[Doh] DNS API server trust

[Mateusz Jończyk <[e-mail]>]

Hello,
There was an interesting discussion on a Github pull request
	https://github.com/dohwg/draft-ietf-doh-dns-over-https/pull/174

It was discussed whether there should be an absolute requirement which servers
the client can use, i.e. the following text:

	In the absence of DNSSEC information about the authenticity of responses
	a DNS API server can give a client invalid data in responses. A client
	MUST NOT use arbitrary DNS API servers. Instead, a client MUST only use
	DNS API servers specified using mechanisms such as explicit
	configuration. This does not guarantee protection against invalid data
	but reduces the risk.

User roryhewitt opposed this wording, He or She argued that usage of MUST is
unsuitable as it is used here to describe policy, not a mechanism.

I would side with His / Her. The concern is merely theoretical at the time being
as there is currently no other way to obtain a DNS API server other then manual
configuration (the usage of DNS responses obtained by server push is dealt
earlier in the specification). I would claim that concerns "that DOH clients
will spray queries to random webservers, or otherwise violate security common
sense." (as Benjamin M. Schwartz put it) are unfounded.

The policy should probably be defined after DNS API server discovery will be
standarized.

At the very least, I would lower the requirement from MUST to SHOULD here as
trust is an intricate topic.

Greetings,
Mateusz Jończyk