Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0CE62130DD3 for ; Mon, 19 Nov 2018 07:39:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M1hSzo3cMhh5 for ; Mon, 19 Nov 2018 07:39:19 -0800 (PST) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9F84A130DD8 for ; Mon, 19 Nov 2018 07:39:19 -0800 (PST) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Mon, 19 Nov 2018 07:39:17 -0800 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1367.000; Mon, 19 Nov 2018 07:39:17 -0800 From: Paul Hoffman To: bert hubert CC: "doh@ietf.org" Thread-Topic: [Doh] [Ext] DNS over HTTP/3? Thread-Index: AQHUgBpJDcHiU7C9TEuONF//QgGdoaVXwfYA Date: Mon, 19 Nov 2018 15:39:16 +0000 Message-ID: References: <20181119100954.GA6704@server.ds9a.nl> <5BE15B68-1C61-4462-AE84-901E2CF0F9F9@icann.org> <20181119151209.GC11506@server.ds9a.nl> In-Reply-To: <20181119151209.GC11506@server.ds9a.nl> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: multipart/signed; boundary="Apple-Mail=_F1A79C9B-90F8-480D-8DF8-28D559885D5B"; protocol="application/pkcs7-signature"; micalg=sha1 MIME-Version: 1.0 Archived-At: Subject: Re: [Doh] [Ext] DNS over HTTP/3? X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Nov 2018 15:39:22 -0000 --Apple-Mail=_F1A79C9B-90F8-480D-8DF8-28D559885D5B Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On Nov 19, 2018, at 7:12 AM, bert hubert = wrote: >=20 > On Mon, Nov 19, 2018 at 02:12:18PM +0000, Paul Hoffman wrote: >>> I've observed that the thousands of users of doh.powerdns.org (I = also do not >>> know how this happened) take around 22 packets per DNS = query/response.=20 >>=20 >> It would be valuable to know if this is this because your DoH server = kills >> the entire connection after every DNS query, or because the clients = are >> doing so. >=20 > It does around 2 DNS queries per HTTPS connection on average = dnsdist-doh > keeps open an HTTP/2 connection for 10 seconds if it becomes idle. Thanks, that seems to be your problem. Can the dnsdist DoH server = package be configured to have an idle timeout that is more = representative of typical browser use, such as on the order of minutes? >>> Larger scale adoption of TLSv1.3 might improve this somewhat, but it = is a >>> big number. >>=20 >> DoH was designed for long-lived connections, so the number would = normally be smaller after the initial connection. >=20 > I can only report what I measure based on several thousands of users. >=20 >>> I've also personally observed that a "slightly suboptimal" network >>> absolutely kills browsing performance in Firefox Nightly using DoH. = A naive >>> calculation shows that 0.5% packet loss turns into a 5% failure rate = per DoH >>> query, which then can cause Head of Line blocking for further = queries, which >>> cascades into "blank pages" getting rendered.=20 >>=20 >> When you say "naive calculation", do you mean this is observed in the >> clients hitting your DoH server? That would indeed be scary. = However, >> the Mozilla numbers tell a very different story. It would be good to = know >> which one is true. >=20 > My personal observation is that on a slightly bad network, turning off = DoH > speeds up things massively and makes the web useable again. This = naively > makes sense, DoH uses way more packets and suffers from Head of Line > blocking, unlike plain DNS. Is that still true with a server timeout that is not so short? > We have asked Mozilla to provide more details of their measurements, = but > these have not been forthcoming. Noted. It would be *really* useful to the community if there was better = communication from them. > Note that the graph published on the blog misses the 95% and 99% bins, > = https://blog.nightly.mozilla.org/files/2018/08/DNS-over-HTTPS-Performance-= Improvement.png > and does not include details on timeouts. Yep, and that would be useful too. >>> And, perhaps somewhat more provocatively, should we maybe not start = pushing >>> DoH/2 if it leaves people with a sub-standard experience, causing = them to >>> disable DoH? >>=20 >> If the implementations on the client or server side make using DoH = bad, >> those implementations should be fixed. If they don't get fixed, = we'll >> certainly hear about it. >=20 > There is already a Firefox ticket I think, but with Patrick and Daniel = gone > or gone soon, I am not sure who owns it now. Hopefully he or she will decloak soon. >=20 >>> DoH/3 might be somewhat of a wait but it might prevent that >>> sour taste from developing. >>=20 >> Without sufficient data, it's hard to say if there really is a sour = taste. >=20 > Perhaps Mozilla can clarify further what they measured beyond the 7 > milliseconds slowdown. >=20 > I may do some induced packetloss experiments to see if the = "experience" can > be reproduced. That would be grand, but it would also be good to have such experiments = when the server has a more sensible timeout value. --Paul Hoffman= --Apple-Mail=_F1A79C9B-90F8-480D-8DF8-28D559885D5B Content-Disposition: attachment; filename="smime.p7s" Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIL9DCCBZ4w ggSGoAMCAQICEAbzeOJeWp48+t/BRQQfhmcwDQYJKoZIhvcNAQELBQAwZTELMAkGA1UEBhMCVVMx FTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UE AxMbRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIENBMB4XDTE4MDYxMzAwMDAwMFoXDTIxMDYxMzEy MDAwMFowgb0xCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRQwEgYDVQQHEwtMb3Mg QW5nZWxlczE8MDoGA1UEChMzSW50ZXJuZXQgQ29ycG9yYXRpb24gZm9yIEFzc2lnbmVkIE5hbWVz IGFuZCBOdW1iZXJzMR4wHAYDVQQDExVQYXVsIEhvZmZtYW4gMjAxODA2MTMxJTAjBgkqhkiG9w0B CQEWFnBhdWwuaG9mZm1hbkBpY2Fubi5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCtNvEFt/FuTVXENCw6YSbXhi1rYATlwFwn+S0yQL5pCtMIxJetAl+OIxRSd2d8BPUNZx+ODvTq +8hNrWWQVougX1vpw0gIwqyJsWu4XLxkDZuwg9Fc8/NKxjrOJt1K00Kmu41NCiIv1sjGVCmpFTH8 F+8cCFLuDl0A5xGCSlb1DhKLluXoDapLQiYgzOS01xXGtYCfQewb27xwpxIIEnFq9ECcy39eETu0 IgKPKh6imthnbO2Z1lQvpSAw2sPP8qh40cBbNMAfjmGfUnPUiC4Ysz8zZVvyYXx4/fACHikxUiLa MLA2oLj3tHzHSWw2vKgb67L/bqcrp+EJOpV8XqGBAgMBAAGjggHvMIIB6zAfBgNVHSMEGDAWgBTn AiOAAE/Y17yUC9k/dDlJMjyKeTAdBgNVHQ4EFgQUP5JPmEQdtO4cllP2G6wM3tUtB2AwDAYDVR0T AQH/BAIwADAhBgNVHREEGjAYgRZwYXVsLmhvZmZtYW5AaWNhbm4ub3JnMA4GA1UdDwEB/wQEAwIF oDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwQwYDVR0gBDwwOjA4BgpghkgBhv1sBAEC MCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwgYgGA1UdHwSBgDB+ MD2gO6A5hjdodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRTSEEyQXNzdXJlZElEQ0Et ZzIuY3JsMD2gO6A5hjdodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRTSEEyQXNzdXJl ZElEQ0EtZzIuY3JsMHkGCCsGAQUFBwEBBG0wazAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGln aWNlcnQuY29tMEMGCCsGAQUFBzAChjdodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNl cnRTSEEyQXNzdXJlZElEQ0EuY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQADu8aIhNUm8QiAU3dRWzMP ifK3ySzx38iTlSPWM+4Pz41fiUGkM4i99iQKfwphKvH6wxCumhLZ6ds4zB6R5/e05uXaFUrZD62/ UaSw+r21D3wBvU52/Ugz1phpTVqVHn8QSFzS6qzVSXPZZRzzH9qd/f8ilsfIQ904IuIv2aJvgYMz zP2aq8AT4y2KypGzb7CUzML/rew0qkDop18E0owsefKoIAoXuW4ZanrXbI+YaiHrdsEuulElCisj 9+y/lITakrdd/ndb8Qt/qzFYyxeb2ISAx6gA60N4keu/6L6+WV3AcckrrOVch1WuPFGSXKAhJeaW x0ez+wOnUwSplM5cMIIGTjCCBTagAwIBAgIQBK55YGZmkBq5xX+mbFvczTANBgkqhkiG9w0BAQsF ADBlMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGln aWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3QgQ0EwHhcNMTMxMTA1 MTIwMDAwWhcNMjgxMTA1MTIwMDAwWjBlMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQg SW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBTSEEyIEFz c3VyZWQgSUQgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDc+BEjP2q178AneRst BYeiEEMx3w7UFRtPd6Qizj6McPC+B47dJyq8AR22LArK3WlYH0HtagUf2mN4WR4iLCv4un7JNTtW 8R98Qn4lsCMZxkU41z1E+SB8YK4csFoYBL6PO/ep8JSapgxjSbZBF1NAMr1P5lB6UB8lRejxia/N /17/UPPwFxH/vcWJ9b1iudj7jkUEhW2ZzcVITf0mqwI2Reo2119q4hqCQQrc6dn1kReOxiGtODwT 5h5/ZpzVTdlG2vbPUqd9OyTDtMFRNcab69TvfuR7A+FEvXoLN+BPy4KKDXEY5KbgiSwb87JzPMGw kp4Yfb2rfcV9CKEswp9zAgMBAAGjggL4MIIC9DASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB /wQEAwIBhjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0 LmNvbTCBgQYDVR0fBHoweDA6oDigNoY0aHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0 QXNzdXJlZElEUm9vdENBLmNybDA6oDigNoY0aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lD ZXJ0QXNzdXJlZElEUm9vdENBLmNybDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwggGz BgNVHSAEggGqMIIBpjCCAaIGCmCGSAGG/WwAAgQwggGSMCgGCCsGAQUFBwIBFhxodHRwczovL3d3 dy5kaWdpY2VydC5jb20vQ1BTMIIBZAYIKwYBBQUHAgIwggFWHoIBUgBBAG4AeQAgAHUAcwBlACAA bwBmACAAdABoAGkAcwAgAEMAZQByAHQAaQBmAGkAYwBhAHQAZQAgAGMAbwBuAHMAdABpAHQAdQB0 AGUAcwAgAGEAYwBjAGUAcAB0AGEAbgBjAGUAIABvAGYAIAB0AGgAZQAgAEQAaQBnAGkAQwBlAHIA dAAgAEMAUAAvAEMAUABTACAAYQBuAGQAIAB0AGgAZQAgAFIAZQBsAHkAaQBuAGcAIABQAGEAcgB0 AHkAIABBAGcAcgBlAGUAbQBlAG4AdAAgAHcAaABpAGMAaAAgAGwAaQBtAGkAdAAgAGwAaQBhAGIA aQBsAGkAdAB5ACAAYQBuAGQAIABhAHIAZQAgAGkAbgBjAG8AcgBwAG8AcgBhAHQAZQBkACAAaABl AHIAZQBpAG4AIABiAHkAIAByAGUAZgBlAHIAZQBuAGMAZQAuMB0GA1UdDgQWBBTnAiOAAE/Y17yU C9k/dDlJMjyKeTAfBgNVHSMEGDAWgBRF66Kv9JLLgjEtUYunpyGd823IDzANBgkqhkiG9w0BAQsF AAOCAQEATtSJJ7n9HYd3fg8oBZDxCi/JOz69k5yQxq/6kVGHMlRr6MrBcVFcmY61+uBiGZmmB5p8 Eyfb5QKihBLZFfYKRFfENI9tcx861qABPd7jguRFa7LrJf2AXh05kL5bQvbOkWDj+aBWDEgQzjNo e82Tq/Bqy09YD7l7XRsEgZ6nIuJXSSfukpMIvmkIUwI6Ll3IGfRQgE4C2bBdkbSTh/mWloFVQI5m 7YLYuyhf7Uxh7QZYKBlTEUS8RyApsgRs2IlUmTt122d4LB6SeMZVPVgSETJuvUMMTTTbe8ZC2+y+ q5thTAaS447fISpQVwTAYKI11SSeZjcJSc/V+GWz4OJuwjGCAxkwggMVAgEBMHkwZTELMAkGA1UE BhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEk MCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIENBAhAG83jiXlqePPrfwUUEH4ZnMAkG BSsOAwIaBQCgggF1MBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTE4 MTExOTE1MzkxN1owIwYJKoZIhvcNAQkEMRYEFDuvJsiHzRO/PHzgIZET+UEzvUYTMIGIBgkrBgEE AYI3EAQxezB5MGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQQIQ BvN44l5anjz638FFBB+GZzCBigYLKoZIhvcNAQkQAgsxe6B5MGUxCzAJBgNVBAYTAlVTMRUwEwYD VQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0Rp Z2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQQIQBvN44l5anjz638FFBB+GZzANBgkqhkiG9w0BAQEF AASCAQBhF9LMAJ0h35JVujX1LWdthrv9SHazHvIPhbhDR/kT/kfSTL0twQ+pwcNcp1/Dr11cikqi fnC7ltdA23oATHvEpscQqMKa99+HYQWeHz46Onah5QbXdbC9ag0mN8tA5JGh93JHI6wFpdLE+hkE yIMKrCiB+l7gcXqjNTqt1fX08MfhvWTv5oSxOQph3n0qaFxKL3RldVHlHxgRQ5q/Xi5Ob5HziBsP 2pDhFrQBF57d9TykMR+qpp4B6rAu1DivOENz2tbdGEm1F+PSwvvZczEDvBVy1XJ/fRsR29o/aF7Q 8/zfJBzw2CUcU0BaP37SvVzBURMmAutIzaluxPNZO1UpAAAAAAAA --Apple-Mail=_F1A79C9B-90F8-480D-8DF8-28D559885D5B--