Re: [Doh] Dedicated DoH port

Would it make more sense to request something out of the well-known ports
range,
or at least outside of commonly-used ephemeral port ranges?

       Erik

On Thu, Apr 11, 2019 at 1:41 PM Tomas Krizek <tomas.krizek@nic.cz> wrote:

> Disclaimer: I don't adocate the use of a dedicated DoH port rather than
> using port 443 for most DoH traffic. I'm simply trying to establish
> reasonable defaults as a software developer and packager.
>
> Knot Resolver will use 44353 as the default port for DoH. We've
> considered using port 443 by default, but it presents many challenges.
>
> If an admin is already running an https service on the machine, the
> clash with DoH resolver can be quite problematic. In best case scenario,
> the admin runs into an error (not able to bind to port 443 - quite
> cryptical for someone trying to run DNS resolver who's not up to date
> about DoH development). In a worse case scenario, the DoH service might
> actually seem to successfully start and run alongside the unrelated
> https service (e.g. when both services use systemd socket activation
> with ReusePort=true - basically SO_REUSEPORT under systemd).
>
> Those who know what they're doing will have no issues configuring their
> DoH service to run on port 443. However, I think it's reasonable to use
> a different, dedicated port as DoH default for packaging, documentation
> etc.
>
> Since there is currently no IANA assigned DoH port, I've filed the
> following user port request with IANA to establish a common default that
> could be used among DNS vendors.
>
> Service Name:         [domain-doh]
> Desired Port Number:  [44353]
> Description:          [DNS query-response protocol over HTTPS]
> --
> Tomas Krizek
> PGP: 4A8B A48C 2AED 933B D495  C509 A1FB A5F7 EF8C 4869
>
> _______________________________________________
> Doh mailing list
> Doh@ietf.org
> https://www.ietf.org/mailman/listinfo/doh
>