Re: [Resolverless-dns] Paper on Resolver-less DNS

[Eric Orth <[e-mail]>]

On Thu, Aug 15, 2019 at 12:39 PM John Levine <[e-mail]> wrote:

> I also like the paper but it misses the largest concern with
> resolverless DNS: it circumvents DNS based access controls.  I realize
> this is not a popular position in the IETF, but there are lots of
> perfectly good reasons that networks provide filtered DNS.  Even
> though it has usually been technically easy to circumvent, most people
> don't and it's been good enough.  If it's widely circumvented, we can
> expect much more intrusive filtering with a lot more collateral damage.
>

>From the Chrome perspective, this is a concern I partly share.  I'm mostly
ignoring here the circumvention and forced-filtering issues of whether or
not the network should be able to mandate filtering/manipulation or whether
or not clients should be forced to comply with such things because that
issue is being debated enough over in the ADD mailing list.

But if Chrome is using a particular filtering DNS server, especially if
that server has been explicitly selected by the user or someone with
authority over the user's device, seems like it would result in a bad user
experience if we then bypassed that filtering by retrieving results outside
the DNS server.  My initial thinking is that we would then ideally only use
resolverless DNS if we had knowledge that the in-use recursive resolver is
not doing significant filtering.  But such a signal does not currently
generally exist, so would we be limited to only doing resolverless DNS when
the resolver is on a hardcoded list of non-filtering resolvers?