[v6ops] draft-palet-v6ops-464xlat-opt-cdn-caches impact on DNS privacy

[JORDI PALET MARTINEZ <[e-mail]>]

Hi all,

Jared and Fred have asked the same question during the WG meeting, for different scenarios.

We have described this under section 4.2.12 (foreign DNS), and we believe that it is not an issue.

Anyway, here is a short clarification on that.

a) If a device/app is not using the DNS proxy from the CE, the optimization will not be done for that device/app. The EAMT entry will not be created.

b) Consequently, the same apply if we are talking about DNS privacy (DoT, DoH, DoQ, etc.).

c) If the DNS is modified (even if not using DNS privacy) in the OS, will not have impact for the same reasons, and even less when we are talking about a dual-stack OS. Remember that we only create the EAMT if an IPv4-only device is detected using the CLAT+DNS proxy. If a dual-stack devices is being detected as IPv4-only, the result is the same as if the device is using IPv6. Even if the device uses HE to fall back from IPv6 (because IPv6 is not working) to IPv4, the device will not be able to connect neither with IPv4 or IPv6, because the access is IPv6-only (this is described in section 4.2.11).

d) If the user modify the DNS in the CE, the optimization is not affected, because it doesn't requires using the ISP DNS, it is based in using the CE DNS proxy.

e) You can imagine combinations of the above scenarios and the result is the same. Either the optimization is not done, or not affected, but I don't think there is any negative impact.

Now, how it changes all this if the scenario is not a residential user with a CE, but an enterprise?

We didn't considered this a different case, because I think the enterprise will be c or d above, or both of them. In fact, it may happen that the enterprise router is not supporting the optimization, or it has been disabled via GUI or CLI.

If the enterprise is already doing something to avoid DNS privacy, because the optimization is not "changing" the way a "foreign DNS" is working, we don't impact on that.

The optimization is based only in using the CE DNS proxy. Enterprises, unless they are SMEs, typically will have their own DNS proxy, so no optimization is performed. This is not a big impact, because the "main" target of the optimization is not an old STB or SmartTV uses from time to time in an enterprise, but the massive residential users (which are the ones, in general, creating more traffic to the CDNs from IPv4-only devices).

Does it makes sense?

Fred, others, if you believe the way enterprises are trying to avoid DNS privacy may impact this, can you point to specific documents?

Regards,

Jordi
@jordipalet
 
 



**********************************************
IPv4 is over
Are you ready for the new Internet ?
http://www.theipv6company.com
The IPv6 Company

This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.