Re: [Doh] [Ext] DOH bypassing protection mechanisms

[Paul Hoffman <[e-mail]>]

On Nov 5, 2017, at 11:48 AM, Adam Roach <[e-mail]> wrote:
> 
> [as an individual]
> 
> On 11/5/17 1:31 PM, Paul Hoffman wrote:
>> On Nov 5, 2017, at 8:29 AM, Eliot Lear <[e-mail]> wrote:
>>> On 11/5/17 4:57 PM, Paul Hoffman wrote:
>>>> As to Eliot's main question: The policy to choose a DOH server is similar to the policy to choose a DNS resolver, it's just done in a different application. For the latter, the typical is "trust whatever DHCP tells you", but there are also commonly policies of "ignore DHCP, always use one of these". Both those policies could be mirrored in a browser for DOH.
>>>> 
>>> That's the theory.  In reality, for the enterprise, you would be hard
>>> pressed to find examples in which the enterprise itself doesn't control
>>> where a query goes on a client (DHCP is not the only control function).
>> It sounds like the operational document might say something like "an enterprise that cares about which DNS resolver its users access needs to also make that policy in DOH-enabled web clients".
> 
> s/web clients/DNS clients/, right?

Maybe?

> I don't get the impression that the use cases are intended to be restricted to web browsers as clients.

They are not restricted to web clients (I was careful not to say "browsers"), but I don't expect current DNS clients to add DOH capabilities any time in the near future. We have had approximately zero success in getting stub resolvers deployed with DNS-over-TLS (RFC 7858), and getting them to do that would be easier than DNS-encoded-in-HTTP-over-TLS. DNS clients are a use case listed in Section 3 of the draft, but not one that we've heard much interest in.

--Paul Hoffman