Re: [Doh] A question of trust (was Re: Draft -09 and WGLC #2)

[Mateusz Jończyk <[e-mail]>]

Hello,

W dniu 29.05.2018 o 03:30, Patrick McManus pisze:
> "A DNS API client uses configuration to select the URI, and thus the DNS API
> server, used for resolution. [RFC2818] defines how HTTPS verifies the server's
> identity.
>
> A client MUST NOT use a different URI simply because it was discovered outside
> of configuration. Specifically, this specification does not extend DNS
> resolution privileges to URIs that are not recognized by the DNS API client as
> configured URIs. A future specification may support this case."

This does not differ much from the following text:

"A client MUST NOT use arbitrary DNS API servers. Instead, a client MUST only
use DNS API servers specified using mechanisms such as explicit configuration."

which happens to be what is specified by the current draft.

I think that the misunderstanding here stems from the fact that server trust is
specified in two distinct places in the document ("Security Considerations" and
"Selection of DNS API Server") and in each place differently.

I've been proposing over and over to unify both specifications. It is OK if Paul
(if I remember correctly) wants to have server trust defined in a separate
section outside "Security Considerations", but we should make both
specifications similar and make one of them refer to the other.

-----------------------------------------------------------------------------

I have also been thinking about the following mechanism:

A DNS API client would have a list of "trustworthy" DNS API servers, but which
DNS API server from that list is used could be selected using DHCP.

I sent this to the DRIU list [1], as I supposed it is more appropriate there.
But now such topics are being discussed on the DOH mailing list and so I am
posting it here.

It would have the following benefits:

1. Using one's own ISP's DNS server would allow DNS64.

2. It would give network administrators an easy way to choose a DNS provider
across a whole network (using DHCP) and configure it in one place instead of on
multiple machines.

3. It would also enable use of ISP's DNS API server (as a main server or as a
fallback), which would make it possible to share global DNS load across many
ISP's DNS servers. For details, see the quoted mail.

At the same time, it would provide protection against phishing and rogue actors.

Greetings,
Mateusz

[1] https://www.ietf.org/mail-archive/web/driu/current/msg00009.html