Re: [Driu] How to describe various flavors of DNS resolvers

[Philip Homburg <[e-mail]>]

>    This is something Willem and I have been working on:
> 
>    [2]https://github.com/pusateri/draft-tpwt-dhc-dns-discovery/blob/maste
>    r/draft-tpwt-dhc-dns-discovery.txt

For IPv6 it is unfortunately also necessary to consider router advertisements.
It might be worth trying to align the DHCPv6 options and any RA options 
such that they use as much as possible the same conceptual model.

>    But Ted Lemon is concerned that learning about private DNS over
>    DHCP is not much benefit because you cant trust the DNS server
>    you learn about.

>    3. Any DNS server providing DNS over TLS or DNS over HTTPS should
>    have DNSSEC records to show they are authentic servers and TLSA
>    records to ensure the client is talking to the actual server.

I wonder if, even just as strawman, we should document how to signal DNS over
TLS and DNS over HTTPS just using DNS, i.e.
- DANE in the reverse zone can signal TLS or HTTPS
- the PTR can be used as ADN
- SRV records can be used to specify ports as well as ADNs and also signal
  DNS over TLS or HTTPS.

The advantage is that no new wire representations have to be introduced. 
The disavantage it that it only works if the operator of the resolver has
control over reverse DNS.

Note that for IPv6, it may take a long time before router vendors support
the required changes to router advertisements and some client device vendors
seem to have strong objections against the use of DHCPv6.