[Doh] Proposal: DNS configuration string

[Mateusz Jończyk <[e-mail]>]

Hello,

Currently, there are multiple ways of resolving DNS queries:

  * old port-53 DNS,
  * DNS over TLS,/
  * DNS over HTTPS.

Some of these accept additional parameters, such as server certificate
information (which may be necessary when using local DoH / DoT servers). These
parameters are server-specific --- when configuring multiple servers, each of
them may need different certificate information.

I would argue that it would be beneficial to embed all such parameters into a
single server specification string. The user would be able to copy-paste them,
for example from the website of their chosen DNS resolver, a file provided by
their sysadmin or from their router configuration GUI. A DHCP server could
advertise the string in a single field. Additionally, an application could pass
the whole string to a DNS-handling library. That way the application would not
have to implement support for all DNS configuration parameters on its own (with
complex GUIs) and new parameters (or even new DNS resolver types) could be
supported by the program after a library upgrade. This would also simplify
configuration file structure (allowing for a single server per line).

Some examples [3]:

  * *doh://dnsserver.example.net/dns-query{?dns};***ip=1.2.3.4*;root-***cert=***zdYsea0CQufOmBpLdLfu/q3tOOdxbBCuZNhAa+YuQWo*

  * *dns://1.2.3.4;valid-for=_nodot,.some-company*

I would like to propose to use a semicolon ';' as the separator between a
resolver address (or an URI template) and resolver parameters. Theoretically, a
DoH URI Template could contain a semicolon, but that should be very rare [1]. In
such cases, the semicolon would be percent-encoded as "%3B".

Parameter explanation:

  * *ip* - IP of the DoH resolver, used for bootstrapping,
  * *root-cert* - fingerprint of the root certificate of the DoH server
    (specified in a similar way as in HTTP certificate pinning),
  * *valid-for *- which domain names should be resolved by this server: in this
    example all names that do not contain a dot ("*_nodot*") [4] as well as all
    domains that end with "*.some-company*".

What do You think?

Greetings,

Mateusz



[1] A URI segment that begins with a semicolon is called a *path parameter*. An
example (taken from [2]) would be:

        *http://www.mysite.com/admin/UpdateUserServlet;jsessionid=OI24B9ASD7BSSD*

The URI template specification (RFC6570) supports expansion of path parameters
with a syntax like:

        *http://example.com/**{;who}*

[2] https://doriantaylor.com/policy/http-url-path-parameter-syntax

[3] The DoH specification requires that:

    "This protocol MUST be used with the https scheme URI [RFC7230]."

but I assume that using "doh://" does not break this as the statement is really
concerned with using encryption and not the "https://" string.

[4] The first character is intentionally "_" because it cannot exist in valid
domain names.