Re: [Resolverless-dns] Paper on Resolver-less DNS

["John R Levine" <[e-mail]>]

I think I've seen rants that any interference with true DNS is evil (add 
DNSSEC to suit) but I think we can agree they're in the weeds.

> [ possible badness ] are:
>
> * new opportunities for circumvention for malware
> * increased likelihood for inappropriate exposure to distressing content
> (whether for adults or children)
> * new risks for regulatory or common imposition of other control surfaces

Not just distressing.  A lot of networks are inside organizations, and 
they have policy reasons to limit what things their employees can see, 
e.g., porn and gambling, or perhaps competitor's web sites if there's a 
risk of anti-competive collusion.  I've seen networks that force all 
outgoing port 53 traffic to their own resolver to more or less 
transparently enforce the policy.

> There is a further assumption that these risk go up as the level of
> sophistication for circumvention goes down.  I think many of these are
> predicated on an assumption that the non-local DNS has no filters, ...

Not at all, it's that the non-local DNS doesn't have the policy filters 
that the local DNS does.

> * new opportunity for a malicious configured service to provide false data
> to non-DNSSEC validating hosts or applications.
> * no opportunities for external services to provide access to split-DNS
> internal data.

That, too.  But the key point is that many networks do policy filtering 
and other people's DNS is unlikely to implement the same policy.

Regards,
John Levine, [e-mail], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly