Re: [Doh] DNS64 and DOH

[Lee Howard <[e-mail]>]

On 03/19/2018 09:00 AM, Stephane Bortzmeyer wrote:
> On Sun, Mar 18, 2018 at 07:20:35PM +0000,
>   Erik Nygren <[e-mail]> wrote
>   a message of 86 lines which said:
>
>> At least for mobile, not using DNS64 synthesis in the client will
>> likely result in this either breaking the client in NAT64
>> environments
> Is it a DNS64-specific problem? It could also happen if you have
> local-only domain names, dummy local TLDs, alternative roots,
> split-horizon, CDN, geo-based answers, or other DNS tricks.
>
> Yesterday, one IETFer told me that DoH was a bad idea because it allows
> people to avoid DNS-based national censorship…
>
> May be a warning "the DoH resolver may give you a different answer
> from what you would have got from the usual resolver"?

Now that I have a couple more minutes, I thought I'd note Apple's 
measurements of IPv6-only hosts:
https://www.ietf.org/proceedings/98/slides/slides-98-maprg-measuring-trends-in-ipv6-support-tommy-pauly-00.pdf
As of a year ago in maprg, 5-10% of hosts had no IPv4.
Thanks for including the text, "For example, in the case of DNS64 
[RFC6147], the choice could affect whether IPv6/IPv4 translation will 
work at all." It might not be immediately clear to a server operator 
that the implication of translation not working is that they must 
dual-stack the server. Proposed text:
"... IPv6/IPv4 translation will work at all, so running both IPv4 and 
IPv6 on the server is recommended." If you don't like "is recommended" 
because it's rfc2119 language, maybe "will improve the chances of 
connecting."

I'm also a little nervous about the text in Section 9 Operational 
Considerations describing the bootstrap problem, and suggesting as one 
possibility  "IP based URIs and corresponding IP based certificates for 
HTTPS". Using IP literals as the URI is the opposite of DNS. I think 
this is the fundamental resolution problem, which DNS solves with root 
hints and glue records. There are, of course, lots of problems with IP 
literals, including that the syntax is different in IPv4 and [IPv6], and 
that addresses change.


Lee