Re: [DNSOP] New draft, seeking comments: draft-sah-resolver-information

["John Levine" <[e-mail]>]

In article <[e-mail]>,
John Levine  <[e-mail]> wrote:
>My inclination would be to put this on hold and advance the web server
>part if ACME adds a way to do IP address certs.  I don't see any
>reason to prefer DoH or DoT over .well-known, since it uses same TLS
>channel and has a much simpler encoding of the content.

Here's a further thought.  After poking at a bunch of public DoT
servers including 1.1.1.1, 8.8.4.4, 8.8.8.8, 9.9.9.9 and lesser
known ones like 89.233.43.71, I find that most of them return
a signed cert for a name that resolves to the appropriate IP.

If you think there is likely to be a critical mass of clients that
find their DoT or DoH server by name, or that have external knowledge
of what the name should be for a server found by IP, it could make
sense to advance the .well-known part, with a security note that
you only get the validation part of TLS if you know the name or
you're in the elite few who can get a signed IP address certificate.

This could still work for servers on private IPs, since it's not hard
to get a signed certificate for a public name that doesn't resolve
to a public IP.  (The public name doesn't even have to be in the DNS
other than for two minutes while the signer checks it.)

I still think that the new RR with funky names is a bad idea, a lot of
complexity that offers the same info that .well-known does.

R's,
John



-- 
Regards,
John Levine, [e-mail], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly