Re: [Doh] DOH and split DNS

[Eliot Lear <[e-mail]>]

On 11/6/17 5:30 PM, Andrew Sullivan wrote:
> On Mon, Nov 06, 2017 at 11:13:19AM +1100, Mark Nottingham wrote:
>>  Some careful wording around the configuration mechanism should help.
>>
>> Allowing something like proxy.pac to override DOH doesn't make any sense, given that the primary purpose of DOH is to NOT allow the local network to impose policy on communication with the DNS server.
>>
> That careful wording had better be pretty careful.  I don't believe
> for an instant that most users have a workable theory for which
> resolution mechanism they're using, and if they configure DOH and
> suddenly all the "internal sites" don't work they're going to be
> pretty surprised.
>
> It strikes me as pretty strange, too, to suggest that, if a user
> configures proxy.pac, they don't want the local network to offer such
> policies.  If the user is prepared to use the proxy, presumably the
> user is prepared to use it to impose local policy, no?
>

That was my thinking, but I will add that this needs some more
thinking.  proxy.pac files can contain many things to match off of, and
if it's an IP address range, it won't be useful.  If it's a domain name
or wildcard (like .mydomain.example.com) then perhaps so.  Also, there
are some corner cases when it might not work- in some environments a
proxy may be required internally.  As such, when something is not
"direct" it might still be within one side of a split DNS fence, as it
were, and so the proxy.pac file would give the wrong answer. 

Eliot