Re: [Doh] [Ext] Re: Associating a DoH server with a resolver

Erik Nygren <> Sat, 23 March 2019 21:41 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 8B8E212AF7A for <>; Sat, 23 Mar 2019 14:41:34 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.648
X-Spam-Status: No, score=-1.648 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.25, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id rzTpGdoqloJ2 for <>; Sat, 23 Mar 2019 14:41:33 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id C819E128B36 for <>; Sat, 23 Mar 2019 14:41:32 -0700 (PDT)
Received: by with SMTP id t124so5317171wma.4 for <>; Sat, 23 Mar 2019 14:41:32 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=m2isSoq6n6ZCdyV4vVvebZrBRH0i5RFhJl3QpHS+M3A=; b=ip4WDqUmGW0FxvYkONmAgMMn71gFjW924LQfgAgrCdI33/L1VB2IjdQNUuQy2ozZ5m ISFHDhbFLC7bptTueUz3DvMsGQM0j0bi8JMzOsNOlvXuUMfnPLFJhCCJ+Yqj6IocAuDT owYHDfxn6j4zqEvRhPRuKWFFHUDa056fyU+gPczjP33a8bDJUWe58udDTqoY5Xj6jYMX 9+n1FnOJBYigWPTJfFrDLQTe0cDLL5z4QIni3DGhHsvJOOAOBm9j2G4L06UI0m0iTFMn JnR9PLKVYeIHhrNh2LRijOtg3MJX73jaRD91+dxHiEd2q8py2S9e23hyKhh5v9N87mEX jI+g==
X-Gm-Message-State: APjAAAX3H49BHitaf/oPHHXVFZxKas7rl1Hi134P/4GameEFXVCEVJyA /04wWJWqDfUOHFr8d8CYvKe34GVB277KPrd9Ta8=
X-Google-Smtp-Source: APXvYqyEVjLajI1yZIr6lSkll3gmn+0AOlz9/zjVWxEHs6IxVIqBgkG8QiSe9EOBv+mk+Lr3eOFSQcIg4CW8sDD03Ww=
X-Received: by 2002:a1c:eb14:: with SMTP id j20mr1002885wmh.32.1553377291168; Sat, 23 Mar 2019 14:41:31 -0700 (PDT)
MIME-Version: 1.0
References: <> <> <> <> <> <>
In-Reply-To: <>
From: Erik Nygren <>
Date: Sat, 23 Mar 2019 17:41:19 -0400
Message-ID: <>
To: Adam Roach <>
Cc: Eric Rescorla <>, Martin Thomson <>, Paul Hoffman <>, DoH WG <>
Content-Type: multipart/alternative; boundary="000000000000a471960584c9d51f"
Archived-At: <>
Subject: Re: [Doh] [Ext] Re: Associating a DoH server with a resolver
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: DNS Over HTTPS <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sat, 23 Mar 2019 21:41:35 -0000

On Tue, Oct 23, 2018 at 11:40 PM Adam Roach <> wrote:

> So, e.g., interested clients would query for a URI record of type
>, and get back a full HTTPS URL as a response.

Reviving this suggestion after reading some recent threads, this approach
(query your local OS-configured resolver for a URI record with a well-known
seems like a reasonably cleanish way to opportunitistically get a DoH
server URI
associated with the currently configured resolver.   It's arguably less of
a hack
than cramming things into a TXT record on a reverse DNS IP.

(Martin asked on a more recent thread something along the lines of "why
we just do a .well-known lookup against the network-configured resolver,
and something
like this seemed like the best equivalent.)

For better or worse it would also work when a caching forwarding resolver
is present
in passing through the record from whatever the caching forwarding resolver
dnsmasq in a home gateway) was pointing to.  It also has the benefit that
clients don't
need to know the IP address of their resolver, they just need to be able to
do a URI record
lookup against a well-known name.

Especially of the OS helps mediate DoH server selection (which would be
long-term regardless) the exact OS APIs that exist today are somewhat less


(Purely for enterrainment value: this well-known name could be in some
other class
like CHAOS rather than IN, like some other recursive-resolver-synthesized
like "version.bind txt chaos".  This is not meant to be a serious