Re: [Doh] Tsvart last call review of draft-ietf-doh-dns-over-https-13

["Rene 'Renne' Bartsch, B.Sc. Informatics" <[e-mail]>]

Am 12.08.2018 um 01:34 schrieb Fernando Gont:
> Hello,
> 
> Thanks for the response. Inline....
> 
> On 08/12/2018 12:58 AM, Star Brilliant wrote:
>>> * Page 15:
>>>> It is the choice of a client to either
>>>>     perform full DNSSEC validation of answers or to trust the DoH server
>>>>     to do DNSSEC validation and inspect the AD (Authentic Data) bit in
>>>>     the returned message to determine whether an answer was authentic or
>>>>     not.
>>>
>>> Relying on the DoH server for DNSsec validation does not seem like a good idea.
>>> You want DNSsec to be end-to-end.
>>
>> We discussed about this paragraph before. The problem depends on how you deploy DoH services.
>>
>> 1) For most people's needs, the users grab a list of DoH servers from the Internet and configure their systems to use the DoH servers. These public servers are untrustworthy. So the users need to validate DNSSEC at their end.
> 
> This is the scenario I was assuming, for which it seemed a bad idea to
> ahve the DOH server do DNSsec validation. Anyway to clarify this so that
> others do't fall into the same assumption?

I suggest to add something like "the AD-bit MUST NOT be used if the upstream resolver is not under control of the client operator" (please, find some better wording).

Renne