Re: [Doh] Associating a DoH server with a resolver

Why do the IP-based spelunking?  It requires that the resolver (which
might not be a DoH server) do HTTP as well.  Can't you define a record
that could be placed at the resolver-addresses.arpa name?  I hesitate
to say TXT, but I can't think of a good reason not to use that in this
case.  Multiple such records could identify different DNS-over-foo
variants.
On Wed, Oct 24, 2018 at 7:15 AM Paul Hoffman <paul.hoffman@icann.org> wrote:
>
> Post-RFC-publication greetings. One of the topics that has been active in the DNS community since the standardization of DoH is how a browser or web application could use the resolver that the operating system on which it is running as a DoH server, or at least to use a DoH server associated with that resolver. I have taken a few stabs at designing a protocol to make it possible to fulfill that need; the result is the draft below.
>
> The draft is still in a very early stage. In fact, I've changed the underlying mechanism three times already because I forgot what browsers and operating systems could not do. I *think* the current draft is possible, but would not be surprised if someone pointed out that even this attempt is wrong. Regardless, the desire for such functionality seems strong.
>
> Also note the Security Considerations section of the draft. In short: all this gives you is opportunistic encryption because (I believe) we can't get any better now. I would be happy to be wrong about that, of course.
>
> Thoughts?
>
> --Paul Hoffman
>
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
>
>
>         Title           : Associating a DoH Server with a Resolver
>         Author          : Paul Hoffman
>         Filename        : draft-hoffman-resolver-associated-doh-04.txt
>         Pages           : 8
>         Date            : 2018-10-23
>
> Abstract:
>    Browsers and web applications may want to know if there are one or
>    more DoH servers associated with the DNS recursive resolver that the
>    operating system is already using.  This would allow them to get DNS
>    responses from a resolver that the user (or, more likely, the user's
>    network administrator) has already chosen.  This document describes a
>    protocol for a resolver to tell a client what its associated DoH
>    servers are.
>
>
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-hoffman-resolver-associated-doh/
>
> There are also htmlized versions available at:
> https://tools.ietf.org/html/draft-hoffman-resolver-associated-doh-04
> https://datatracker.ietf.org/doc/html/draft-hoffman-resolver-associated-doh-04
>
> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=draft-hoffman-resolver-associated-doh-04
>
> _______________________________________________
> Doh mailing list
> Doh@ietf.org
> https://www.ietf.org/mailman/listinfo/doh