[dnsoverhttp] Comments on draft-hoffman-01

[Ben Schwartz <[e-mail]>]

I've been taking a close look at this DNS over HTTP draft.  I like it a
lot, but I could use some clarification on some finer points:

1. What values must the server accept for each of these parameter values,
and what may the client send?  I think it would help to very tightly limit
the allowed parameter values (e.g. no leading zeros), but allow the server
to optionally accept a broader range of values.  That way, server
implementations can use whatever parsing functions they happen to have on
hand.

2. What is the meaning of the pad field: is it a string of bytes, or a
number of bytes?  What's the purpose of the padding option?  What if the
HTTP connection is encrypted, but the DNS over HTTP server performs
resolution that is not encrypted?  What does the maximum UDP payload size
have to do with HTTP?

3. What should the server do if parameters are duplicated?  Just choose the
first instance?

4. What is at the given path in .well-known?  Is it a static file
containing the prefix?  Is that path actually the prefix?  Could it be
both?  What is the client's intended TLS behavior when knowing only an IP
address: should it send an SNI?  Should it verify the certificate or
consider the encryption opportunistic?  (Can we adopt DNS-over-TLS's
security profiles?)

--Ben