Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients

nalini elkins <> Mon, 11 March 2019 20:43 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id ED3A61311AB for <>; Mon, 11 Mar 2019 13:43:48 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.898
X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, NORMAL_HTTP_TO_IP=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id cKjeKpBl2dnl for <>; Mon, 11 Mar 2019 13:43:47 -0700 (PDT)
Received: from ( [IPv6:2a00:1450:4864:20::241]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 560711311C9 for <>; Mon, 11 Mar 2019 13:43:43 -0700 (PDT)
Received: by with SMTP id t13so350177lji.2 for <>; Mon, 11 Mar 2019 13:43:43 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=xt4Iw//cVRXManG4BIdxrjJe1wpkbP7taIrKwMF0WRk=; b=mkbBsGSNYJqvcZrqNdMVlNrLI2dLtg3Esky9pRICaeAdioN0atKG0rg8wzBpXHwpre wqZqNhZICxt0mG9bxy+lC/kv3D/iFgtf6Zgz287HpzsCEd8W0zAGquYAn7G2eVAauS4+ HAux/2LTIHOinRrjaA0Xys/+P+NSHtYmFNjA/xf3aF65T4PvXskIsGYf8a7dlfWXMe2r Ptc2W7jTLK1eUcb8op7ck98r1JVKzc4Xjf7H13d69zdF7Nzc9lGlHqmZInUDZuvIAfkQ inEeOggn25BK+bfkyuHBnPTZLkZarPEB4vrYqPEsAFClclytYZe1wbFkfqzgzcOnDblh +SOw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=xt4Iw//cVRXManG4BIdxrjJe1wpkbP7taIrKwMF0WRk=; b=NzZFlXVIDiZGlRVxLq0khJKWfuEgew3MYPIYZ5/c8ibp5qCWCCgQmZRsJNDOKUH0iZ h+fEb176LlBfyxkHRzGnJqNEsGxwmffZFS6/zmPY+sYV5M/UmAMVSQv3yqG2Shj6Qp8A ZQ9SbBlTUbDT/xDKxHVn2v3gu5fIZfuRUZPswnLOR+8EeC1x2xC4Fq8aoUVBjTKAtsMb Tzv0n1BxOZE0nyT0qi0jCOkKsiL06BhKeGY53Afj0r3CY6CbUUJXqluArflJJVHyBQoh sSGmRDMWFdL6dysr3ZJ+wWk8lTVtIzc0eVeKetI0C2wX/Fjc7oG9GlsuEIU9ZcW+Plvd z2CQ==
X-Gm-Message-State: APjAAAX+atiLLJbTLUYuQWYY2a32RHLFHCSBzNiu5n2jeTWX5sAuDkP7 eVl+5HisOvNe4IBby984mFIt6xtw1kQg6rWmcY5kGA==
X-Google-Smtp-Source: APXvYqwSlIGicz6r+XCYz1p03I/bdXCAf4G1RV0C/pVMDx5gMOKpbmbk28Pxem/iuYFi0P/x1hz10jHCR1Nwuq+kR3s=
X-Received: by 2002:a2e:a28f:: with SMTP id k15mr17962255lja.160.1552337021307; Mon, 11 Mar 2019 13:43:41 -0700 (PDT)
MIME-Version: 1.0
References: <> <> <> <> <> <> <> <> <> <> <>
In-Reply-To: <>
From: nalini elkins <>
Date: Tue, 12 Mar 2019 02:13:30 +0530
Message-ID: <>
To: Paul Vixie <>
Cc: "Konda, Tirumaleswar Reddy" <>, Stephen Farrell <>, "" <>, "" <>, Christian Huitema <>, "" <>, Vittorio Bertola <>, "Ackermann, Michael" <>
Content-Type: multipart/alternative; boundary="000000000000ba2bff0583d7a0f2"
Archived-At: <>
Subject: Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 11 Mar 2019 20:43:53 -0000

>i wonder if everyone here knows that TLS 1.3 and encrypted headers is
>going to push a SOCKS agenda onto enterprises that had not previously
>needed one

I have, ahem, some familiarity with the enterprises and TLS1.3 issue.
past few years have aged me terribly!)  I frankly feel that we have at the
a problem with the how we do conflict resolution and the process of
itself.  In fact, I co-authored a draft on this topic:

I feel that until we fix these fundamental issues, we will find ourselves
in this
place again and again.   The next time will be with QUIC (as Paul points out
in his mention of encrypted headers).  I actually have some suggestions as
to how we might better work with each other.  But, I do not want to
into a much larger issue.

At a minimum, I think that some relatively neutral arbiter, say CERT, might
provide an after the fact impact assessment that certain changes such as
DoH and TLS1.3 will have on enterprises, the home user, and so on.   Of
course, it would be better if such a neutral assessment were done BEFORE
the draft becomes final.

This is similar to what is done in California on ballot initiatives.  When
we get our
voting pamphlet, it tells us for each issue, what impact a pro or con vote
will have
on various aspects such as increased taxes, and so forth.


On Mon, Mar 11, 2019 at 11:42 PM Paul Vixie <> wrote:

> nalini elkins wrote on 2019-03-11 10:26:
> > Tiru,
> >
> > Thanks for your comments.
> >
> >  > Enterprise networks are already able to block DoH services,
> i wonder if everyone here knows that TLS 1.3 and encrypted headers is
> going to push a SOCKS agenda onto enterprises that had not previously
> needed one, and that simply blocking every external endpoint known or
> tested to support DoH will be the cheaper alternative, even if that
> makes millions of other endpoints at google, cloudflare, cisco, and ibm
> unreachable as a side effect?
> CF has so far only supported DoH on and, which i
> blocked already (before DoH) so that's not a problem. but if google
> decides to support DoH on the same IP addresses and port numbers that
> are used for some API or web service i depend on, that web service is
> going to be either blocked, or forced to go through SOCKS. this will add
> considerable cost to my network policy. (by design.)
> --
> P Vixie

Nalini Elkins
Enterprise Data Center Operators