Re: [Driu] How to describe various flavors of DNS resolvers

[Tom Pusateri <[e-mail]>]

> On May 14, 2018, at 5:59 AM, Philip Homburg <[e-mail]> wrote:
> 
>>   This is something Willem and I have been working on:
>> 
>>   [2]https://github.com/pusateri/draft-tpwt-dhc-dns-discovery/blob/maste
>>   r/draft-tpwt-dhc-dns-discovery.txt
> 
> For IPv6 it is unfortunately also necessary to consider router advertisements.
> It might be worth trying to align the DHCPv6 options and any RA options 
> such that they use as much as possible the same conceptual model.

Yes, this makes sense. We will also consider IPv4 if/when there is general agreement about IPv6.

>>   But Ted Lemon is concerned that learning about private DNS over
>>   DHCP is not much benefit because you cant trust the DNS server
>>   you learn about.
> 
>>   3. Any DNS server providing DNS over TLS or DNS over HTTPS should
>>   have DNSSEC records to show they are authentic servers and TLSA
>>   records to ensure the client is talking to the actual server.
> 
> I wonder if, even just as strawman, we should document how to signal DNS over
> TLS and DNS over HTTPS just using DNS, i.e.
> - DANE in the reverse zone can signal TLS or HTTPS
> - the PTR can be used as ADN
> - SRV records can be used to specify ports as well as ADNs and also signal
>  DNS over TLS or HTTPS.
> 
> The advantage is that no new wire representations have to be introduced. 
> The disavantage it that it only works if the operator of the resolver has
> control over reverse DNS.

I think this is always a possibility (even now) but it causes delays so it would be better to explicitly advertise the service offering.

It’s also possible to have an SRV record advertising the service that can be verified and the server authenticated.

> Note that for IPv6, it may take a long time before router vendors support
> the required changes to router advertisements and some client device vendors
> seem to have strong objections against the use of DHCPv6.

Yes, definitely.

This is an attempt at determining what the community wants and hashing out the details. The difference between using RA or DHCPv6 mechanisms is mostly the same from the trust / threat on DNS perspective since the network operator controls both.

Thanks for the comments,
Tom