Re: [DNSOP] extension of DoH to authoritative servers

Paul Vixie <> Tue, 12 February 2019 20:48 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 11B5212F1A6 for <>; Tue, 12 Feb 2019 12:48:16 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id BaCssT8wxl4q for <>; Tue, 12 Feb 2019 12:48:14 -0800 (PST)
Received: from ( []) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 75B6412F1A5 for <>; Tue, 12 Feb 2019 12:48:14 -0800 (PST)
Received: from [IPv6:2001:559:8000:c9:14dc:261d:a3ba:1384] (unknown [IPv6:2001:559:8000:c9:14dc:261d:a3ba:1384]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by (Postfix) with ESMTPSA id 05A43892C6; Tue, 12 Feb 2019 20:48:14 +0000 (UTC)
To: Ted Lemon <>
Cc: David Conrad <>, dnsop <>
References: <> <> <> <> <> <> <> <>
From: Paul Vixie <>
Message-ID: <>
Date: Tue, 12 Feb 2019 12:48:14 -0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 PostboxApp/6.1.10
MIME-Version: 1.0
In-Reply-To: <>
Content-Type: text/plain; charset="utf-8"; format="flowed"
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Archived-At: <>
Subject: Re: [DNSOP] extension of DoH to authoritative servers
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 12 Feb 2019 20:48:16 -0000

Ted Lemon wrote on 2019-02-12 12:07:
> On Feb 12, 2019, at 11:04 AM, Paul Vixie < 
> <>> wrote:
>> actually, there are other choices.
> I may have failed to communicate.   What I mean is that you said that 
> you can detect all nefarious traffic, but you can’t detect DoH, which to 
> you is nefarious.   What I’m saying is that there’s no such distinction, 
> or at least if there is at present, it is a temporary situation.

i realize that the political tacticians who designed DoH are searching 
for a world in which network operators have no control plane choices. i 
think they're proceeding from the mistaken belief that all control is 
evil, and that all network operators are equally deserving of 
disintermediation. and other mistaken beliefs as well, which i won't 

> Of course you have choices about what to do about this; my point is not 
> to suggest that you do not.

whether the situation turns out to be temporary or not is important to 
your final argument. probably you shouldn't go there so soon. spammers 
also believe that network operators should not be able to control their 
own networks, and malware authors, and botnet creators, and IoT 
innovators, and surveillance capitalists. none of those matters seem 
like they are, or will ever be, settled. so, none are "temporary".

my network, my rules. anyone who acts otherwise will be treated by me as 
an adversary, even folks like mozilla who have been fellow travelers for 
decades now, if they continue to pursue unblockable endpoint technology.

P Vixie