Re: [DNSOP] Comments on draft-ietf-dnsop-svcb-httpssvc-02

[Ben Schwartz <[e-mail]>]

On Thu, Jun 11, 2020 at 9:30 AM Alessandro Ghedini <[e-mail]>
wrote:

>
> > Well firstly if you are going to be using providers, use their domain
> names in
> > the HTTPSSVC records.  The above configuration is more for self hosting.
>
> So, the domain name is always www.example.net for all providers, are you
> saying
> that instead of "HTTPSSVC 1 . ..." it should be "HTTPSSVC 1
> www.example.net ..."?
>

No, the correct configuration is the one you wrote at the start of this
thread, back in April:

    www.example.net <http://www.xample.net/>      3600 IN CNAME
cname.cdn-a.example
    cname.cdn-a.example 3600 IN HTTPSSVC 1 . alpn=h3 echconfig="..."

Here, "." means "cname.cdn-a.example.", so the ECHConfig will be bound to
the A/AAAA for that domain.  To switch providers, www.example.net would
just update its CNAME, and clients will seamlessly transition as caches
update.

> So, what am I missing here?

I think the key point here is that skipping the CNAME is a bad idea, for
exactly the reason you described.

If the customer really wants to skip the CNAME for some reason, it can do

    www.example.net      3600 IN HTTPSSVC 1 cname.cdn-a.example alpn=h3
echconfig="..."

If it also feels the need to short-circuit the A/AAAA lookups, it can add
IP hints here.  With or without IP hints, this is more fragile than a CNAME
if the CDN changes its configuration, but it won't break, or prevent
switching CDNs, so long as it's kept up to date.