Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh

Stephane Bortzmeyer <bortzmeyer@nic.fr> Tue, 29 January 2019 14:48 UTC

Return-Path: <bortzmeyer@nic.fr>
X-Original-To: doh@ietfa.amsl.com
Delivered-To: doh@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E9AB212F295 for <doh@ietfa.amsl.com>; Tue, 29 Jan 2019 06:48:54 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.901
X-Spam-Level:
X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9oC-YUSt2TCh for <doh@ietfa.amsl.com>; Tue, 29 Jan 2019 06:48:52 -0800 (PST)
Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0483312F1AC for <doh@ietf.org>; Tue, 29 Jan 2019 06:48:52 -0800 (PST)
Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 3A25A2801AD; Tue, 29 Jan 2019 15:48:50 +0100 (CET)
Received: by mx4.nic.fr (Postfix, from userid 500) id 341AC2802DF; Tue, 29 Jan 2019 15:48:50 +0100 (CET)
Received: from relay01.prive.nic.fr (relay01.prive.nic.fr [IPv6:2001:67c:2218:15::11]) by mx4.nic.fr (Postfix) with ESMTP id 2C8F22801AD; Tue, 29 Jan 2019 15:48:50 +0100 (CET)
Received: from b12.nic.fr (b12.users.prive.nic.fr [10.10.86.133]) by relay01.prive.nic.fr (Postfix) with ESMTP id 28952642A7A1; Tue, 29 Jan 2019 15:48:50 +0100 (CET)
Received: by b12.nic.fr (Postfix, from userid 1000) id 18F9E4021E; Tue, 29 Jan 2019 15:48:50 +0100 (CET)
Date: Tue, 29 Jan 2019 15:48:50 +0100
From: Stephane Bortzmeyer <bortzmeyer@nic.fr>
To: Paul Hoffman <paul.hoffman@icann.org>
Cc: DoH WG <doh@ietf.org>
Message-ID: <20190129144850.rfqb56qp4irggbhz@nic.fr>
References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org>
X-Operating-System: Debian GNU/Linux 9.6
X-Kernel: Linux 4.9.0-8-amd64 x86_64
X-Charlie: Je suis Charlie
Organization: NIC France
X-URL: http://www.nic.fr/
User-Agent: NeoMutt/20170113 (1.7.2)
X-Bogosity: No, tests=bogofilter, spamicity=0.000000, version=1.2.2
X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.1.29.142716
Archived-At: <https://mailarchive.ietf.org/arch/msg/doh/AV0TjpAxpbPhE9KtV6jXKFkyfwA>
Subject: Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh
X-BeenThere: doh@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: DNS Over HTTPS <doh.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/doh>, <mailto:doh-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/doh/>
List-Post: <mailto:doh@ietf.org>
List-Help: <mailto:doh-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/doh>, <mailto:doh-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 29 Jan 2019 14:48:55 -0000

On Wed, Jan 16, 2019 at 12:25:55AM +0000,
 Paul Hoffman <paul.hoffman@icann.org> wrote 
 a message of 121 lines which said:

> I did a short presentation on "Associating a DoH Server with a
> Resolver"
> (https://datatracker.ietf.org/doc/draft-hoffman-resolver-associated-doh/)
> at the DNSOP WG. The presentation ended with the question of whether
> the draft should be taken up in a WG, and if so, where.

I tend to say Yes, because it is an interesting and useful
subject. However, I also tend to agree with Stephen Farrell that a
general "DNS resolver discovery solution", not limited to DoH, would
be a good idea.

In the current draft, I have a big concern about the idea of an
application (for instance the Web browser) having a specific DNS
resolver (section 5 of draft -07), different from the rest of the
applications on the same machine. It will be a nightmare to debug DNS
issues with such a setup. We cannot prevent people for doing bad
choices like this one but we should not condone it in a RFC. IMHO, the
correct setup is a shared DoH client, running on the local machine
(stubby, systemd-resolve, etc) or on the CPE.

[This is a purely technical issue, different for the more political
one raised by Bert Hubert.]