[Doh] Clarification re: "Opportunistic DNS"

[Adam Roach <[e-mail]>]

I'm posting this in my role as AD, to get information that might help us 
figure out next steps regarding the "Opportunistic DNS" [1] work that 
was discussed in London. Note that the "Opportunistic DNS" work remains 
out of scope for DOH: I'm posting here because this list has the correct 
community of interest.

During last week's discussion in DOH regarding techniques for 
proactively pushing DNS records to endpoints [2], there were several 
comments at the microphone that make me think there are important and 
subtle issues that were not completely obvious.

Specifically: while the slides and proponent were careful to talk about 
DNSSEC, TLS certificate validation, and "additional validation checks" 
for received information, there were at least two independent comments 
at the microphone that expressed concerns about cache poisoning. There 
were also multiple comments (one at the mic, one after the meeting) 
expressing concerns that DNSSEC doesn't provide the right kind of 
assurances necessary to validate records received from untrusted sources.

If the DNS experts on this list could expand on the concerns about 
poisoning in the context of DNSSEC, it would be greatly appreciated. 
Feel free to reply directly to me, or on-list.

Thanks!

/a

___
[1] I'm carefully using quotation marks here to indicate what it was 
called in the meeting, with the explicit recognition that this name is 
considered problematic by some.

[2] Presentation at 
https://datatracker.ietf.org/meeting/101/materials/slides-101-doh-opportunistic-dns-00