Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh

["A. Schulze" <[e-mail]>]

Am 16.01.19 um 01:25 schrieb Paul Hoffman:
> So, does this WG want to adopt this as a work item?

Hello,

adopt "DoH Servers by TXT" using unbound is fairly simple.
Maybe someone could verify that config.

unbound.conf:
	# option 1:
	# resolver that understands this protocol but has no associated DoH server
	server:
	 local-data: 'resolver-associated-doh.arpa. TXT ""'

	# option 2:
	# resolver that understands this protocol and has one associated DoH server
	server:
	 local-data: 'resolver-associated-doh.arpa. TXT "https://doh.example/"'

	# option 3:
	# resolver that understands this protocol and has multiple associated DoH server
	server:
	 local-data: 'resolver-associated-doh.arpa. TXT "https://doh01.example/"'
	 local-data: 'resolver-associated-doh.arpa. TXT "https://doh02.example/"'

The second suggestion "DoH Servers by Addresses" isn't attractive to me.
Getting a certificate for an IP isn't common these days.

https://IPADDRESSGOESHERE/ -> Ask your favorite CA to issue a certificate for "IPADDRESSGOESHERE"...

also: 
 * https://[2001:db8::53]/ -> Address in []
 * Certificate SAN Entry   -> Address without []
can this work with IPv6? I simply never tried that...

I agree with Ralf on defining something similar for DoT, too

Andreas