Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh

[bert hubert <[e-mail]>]

On Wed, Jan 16, 2019 at 01:28:03PM -0500, Ben Schwartz wrote:
> DNS over TLS already supports a way for clients to upgrade from unencrypted
> DNS, by probing port 853 on the server's IP address.  I presume that's why
> DNS over TLS discovery was not mentioned in this draft.  Is probing port
> 853 sufficient for your use case?

With my "large scale internet service provider constituency" hat on, a major
problem for them is that many deployed CPEs announce themselves as
nameserver. So over DHCP they will tell clients to use 192.168.1.1 for DNS.

This leads opportunistic DNS over TLS clients to probe the modem/router/CPE
for TLS support.  For many reasons, CPEs are hard to change substantially,
so it is not that easy to add 853 proxying or an actual DoT server on these
boxes.

So service providers would love to be able to configure a DoT server that
lives on a different IP address than the regularly configured plaintext
nameserver.

	Bert