IETF Logo Mail Archive

Re: [DNSOP] Draft for dynamic discovery of secure resolvers

Paul Ebersman <list-dnsop@dragon.net> Sun, 19 August 2018 20:04 UTC

Return-Path: <list-dnsop@dragon.net>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 26E01130DD4 for <dnsop@ietfa.amsl.com>; Sun, 19 Aug 2018 13:04:34 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level:
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v-LDuilFA3Qb for <dnsop@ietfa.amsl.com>; Sun, 19 Aug 2018 13:04:32 -0700 (PDT)
Received: from mail.dragon.net (mail.dragon.net [IPv6:2001:4f8:3:36::235]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4F4AE130DE4 for <dnsop@ietf.org>; Sun, 19 Aug 2018 13:04:32 -0700 (PDT)
Received: from fafnir.remote.dragon.net (localhost [IPv6:::1]) by mail.dragon.net (Postfix) with ESMTP id 284703740090; Sun, 19 Aug 2018 13:04:31 -0700 (PDT)
Received: by fafnir.remote.dragon.net (Postfix, from userid 501) id EF22CACBD58; Sun, 19 Aug 2018 14:04:30 -0600 (MDT)
Received: from fafnir.local (localhost [127.0.0.1]) by fafnir.remote.dragon.net (Postfix) with ESMTP id EB2FEACBD57; Sun, 19 Aug 2018 14:04:30 -0600 (MDT)
From: Paul Ebersman <list-dnsop@dragon.net>
To: Ted Lemon <mellon@fugue.com>
cc: dnsop WG <dnsop@ietf.org>
In-reply-to: <CAPt1N1nFW_h1i9cetKXm1isp9aUDKH73ZB+3trabFZd9NSDZkw@mail.gmail.com>
References: <CAPt1N1nEH86yPvtoNqJ+xM-OFunEqr2x8s2LV_yFU1fkVt9WUQ@mail.gmail.com> <53074d98-a8ef-9127-edc7-d3e3188c2453@dougbarton.us> <CAPt1N1muo07jvDmyM+oL96Ow1RXGcsgVKX51S86CUcedirzvew@mail.gmail.com> <20180819.204841.532639858.sthaug@nethelp.no> <CAPt1N1nFW_h1i9cetKXm1isp9aUDKH73ZB+3trabFZd9NSDZkw@mail.gmail.com>
Comments: In-reply-to Ted Lemon <mellon@fugue.com> message dated "Sun, 19 Aug 2018 15:28:30 -0400."
X-Mailer: MH-E 7.4.2; nmh 1.7.1; XEmacs 21.4 (patch 22)
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <40562.1534709070.1@fafnir.local>
Date: Sun, 19 Aug 2018 14:04:30 -0600
Message-Id: <20180819200430.EF22CACBD58@fafnir.remote.dragon.net>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/NfZGr1LoD1lBWd7iY8tdPAQThk4>
Subject: Re: [DNSOP] Draft for dynamic discovery of secure resolvers
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.27
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 19 Aug 2018 20:04:34 -0000

mellon> Think about DHCP providing an SMTP server address. Does that
mellon> make sense?

That doesn't. But DHCP already hands out DNS servers. You are already
trusting the DHCP server to give you default gateway and DNS server (or
you are choosing not to use DHCP).

Take the use case of coffee house or wireless hotspot. I think that it
would be an improvement of privacy to not allow anyone there to sniff
DNS packets because the owner of the network uses DOH for their
recursive resolver. I'm already trusting the network for default gateway
and most users would trust the DNS servers handed via DHCP. So no huge
new leap of trust and improved privacy. Seems like a win.

Why not allow network operators that option via a new DHCP option? You
don't have to use it but it would be a good choice for some.

v2.15.0 | Report a Bug | By Email