Re: [Doh] [Ext] Re: Associating a DoH server with a resolver

[Martin Thomson <[e-mail]>]

On Wed, Oct 24, 2018 at 12:12 PM Paul Hoffman <[e-mail]> wrote:
> There is no way for an application like a browser to send a query through the OS for anything other than address records. That is, gethostbyname() and its equivalents only pass back address records. Even if an application had its own DNS stack to make queries for other RRtypes, it doesn't have any way to know where to send them to.

Well, resolver-addresses.arpa./IN/A(AAA) might still be useful for
that then.  That's not ideal, but I believe that there are ways to
make queries for other record types that are more available now than
perhaps there were in the past (see
https://docs.microsoft.com/en-us/windows/desktop/api/windns/nf-windns-dnsquery_a
for example).

>> IP-based certificates [...] impossible to deploy in many cases (think of the many resolvers with 1918 addresses, for example).
>
> They don't make it "impossible" by a long shot. Plenty of resolvers, even corporate resolvers, have public addresses.

True, it is probably still possible, but it's not like you can just
use ACME to get the certificate.  That's "possible" in theory, but I'm
looking for practicable.