Re: [Resolverless-dns] Paper on Resolver-less DNS

[Paul Vixie <[e-mail]>]

On Friday, 16 August 2019 21:35:25 UTC Anne Bennett wrote:
> Paul Vixie <[e-mail]> writes:
> > i'll want to see how the network operator's policies for
> > dns monitoring and filtering will be reliably detected,
> > and respected.
> 
> I would think this to be an impossible task; if I as a network
> operator am redirecting all port 53 traffic to my resolvers,
> which use various filtering policies to, for example, redirect
> queries for known phishing and malware sites to my local
> "don't be phished" web page, what on earth mechanism could
> possibly exist that could mirror my policies in this context?

this draft in another wg appears to be an attempt at such:

https://datatracker.ietf.org/doc/draft-sah-resolver-information/

i don't know if it can meet the "reliably detected" threshold though.

> While I believe in the bona fide of the people advocating for
> resolverless DNS, and I don't doubt that there are performance
> bottlenecks that could be alleviated with such a scheme, as a
> sysadmin I feel almost as if these designs were specifically
> created to prevent me from protecting my users.  :-(

i know that feeling. but i think what's happened is the next generation of 
internet technologists have taken an interest in dns, without ever having 
tried to secure it or defend it, or its applications. not knowing what they 
don't know, their proposals seem more reasonable to them than to me.

see also:

http://dnstap.info/

and:

https://dnsrpz.info/

-- 
Paul