Re: [Doh] [Ext] Re: Associating a DoH server with a resolver

[Adam Roach <[e-mail]>]

On 10/23/18 10:18 PM, Eric Rescorla wrote:
> Several points here:
>
> 1. As a matter of aesthetics, I agree with Martin that domain names 
> would be better.
> 2. Martin sent a link to a method for resolving TXT records on 
> Windows. MacOS has its own API: 
> https://developer.apple.com/documentation/dnssd/1804747-dnsservicequeryrecord?language=objc.
> So, this doesn't seem prohibitive to me.
> 3. It seems like in the use case for which this draft is specified, 
> the whole thing is pretty opportunistic, so IP address certs wouldn't 
> be required.
> 4. There are other uses cases for which it might be nice to have real 
> domain names, in which case the IP address cert thing is a pain.
>
> For these reasons, I think a domain name in TXT or the like would be 
> better.


If we are going for non-A/AAAA record types, then I would suggest that 
we use the record to directly indicate the URI instead of having to 
synthesize one using a .well-known path. I would also point out that we 
already have a resource record type for converting desired services into 
URIs (RFC 7553).

So, e.g., interested clients would query for a URI record of type 
_doh._tcp.resolvers.arpa, and get back a full HTTPS URL as a response.

/a