Re: [Doh] [EXTERNAL] Re: [Ext] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh

[Jim Reid <[e-mail]>]

On 22 Jan 2019, at 12:15, Winfield, Alister <Alister.Winfield=[e-mail]> wrote:
> 
> how about putting the information in the reverse zone for the resolver.
>  ... This is delegated and could be DNSSEC signed.

It won't work for RFC1918 address space.

The bootstrapping problem isn’t solved either. Presumably you’d still be relying on DHCP or something equally insecure to get the IP addresses of the resolving servers.

If a stub resolver gets configured in some other way -- editing /etc/resolv.conf for instance -- that might as well include whatever voodoo is needed for trusted DoH or DoT servers.

And what if that reverse zone isn’t signed? 

Then there are the issues when that zone isn’t managed by the same entity which manages the corresponding forward zone. This is quite common. For example, if I was a Sky customer I very much doubt I’d be able to add/remove/replace one of these hypothetical RRs in whatever Sky reverse zone happens to be “hosting” the IP address of my DoH server today. And if/when I reconnect to your net and get a different IP address, what happens to the old TXT record?

> If my resolver is a.b.c.d then you could put TXT records in the reverse..

That’s a Bad Idea. TXT records are already overloaded (abused?) for all sorts of things. A discrete RRtype would be better. Assuming this suggestion got picked up.