Re: [Doh] DNS64 and DOH

I will also draft some text in https://tools.ietf.org/html/draft-palet-v6ops-nat64-deployment-00, in order to consider different issues that have been raised with this thread, so at least, those deploying NAT64s/DNS64s are aware of it.

Regards,
Jordi

-----Mensaje original-----
De: Doh <doh-bounces@ietf.org> en nombre de Lee Howard <lee@asgard.org>
Fecha: jueves, 22 de marzo de 2018, 14:17
Para: Stephane Bortzmeyer <bortzmeyer@nic.fr>, Erik Nygren <erik+ietf@nygren.org>
CC: <doh@ietf.org>, Jordi Palet Martinez <jordi.palet@consulintel.es>
Asunto: Re: [Doh] DNS64 and DOH

    On 03/19/2018 09:00 AM, Stephane Bortzmeyer wrote:
    > On Sun, Mar 18, 2018 at 07:20:35PM +0000,
    >   Erik Nygren <erik+ietf@nygren.org> wrote
    >   a message of 86 lines which said:
    >
    >> At least for mobile, not using DNS64 synthesis in the client will
    >> likely result in this either breaking the client in NAT64
    >> environments
    > Is it a DNS64-specific problem? It could also happen if you have
    > local-only domain names, dummy local TLDs, alternative roots,
    > split-horizon, CDN, geo-based answers, or other DNS tricks.
    >
    > Yesterday, one IETFer told me that DoH was a bad idea because it allows
    > people to avoid DNS-based national censorship…
    >
    > May be a warning "the DoH resolver may give you a different answer
    > from what you would have got from the usual resolver"?

    Now that I have a couple more minutes, I thought I'd note Apple's 
    measurements of IPv6-only hosts:
    https://www.ietf.org/proceedings/98/slides/slides-98-maprg-measuring-trends-in-ipv6-support-tommy-pauly-00.pdf
    As of a year ago in maprg, 5-10% of hosts had no IPv4.
    Thanks for including the text, "For example, in the case of DNS64 
    [RFC6147], the choice could affect whether IPv6/IPv4 translation will 
    work at all." It might not be immediately clear to a server operator 
    that the implication of translation not working is that they must 
    dual-stack the server. Proposed text:
    "... IPv6/IPv4 translation will work at all, so running both IPv4 and 
    IPv6 on the server is recommended." If you don't like "is recommended" 
    because it's rfc2119 language, maybe "will improve the chances of 
    connecting."

    I'm also a little nervous about the text in Section 9 Operational 
    Considerations describing the bootstrap problem, and suggesting as one 
    possibility  "IP based URIs and corresponding IP based certificates for 
    HTTPS". Using IP literals as the URI is the opposite of DNS. I think 
    this is the fundamental resolution problem, which DNS solves with root 
    hints and glue records. There are, of course, lots of problems with IP 
    literals, including that the syntax is different in IPv4 and [IPv6], and 
    that addresses change.

    Lee

    _______________________________________________
    Doh mailing list
    Doh@ietf.org
    https://www.ietf.org/mailman/listinfo/doh

**********************************************
IPv4 is over
Are you ready for the new Internet ?
http://www.consulintel.es
The IPv6 Company

This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.