[Doh] Ignore AD (Authentic Data) bit

["Rene 'Renne' Bartsch, B.Sc. Informatics" <[e-mail]>]

Hi,

the AD-bit is just a flag forwarded by the DoH-server to the DoH-client. 
Nobody knows where or by whom DNSSEC-'validation' was done or if someone 
tampered with the AD bit on the DoH-server or any upstream 
server/connection. A security chain is only as strong as the weakeast 
link. To make matters worse router vendors lull users in a false sense 
of security by advertising DNSSEC support while only passing along the 
AD-bit instead of doing DNSSEC validation on the router. This undermines 
the reputation of DNSSEC. In my opinion the AD-bit should never ever 
have made it into the DNSSEC-RFCs.

I suggest to replace the text

'It is the choice of a client to either perform full DNSSEC validation 
of answers or to trust the DoH server to do DNSSEC validation and 
inspect the AD (Authentic Data) bit in the returned message to determine 
whether an answer was authentic or not.'

in section '9. Security Considerations' with

'The DNSSEC AD (Authentic Data) bit MUST be ignored by DoH clients to 
avoid AD bits manipulated on the DoH server, upstream servers or 
upstream connections.'

Regards,

Renne