Re: [Doh] Proposal: DNS configuration string

[Mark Nottingham <[e-mail]>]

Why not just convey this separately -- why does it have to be in the URL?

> On 2 Jun 2019, at 7:44 pm, Mateusz Jończyk <[e-mail]> wrote:
> 
> Signed PGP part
> Hello,
> 
> Currently, there are multiple ways of resolving DNS queries:
> 
> 	• old port-53 DNS,
> 	• DNS over TLS,/
> 	• DNS over HTTPS.
> Some of these accept additional parameters, such as server certificate information (which may be necessary when using local DoH / DoT servers). These parameters are server-specific --- when configuring multiple servers, each of them may need different certificate information.
> 
> I would argue that it would be beneficial to embed all such parameters into a single server specification string. The user would be able to copy-paste them, for example from the website of their chosen DNS resolver, a file provided by their sysadmin or from their router configuration GUI. A DHCP server could advertise the string in a single field. Additionally, an application could pass the whole string to a DNS-handling library. That way the application would not have to implement support for all DNS configuration parameters on its own (with complex GUIs) and new parameters (or even new DNS resolver types) could be supported by the program after a library upgrade. This would also simplify configuration file structure (allowing for a single server per line).
> 
> Some examples [3]:
> 
> 	• doh://dnsserver.example.net/dns-query{?dns};ip=1.2.3.4;root-cert=zdYsea0CQufOmBpLdLfu/q3tOOdxbBCuZNhAa+YuQWo
> 	• dns://1.2.3.4;valid-for=_nodot,.some-company
> I would like to propose to use a semicolon ';' as the separator between a resolver address (or an URI template) and resolver parameters. Theoretically, a DoH URI Template could contain a semicolon, but that should be very rare [1]. In such cases, the semicolon would be percent-encoded as "%3B".
> 
> Parameter explanation:
> 
> 	• ip - IP of the DoH resolver, used for bootstrapping,
> 	• root-cert - fingerprint of the root certificate of the DoH server (specified in a similar way as in HTTP certificate pinning),
> 	• valid-for - which domain names should be resolved by this server: in this example all names that do not contain a dot ("_nodot") [4] as well as all domains that end with ".some-company".
> What do You think?
> Greetings,
> 
> Mateusz
> 
> 
> 
> 
> 
> [1] A URI segment that begins with a semicolon is called a path parameter. An example (taken from [2]) would be:
> 
>         http://www.mysite.com/admin/UpdateUserServlet;jsessionid=OI24B9ASD7BSSD
> 
> The URI template specification (RFC6570) supports expansion of path parameters with a syntax like:
> 
>         http://example.com/{;who}
> 
> [2] https://doriantaylor.com/policy/http-url-path-parameter-syntax
> 
> [3] The DoH specification requires that:
> 
>     "This protocol MUST be used with the https scheme URI [RFC7230]."
> 
> but I assume that using "doh://" does not break this as the statement is really concerned with using encryption and not the "https://" string. 
> 
> [4] The first character is intentionally "_" because it cannot exist in valid domain names.
> 
> 
> 
> 

--
Mark Nottingham   https://www.mnot.net/