Re: [Doh] [Ext] DOH bypassing protection mechanisms

[Paul Hoffman <[e-mail]>]

> On 5 Nov 2017, at 0:30, Eliot Lear wrote:
>
>>   * Use of DoH will bypass protection mechanisms commonly used to
>>     efficiently detect and prevent access to known malware-infested
>>     sites.  There are two mitigation mechanisms available, but one is
>>     incomplete:  deployments make use of in-path blocking methods such
>>     as IP access lists.  This is partial because there is a
>>     performance/memory impact in doing so, and the query itself can
>>     indicate that the device itself is infected.  The other mitigation
>>     here is to have a configuration mechanism to turn on/off DoH in
>>     order to use the existing infrastructure.  This has the least impact
>>     on surrounding infrastructure (and takes the least text ;-).

On 5 Nov 2017, at 7:48, tjw ietf wrote:

> in the case of detect and prevent access to known malware-infested
> sites, could;n't DoH deploy an RPZ like mechanism?
>

Yes. A DOH server is just like any DNS recursive resolver that a user might choose (such as from DHCP). It could use RPZ, it could offer anti-malware, it could be be malicious itself, ...

As to Eliot's main question: The policy to choose a DOH server is similar to the policy to choose a DNS resolver, it's just done in a different application. For the latter, the typical is "trust whatever DHCP tells you", but there are also commonly policies of "ignore DHCP, always use one of these". Both those policies could be mirrored in a browser for DOH.

--Paul Hoffman