Re: [Doh] [Ext] Re: Associating a DoH server with a resolver

[Erik Nygren <[e-mail]>]

On Tue, Oct 23, 2018 at 11:40 PM Adam Roach <[e-mail]> wrote:

>
> So, e.g., interested clients would query for a URI record of type
> _doh._tcp.resolvers.arpa, and get back a full HTTPS URL as a response.
>

Reviving this suggestion after reading some recent threads, this approach
(query your local OS-configured resolver for a URI record with a well-known
name)
seems like a reasonably cleanish way to opportunitistically get a DoH
server URI
associated with the currently configured resolver.   It's arguably less of
a hack
than cramming things into a TXT record on a reverse DNS IP.

(Martin asked on a more recent thread something along the lines of "why
don't
we just do a .well-known lookup against the network-configured resolver,
and something
like this seemed like the best equivalent.)

For better or worse it would also work when a caching forwarding resolver
is present
in passing through the record from whatever the caching forwarding resolver
(eg,
dnsmasq in a home gateway) was pointing to.  It also has the benefit that
clients don't
need to know the IP address of their resolver, they just need to be able to
do a URI record
lookup against a well-known name.

Especially of the OS helps mediate DoH server selection (which would be
beneficial
long-term regardless) the exact OS APIs that exist today are somewhat less
interesting.

      Erik


(Purely for enterrainment value: this well-known name could be in some
other class
like CHAOS rather than IN, like some other recursive-resolver-synthesized
names
like "version.bind txt chaos".  This is not meant to be a serious
suggestion.)