Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator

[Adam Roach <[e-mail]>]

On 3/19/19 3:33 PM, Martin Thomson wrote:
> I agree with Ted.
>
> On Wed, Mar 20, 2019, at 04:46, Ted Hardie wrote:
>> My apologies if I have misunderstood your point
>> here, but unless you also block all traffic for which you have seen no
>> resolution event, I believe that it is entirely possible to circumvent
>> the defense you describe.
> The problem with blocking packets that can't be traced to a resolution event is that you need to catch all the resolution events. DNS doesn't have a monopoly on address resolution - I mean, that's the whole point of this discussion, isn't it?


It's also pretty trivial to defeat: if I were malware that used DoH to 
resolve "cnc.horriblebotnet.example" to 192.0.2.17, I could then do a 
Do53 query for 
"192-0-2-17.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.plex.direct", which 
triggers a valid resolution response for the IP address I want to get to 
and lets my traffic through.

Sure, you can block the entire "plex.direct" tree, but it's not the only 
resolver that acts like this. You'll be playing a long game of whack-a-mole.

/a