Re: [Doh] [EXTERNAL] Reviewing Resolver-Associated DOH

["Winfield, Alister" <[e-mail]>]

  1.  IP-address certificates

Bad ! Especially if the less enlightened think to try to create a certificate for a private IP. Very bad idea.


  1.  A new .well-known endpoint

Maybe someone can suggest a better location that doesn’t break things.

4. Recursive resolvers synthesizing responses as if they were authoritative for certain names
5. Machine-readable content in a TXT record

Also, the draft does not enable the use of DoH if (1) an application relies on POSIX-like DNS APIs to bootstrap AND (2) the resolver is only reachable on a non-public IP address (e.g. RFC 1918).  This is a side effect of the requirement that the DoH server provide a valid certificate for its name, chained to a root that is already trusted by the client.  This draft does not alter that requirement.

If any of these technical elements are of concern to you, please comment now, so that the meeting can be as productive as possible.

--Ben
Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and Sky International AG and are used under licence.

Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075), Sky Subscribers Services Limited (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD