Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh

[Ben Schwartz <[e-mail]>]

DNS over TLS already supports a way for clients to upgrade from unencrypted
DNS, by probing port 853 on the server's IP address.  I presume that's why
DNS over TLS discovery was not mentioned in this draft.  Is probing port
853 sufficient for your use case?

On Wed, Jan 16, 2019 at 1:17 PM A. Schulze <[e-mail]> wrote:

>
>
> Am 16.01.19 um 01:25 schrieb Paul Hoffman:
> > So, does this WG want to adopt this as a work item?
>
> Hello,
>
> adopt "DoH Servers by TXT" using unbound is fairly simple.
> Maybe someone could verify that config.
>
> unbound.conf:
>         # option 1:
>         # resolver that understands this protocol but has no associated
> DoH server
>         server:
>          local-data: 'resolver-associated-doh.arpa. TXT ""'
>
>         # option 2:
>         # resolver that understands this protocol and has one associated
> DoH server
>         server:
>          local-data: 'resolver-associated-doh.arpa. TXT "
> https://doh.example/"'
>
>         # option 3:
>         # resolver that understands this protocol and has multiple
> associated DoH server
>         server:
>          local-data: 'resolver-associated-doh.arpa. TXT "
> https://doh01.example/"'
>          local-data: 'resolver-associated-doh.arpa. TXT "
> https://doh02.example/"'
>
> The second suggestion "DoH Servers by Addresses" isn't attractive to me.
> Getting a certificate for an IP isn't common these days.
>
> https://IPADDRESSGOESHERE/ -> Ask your favorite CA to issue a certificate
> for "IPADDRESSGOESHERE"...
>
> also:
>  * https://[2001:db8::53]/ -> Address in []
>  * Certificate SAN Entry   -> Address without []
> can this work with IPv6? I simply never tried that...
>
> I agree with Ralf on defining something similar for DoT, too
>
> Andreas
>
> _______________________________________________
> Doh mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/doh
>