[Doh] Reviewing Resolver-Associated DOH

[Ben Schwartz <[e-mail]>]

I'd like to thank the working group participants for the extensive
discussion of our most recent drafts.  However, I would appreciate more
review of the Resolver-Associated DOH draft, which has the largest time
segment allocated for the upcoming meeting.  This draft contains several
components that have been controversial in the past:

1. IP-address certificates
2. A new .well-known endpoint
3. JSON
4. Recursive resolvers synthesizing responses as if they were authoritative
for certain names
5. Machine-readable content in a TXT record

Also, the draft does not enable the use of DoH if (1) an application relies
on POSIX-like DNS APIs to bootstrap AND (2) the resolver is only reachable
on a non-public IP address (e.g. RFC 1918).  This is a side effect of the
requirement that the DoH server provide a valid certificate for its name,
chained to a root that is already trusted by the client.  This draft does
not alter that requirement.

If any of these technical elements are of concern to you, please comment
now, so that the meeting can be as productive as possible.

--Ben