Re: [Doh] I-D Action: draft-ietf-doh-resolver-associated-doh-03.txt

[Stephane Bortzmeyer <[e-mail]>]

On Sun, Mar 24, 2019 at 01:14:54AM -0700,
 [e-mail] <[e-mail]> wrote 
 a message of 43 lines which said:

>         Title           : Associating a DoH Server with a Resolver
>         Author          : Paul Hoffman
> 	Filename        : draft-ietf-doh-resolver-associated-doh-03.txt

My biggest issue is that the rationale in section 1 has many weak points:

* "There is a use case for browsers and web applications". Why not for
local limited resolvers like stubby or systemd-resolve? We assume they
will always prefer DoT?

* "much less often, they use manual configuration" Less often but more
and more, to workaround failures and/or censorships. On a gamer forum,
these days, any report of an issue, whatever the issue is, elicit a
suggestion "switch to [some public DNS resolver]"

* "In a common scenario" "Common" is way too vague for something which
exists in *some* corporate networks but never (I hope so!) in public
ISPs.

Otherwise, even after reading the whole thread "Reviewing
Resolver-Associated DOH", I don't understand why https is required in
section 2. We don't require DNSSEC in section 3, so why having
stronger requirments for HTTP? Since having certificates for IP
addresses will be difficult in practice, why not just accepting http
as well as https? (Or, <horror>https without cert. checking</horror>.)

Editorial:

* in section 5, server is written serer.

* in section 1, "Users typically configure their DNS recursive
resolvers with through automatic configuration" With through?