[Doh] Suggestion: The final endpoint should be able to temporarly act as a recursive DoH resolver

["Sebastian Nielsen" <[e-mail]>]

I have a suggestion for extending the DoH specification:

 

The final endpoint, should be able to act as a authorative and sometimes
recursive DoH resolver if it has support for the DoH protocol, during the
normal HTTPS connection.

 

This could mean that once you reach a WWW server, theres no need for looking
up domains like static.example.org and such since the result of such domains
could be returned by the original HTTPS server over the same connection as
the website traffic goes over.

If the HTTPS server has other domains for example ads.thirdparty-example.org
as links it could return those aswell but only if they are DNSSEC signed,
and for security, a DoH client should only accept results for a third-party
domain if the result is DNSSEC signed.

 

To avoid abuse, a WWW server supporting this extension should only allow
queries for its own domain and subdomains, and also queries for any
resources it has been configured to resolve (and this type of configuration
could be done automatically by for example a script on the web server that
adds all external links to its ACL)

 

This would mean an WWW server serving content for itself and also have links
to ads.thirdparty-example.org could have those 2 domains cached in its
internal DoH resolver and resolve for those, thus once you reach a webpage's
server, you no longer need to talk to your recursive DoH serverl, which also
increases privacy.

 

This could lead to much faster response times aswell, as the WWW server
would have the information about all its linked hosts permanently cached and
updated regularly.

Think like OCSP stapling but for DNS responses instead.

 

 

Best regard, Sebastian Nielsen