Re: [Doh] DOH and split DNS

[Andrew Sullivan <[e-mail]>]

On Mon, Nov 06, 2017 at 11:13:19AM +1100, Mark Nottingham wrote:
> 
>  Some careful wording around the configuration mechanism should help.
> 
> Allowing something like proxy.pac to override DOH doesn't make any sense, given that the primary purpose of DOH is to NOT allow the local network to impose policy on communication with the DNS server.
> 

That careful wording had better be pretty careful.  I don't believe
for an instant that most users have a workable theory for which
resolution mechanism they're using, and if they configure DOH and
suddenly all the "internal sites" don't work they're going to be
pretty surprised.

It strikes me as pretty strange, too, to suggest that, if a user
configures proxy.pac, they don't want the local network to offer such
policies.  If the user is prepared to use the proxy, presumably the
user is prepared to use it to impose local policy, no?

Best regards,

A

-- 
Andrew Sullivan
[e-mail]