Subject: Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertola-bcp-doh-clients
From: Stephane Bortzmeyer <[email-masked]>
To: Neil Cook <[email-masked]>
Cc: Stephane Bortzmeyer <[email-masked]>, nalini elkins <[email-masked]>, Stephen Farrell <[email-masked]>, [email-masked], [email-masked], Christian Huitema <[email-masked]>, [email-masked], Vittorio Bertola <vittorio.bertola=[email-masked]>, "Ackermann, Michael" <[email-masked]>
Date: Tue, 12 Mar 2019 17:01:41 +0100
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>

On Tue, Mar 12, 2019 at 04:55:11PM +0100,
 Neil Cook <[email-masked]> wrote 
 a message of 22 lines which said:

> Actually many enterprises (particularly banks etc.) do not allow DNS resolution directly from employee endpoints.

They block UDP/53, which is not the same thing. Malware or
non-cooperating applications can do name resolution by other means. I
still do not understand why people have a problem with DoH whch did
not already exist before with
my-own-name-resolution-protocol-over-HTTPS.