Re: [Doh] DOH and Induced DNS

Adam Roach <> Mon, 06 November 2017 23:39 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id C1B1E13FB59 for <>; Mon, 6 Nov 2017 15:39:46 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.88
X-Spam-Status: No, score=-1.88 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id WYdVBXDlDGfB for <>; Mon, 6 Nov 2017 15:39:45 -0800 (PST)
Received: from ( [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 22A0713F698 for <>; Mon, 6 Nov 2017 15:39:44 -0800 (PST)
Received: from ( []) (authenticated bits=0) by (8.15.2/8.15.2) with ESMTPSA id vA6Ndg1i041193 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Mon, 6 Nov 2017 17:39:43 -0600 (CST) (envelope-from
X-Authentication-Warning: Host [] claimed to be
To: Mark Nottingham <>, dagon <>
References: <> <>
From: Adam Roach <>
Message-ID: <>
Date: Mon, 6 Nov 2017 17:39:42 -0600
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:52.0) Gecko/20100101 Thunderbird/52.4.0
MIME-Version: 1.0
In-Reply-To: <>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Language: en-US
Archived-At: <>
Subject: Re: [Doh] DOH and Induced DNS
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: DNS Over HTTPS <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 06 Nov 2017 23:39:47 -0000

On 11/6/17 5:32 PM, Mark Nottingham wrote:
>> On 7 Nov 2017, at 4:07 am, dagon <> wrote:
>>   c) Header-only?  If we assume implementation mistakes will always
>> occur in DOH stubs and recursives, perhaps the wire encoding should
>> appear only in HTTP headers, since these are less easily manipulated
>> by crafted javascript and HTML.  At the same time, the headers are
>> presumably within reach of the stub.  Header fields seem more likely
>> to reflect browser user decisions, and not the HTML author's malicious
>> whims.  (At least the problem would only be as bad as DNS prefetch, in
>> terms of volume.)
> It's trivial for scripts to modify headers, EXCEPT those starting with Sec-:
> If this is a concern, it might be workable to define a header that looks something like:
> Sec-Doh: 1
> to indicate that the request was generated by the browser / client internals, not script.

If the notion here is to prevent JS-initiated queries, I'll point out 
that this is explicitly prohibited by the working group charter: "While 
access to DNS-over-HTTPS servers from JavaScript running in a typical 
web browser is not the primary use case for this work, precluding the 
ability to do so would require additional preventative design. The 
working group will not engage in such preventative design."