Re: [Doh] Seeking input on draft-03

Stephen Farrell <> Fri, 09 February 2018 09:24 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 05A2A12422F for <>; Fri, 9 Feb 2018 01:24:03 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -4.311
X-Spam-Status: No, score=-4.311 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id S9snsGfteiEF for <>; Fri, 9 Feb 2018 01:23:59 -0800 (PST)
Received: from ( []) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id D503D12420B for <>; Fri, 9 Feb 2018 01:23:58 -0800 (PST)
Received: from localhost (localhost []) by (Postfix) with ESMTP id 378EABE4D; Fri, 9 Feb 2018 09:23:56 +0000 (GMT)
X-Virus-Scanned: Debian amavisd-new at
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 5h9n2E65AjbT; Fri, 9 Feb 2018 09:23:54 +0000 (GMT)
Received: from [] ( []) by (Postfix) with ESMTPSA id 55E7CBE49; Fri, 9 Feb 2018 09:23:54 +0000 (GMT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;; s=mail; t=1518168234; bh=vAKdT7mer22fn6W4AaESwSo6Xcytpd2DwGhAYXma7MM=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=M01zAhEd4ylSFmtpEIZGC6WiRwxTTt3RtKyljugKjVN9UPZEaHSCf92liaL90icAP dHlFLSL9Dn4auOJyfD+/6oSuO99OvY1H6lVxbpHVW1+adFMneO7RNUvYEREDXHnVQy FJEoda+kUXT/i9Ms6+/YBoCS4mI0Sdm6uFKNEwoc=
To: Patrick McManus <>
Cc: Ben Schwartz <>,
References: <> <> <>
From: Stephen Farrell <>
Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url=
Message-ID: <>
Date: Fri, 9 Feb 2018 09:23:53 +0000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.6.0
MIME-Version: 1.0
In-Reply-To: <>
Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="3zP56FoX6pmdaVUyaUUZEUkvvhxW6joUp"
Archived-At: <>
Subject: Re: [Doh] Seeking input on draft-03
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: DNS Over HTTPS <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 09 Feb 2018 09:24:03 -0000

Thanks Patrick,

On 08/02/18 20:24, Patrick McManus wrote:
> WRT the removal of .wk:
> * its previous presence had never been meant as a discovery mechanism of
> the form "I know a hostname, therefore I know the URL". origin is a
> security primitive for http, but its not an addressing primitive for http
> services such as a DoH endpoint.. indeed the DoH server might sensibly wish
> to offer multiple URIs on the same host (in the same way some free dns

Fair point.

> providers make a variety of resolution policies available with different IP
> addresses).  The configuration primitive for a DoH server is the URI - not
> origin.
> * I had originally included .wk as a bit of future proofing for a use case
> not part of the DoH charter (not to enable it, but being sure not to
> preclude it at a later time). I have been convinced that .wk is not
> necessary for that - and so it was removed from the draft. I regret that
> these two things were confused by readers of <= -02 due to my own
> composition skills (or lack thereof).
> As to Stephen's query - this was both discussed f2f in singapore and
> . Of

I read that and it's overall convincing enough for me.

I do also wonder about the point raised there about doing surveys of
doh deployments - as one poster (willscott) said though, I'm not sure
if I think enabling that is a good thing or not. (The downside being
that censors discover deployments too.) I'd not argue that's reason
enough to retain well-known in the draft.


> course there hasn't been consensus declared on the issue - the editors are
> just trying to make the newer drafts as closely aligned with the group's
> discussion as we can manage as part of the proces> -P
> On Thu, Feb 8, 2018 at 2:56 PM, Stephen Farrell <>
> wrote:
>> On 08/02/18 18:05, Ben Schwartz wrote:
>>> One important difference is that draft-03 no longer proposes a
>>> ".well-known" entry.  In draft-02 and prior, clients could check for the
>>> presence of a DOH service at the default path, given only the domain name
>>> of a server.  In draft-03, there is no default path, so clients must be
>>> configured with the full URL of the DOH endpoint.
>> Apologies if I'm forgetting a thread where this was discussed,
>> but what's the reason for dropping .well-known? (If there is a
>> thread, a pointer to that is a sufficient answer.)
>> Thanks,
>> S.
>> --
>> PGP key change time for me.
>> New-ID 7B172BEA; old-ID 805F8DA2 expires Jan 24 2018.
>> NewWithOld sigs in keyservers.
>> Sorry if that mucks something up;-)
>> _______________________________________________
>> Doh mailing list

PGP key change time for me.
New-ID 7B172BEA; old-ID 805F8DA2 expires Jan 24 2018.
NewWithOld sigs in keyservers.
Sorry if that mucks something up;-)