Re: [Doh] operational considerations

[Jim Reid <[e-mail]>]

> On 19 Nov 2017, at 01:48, Patrick McManus <[e-mail]> wrote:
> 
> Different DNS servers may provide different results to the same query. It logically follows that which server is consulted influences the end result. Split-horizon DNS [RFC6950] is a specific example of this approach where the answers are derived from the (potentially natted) source of the query. A client that chooses to query a non-default resolver for a name that is using this style of algorithm may not obtain correct results.

I think the last sentence could be improved by deleting the reference to "non-default" and "correct results”. First, it’s not clear what a default resolver is. Or what that means. Second, the result that one of these non-default resolvers may well be correct since the correct DNS response depends on the context: ie someone on the internal net gets back the correct internal web site (or whatever) instead of the incorrect public-facing one. We could probably lose “(potentially natted)” too since that doesn’t seem to add anything useful IMO.

How about the following instead?

Different DNS servers may provide different results to the same query. It logically follows that which server is consulted influences the end result. Split-horizon DNS [RFC6950] is a specific example of this approach where the answers are derived from the source of the query. A client that chooses to query a resolver which uses these sorts of policy-based approaches can expect to sometimes be returned different answers from the responses given by resolvers which do not use them.