Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh

[bert hubert <[e-mail]>]

On Wed, Jan 16, 2019 at 12:25:55AM +0000, Paul Hoffman wrote:
> So, does this WG want to adopt this as a work item?

Yes. My reasoning is as follows. Even though it is a challenging subject,
if we don't do it bad things will happen. As long as there is no way to
associate a network with an encrypted DNS provider (DoH in this case), we
can not rebut the argument "we simply HAVE to centralize the DNS on this
cloud provider because there is no alternative".

Regardless of what we think about the desireability of centralized or
decentralized DNS, it is never good if there are no options.

So I hope we can give this a very hard think to see what we can come up
with.

To stimulate the discussion a bit, it turns out browsers already contain a
list of providers they are willing to trust. It may be that the solution for
provisioning DoH securely also involves having a list of providers who are
allowed to provision DoH.

The existing list of trusted parties that can (not) be trusted is of course
the list of trusted certificate authorities.

	Bert