a pages containing paid
    advertisements.

    [Browser vendor] considers this practice harmful, not only because
    it alters your web browsing experience, but also because it can
    interfere with the operation of other Internet applications on
    your computer and other Internet-enabled devices on your network.

    [Browser] has automatically switched to a third-party DNS service
    operated by [company], but your other applications and devices are
    still affected.  If your Internet Service Provider allows you to
    opt out of DNS rewriting, we recommend that you do so.  Alternatively,
    you can change your DNS settings to use a third-party DNS provider
    by following the instructions at [this link].

-- 
Andreas Gustafsson, [e-mail]