Re: [Doh] Talking to my resolver

[Ben Schwartz <[e-mail]>]

On Sun, Mar 17, 2019 at 6:03 PM Martin Thomson <[e-mail]> wrote:

> I don't know if there is any hope of adding a general facility to DNS
> where a client could talk to the server about itself, rather than the data
> that it can provide.


As a chair, I agree with nusenu that this topic might be out of charter,
but if we decide that it is the best course of action then we can make
organizational changes as necessary.  We may also be able to find a
balance, by implementing a DoH-specific practice that seems likely to
generalize well.


> p.p.s., I really wish that DoT had decided to add some meta-information
> channel.  That solves a bunch of these issues.  I guess we can ALPN-up
> ourselves a v2 if we needed one.
>

Not as chair, here's a free, slightly unsettling idea: use the "h2" ALPN on
port 853 to negotiate a DoT-to-DoH upgrade during the TLS handshake.


> On Sat, Mar 16, 2019, at 00:13, Ben Schwartz wrote:
> > I'd like to thank the working group participants for the extensive
> > discussion of our most recent drafts. However, I would appreciate more
> > review of the Resolver-Associated DOH draft, which has the largest time
> > segment allocated for the upcoming meeting. This draft contains several
> > components that have been controversial in the past:
> >
> > 1. IP-address certificates
> > 2. A new .well-known endpoint
> > 3. JSON
> > 4. Recursive resolvers synthesizing responses as if they were
> > authoritative for certain names
> > 5. Machine-readable content in a TXT record
> >
> > Also, the draft does not enable the use of DoH if (1) an application
> > relies on POSIX-like DNS APIs to bootstrap AND (2) the resolver is only
> > reachable on a non-public IP address (e.g. RFC 1918). This is a side
> > effect of the requirement that the DoH server provide a valid
> > certificate for its name, chained to a root that is already trusted by
> > the client. This draft does not alter that requirement.
> >
> > If any of these technical elements are of concern to you, please
> > comment now, so that the meeting can be as productive as possible.
> >
> > --Ben
> > _______________________________________________
> > Doh mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/doh
> >
> > Attachments:
> > * smime.p7s
>
> _______________________________________________
> Doh mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/doh
>