Re: [Driu] How to describe various flavors of DNS resolvers

[Tom Pusateri <[e-mail]>]

> On May 12, 2018, at 6:30 PM, Paul Hoffman <[e-mail]> wrote:
> 
> Greetings. This mailing list has many purposes, but a (hopefully easy) one is: how should DNS-over-TLS be described in protocols like DHCP? Should there be a separate DHCP option for naming DNS-over-TLS servers to the DHCP client? If not, how should clients upgrade from DNS-over-53 to DNS-over-TLS?
> 
> And: who wants to write the Internet Draft for this?
> 
> --Paul Hoffman

This is something Willem and I have been working on:

https://github.com/pusateri/draft-tpwt-dhc-dns-discovery/blob/master/draft-tpwt-dhc-dns-discovery.txt <https://github.com/pusateri/draft-tpwt-dhc-dns-discovery/blob/master/draft-tpwt-dhc-dns-discovery.txt>

But Ted Lemon is concerned that learning about private DNS over DHCP is not much benefit because you can’t trust the DNS server you learn about.

We have been discussing this is more detail and so I wrote this threat document to try and work through it:

https://github.com/pusateri/draft-tpwt-dhc-dns-discovery/blob/master/threat.md <https://github.com/pusateri/draft-tpwt-dhc-dns-discovery/blob/master/threat.md>

This is still a work in progress and talks are ongoing.

1. In the presence of DNSSEC, the responses can be shown to be trustworthy. In the absence of DNSSEC, there are still some benefits in my opinion.

2. I think there may be a benefit for operating system vendors  and/or dhclient vendors to have a black list / white list.
    Something similar is done today with browser vendors / operating system vendors with https://hstspreload.org <https://hstspreload.org/>

3. Any DNS server providing DNS over TLS or DNS over HTTPS should have DNSSEC records to show they are authentic servers and TLSA records to ensure the client is talking to the actual server. Other out of band mechanisms such as SPKI pinning could be used but distributing this over DHCP is worthless because having the network provider include the information needed to check the network provider is not helpful. But even DNSSEC records for the server do not guarantee the responses that don’t have DNSSEC validation are not tampered with. SIG(0) can help. See the threat document.

4. If a well known DNS over TLS server like 1.1.1.1 or 9.9.9.9 is blocked, then the DHCP client is probably in a hostile environment. If it can’t verify through DNSSEC, the records it learns, it probably should disconnect. But how do we know we can trust 1.1.1.1 or 9.9.9.9?

I welcome more discussion and feedback.

Thanks,
Tom