Re: [Doh] [Ext] Are we missing an architecture? (was Re: DNS Camel thoughts: TC and message size)

Sara Dickinson <> Thu, 14 June 2018 14:00 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 3C022131163 for <>; Thu, 14 Jun 2018 07:00:59 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -4.199
X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id NrLh_SvYwEOw for <>; Thu, 14 Jun 2018 07:00:57 -0700 (PDT)
Received: from ( [IPv6:2a00:1098:0:86:1000:0:2:1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 91315131160 for <>; Thu, 14 Jun 2018 07:00:57 -0700 (PDT)
Received: from [] (port=5090 helo=[]) by with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from <>) id 1fTSnu-0006x7-C6; Thu, 14 Jun 2018 15:00:50 +0100
Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 11.4 \(3445.8.2\))
From: Sara Dickinson <>
In-Reply-To: <>
Date: Thu, 14 Jun 2018 15:00:24 +0100
Cc: Mukund Sivaraman <>, Ben Schwartz <>, DoH WG <>, =?utf-8?B?UGV0ciDFoHBhxI1law==?= <>, Patrick McManus <>
Content-Transfer-Encoding: quoted-printable
Message-Id: <>
References: <> <> <> <> <> <20180613192030.GA2792@jurassic> <> <20180613205637.GA23215@jurassic> <> <20180614042217.GA25915@jurassic> <20180614044113.GA27115@jurassic> <>
To: Daniel Stenberg <>
X-Mailer: Apple Mail (2.3445.8.2)
X-BlackCat-Spam-Score: 4
Archived-At: <>
Subject: Re: [Doh] [Ext] Are we missing an architecture? (was Re: DNS Camel thoughts: TC and message size)
X-Mailman-Version: 2.1.26
Precedence: list
List-Id: DNS Over HTTPS <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 14 Jun 2018 14:01:00 -0000

> On 14 Jun 2018, at 09:14, Daniel Stenberg <>; wrote:
> On Thu, 14 Jun 2018, Mukund Sivaraman wrote:
>> The switch to DoH at the application layer seems suddenly upon us. I was thinking of DoH just as a fallback transport, but suddenly it seems almost like this is the new way to do DNS queries (a switch).
> Users have wanted (and used) "name resolving in the application" layer since a long time in various situations. The fact that the standard operating system APIs make this hard has never taken away the desire or will for a lot of solutions to be able to ask their *preferred* resolvers. Why shouldn't applications be able to decide this?

Applications are free to decide it but it is not without consequences, for example:

1) Many enterprises rely on using internal views for DNS from servers provided by DHCP. If applications override this by _default_ then that model completely breaks internal name resolution _and_ leaks internal queries to the external resolver. Some might consider that a loss of security and privacy. 

2) By ‘users’ above I think you mean ‘application developers’ not ‘actual end users’? While their may be good reasons for application developers to want to do this I would postulate that actual end users who understand enough about DNS to want to control it would prefer to have a single system setting to configure it to point at _their_ preferred resolver, rather than a (transport/DNSSEC/resolver) setting existing in every individual application. 

I’m not saying there is a right or wrong model here, just that there are more concerns than simply what the application prefers.