Re: [Doh] [Ext] Re: Associating a DoH server with a resolver

[Eric Rescorla <[e-mail]>]

On Wed, Oct 24, 2018 at 9:11 AM Paul Hoffman <[e-mail]> wrote:

> On Oct 23, 2018, at 8:18 PM, Eric Rescorla <[e-mail]> wrote:
>
> Several points here:
>
> 1. As a matter of aesthetics, I agree with Martin that domain names would
> be better.
>
>
> If we can get non-address records back, I would prefer to go all the way
> to "here are the URI templates of the DoH servers". No need to cause
> another round-trip.
>
> 2. Martin sent a link to a method for resolving TXT records on Windows.
> MacOS has its own API: https://developer.apple.com/documentation/dnssd/1804747-dnsservicequeryrecord?language=objc
> [developer.apple.com]
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__developer.apple.com_documentation_dnssd_1804747-2Ddnsservicequeryrecord-3Flanguage-3Dobjc&d=DwMFaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=yvHk3BrvY-tKWGRmaFbQS1aHXNfQjC40fPfI5u1VsFs&m=iJ8qV6wySJ414-hN_AOIVx2XwwybAWbVxH5x8UIf4kQ&s=5WHmwl5icl3kObdG8_5f2rpWhKXSf4wIs0YR6IefeDA&e=>
> .
> So, this doesn't seem prohibitive to me.
>
>
> I thought this only worked for DNSSD, not DNS. Does it work for both? Or
> is there a similar-flavored Mac call for DNS?
>

I am reliably informed it works for ordinary DNS.


4. There are other uses cases for which it might be nice to have real
domain names, in which case the IP address cert thing is a pain.

For these reasons, I think a domain name in TXT or the like would be better.


Do you see a use case for domain names other than "here's a way to get to a
> well-known URI on the resolver"? If so, we could add that as well as "here
> are the URI templates for the associated DoH server.
>

I think templates would be fine.

-Ekr


> --Paul Hoffman
>