Re: [Resolverless-dns] Paper on Resolver-less DNS

[Paul Vixie <[e-mail]>]

On Thursday, 15 August 2019 19:00:31 UTC Erik Sy wrote:
> Hi John,
> 
> On 8/15/19 18:39, John Levine wrote:
> > I also like the paper but it misses the largest concern with
> > resolverless DNS: it circumvents DNS based access controls.
> 
> Resolver-less DNS does not circumvent DNS-based access controls. First,
> clients can configure their user agent to filter the DNS records
> retrieved via resolver-less DNS to enforce such access controls.

how? right now network operators use DNS RPZ, implemented in their recursive 
name servers, to achieve multivendor threat intelligence based policy 
enforcement at the DNS level. i know of no similar protocol by which browsers 
could learn the network operator's policy. and in any case some of the policy 
rules expressed in RPZ are about name server names and name server addresses, 
neither of which a browser will know.

so, this _does_ circumvent, as written, and i suspect, by (poltiical) intent.

> Second,
> resolver-less DNS requires in some situations fallback DNS queries using
> the traditional resolver that may conduct DNS-based access controls.

that's small beer, irrelevant to the thread.

-- 
Paul