[Doh] on blackholing resolver-associated-doh.arpa and resolver-associated-doh.arpa

[Joe Abley <[e-mail]>]

Hi all,

There was a suggestion at the microphone this morning in the Grand Ballroom that the resolver-associated-doh.arpa and resolver-associated-doh.arpa domains be "blackholed". The draft currently specifies that these MUST NOT be delegated from ARPA.

The microphone queue was already cut off before I could ask more about what this means, but I think it's worth reminding the wg what blackhole generally means in this context of DNS names in and near ARPA, and how it can be implemented, since I think there is a security concern.

RFC 7534 provides two mechanisms to blackhole DNS traffic: one uses DNAME (see RFC 7535) and the other uses a zone cut. The DNAME approach is technically compatible with the MUST NOT in the draft (since it's technically not a delegation but rather a redirection) but the direct delegation mechanism is not.

In both cases, however, blackholing these domains would point their DNS resolution away from the authoritative servers that serve ARPA towards a loosely-coordinated set of AS112 servers.

Anybody can operate an AS112 server; in fact, operators have in the past been actively encouraged to operate AS112 servers without any requirement for coordination. This has been considered a reasonable approach so long as the query data being sent to AS112 servers is recognised to be junk that only leaks by accident; since it's generally private network PTR query traffic the potential for exploitation by bad actors (malicious AS112 node operators) is arguably low.

However, in the case of these doh resolver domains, there is the potential for a bad actor to respond with an unauthorised list of DoH URIs and steal the resolver traffic of a large array of end-users whose local (or configured) resolvers don't implement the mechanisms described in this draft. This would be a bit like DNS changer, but without the need to infect individual end-hosts..

I think this a problem.

I think (in contrast to the thought at the microphone) if we mention blackholing at all it ought to be of the form "don't ever do this because it would be bad for the following reasons".


Joe