From nobody Tue Jan 15 14:10:56 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5317D1294FA for ; Tue, 15 Jan 2019 14:10:55 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yu15KE92xXI8 for ; Tue, 15 Jan 2019 14:10:52 -0800 (PST) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AEAC2127598 for ; Tue, 15 Jan 2019 14:10:52 -0800 (PST) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Tue, 15 Jan 2019 14:10:50 -0800 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1367.000; Tue, 15 Jan 2019 14:10:50 -0800 From: Paul Hoffman To: RFC Editor CC: Patrick McManus , "ben@nostrum.com" , "aamelnikov@fastmail.fm" , "adam@nostrum.com" , "bemasc@google.com" , David Lawrence , Carsten Bormann , "doh@ietf.org" Thread-Topic: [Ext] [Technical Errata Reported] RFC8484 (5603) Thread-Index: AQHUrR8F4HHNRabckUevbB6aQUECcqWxajWA Date: Tue, 15 Jan 2019 22:10:50 +0000 Message-ID: <3D7D49BB-69F2-4976-94BE-2D0685D1E136@icann.org> References: <20190115220919.1F1B1B8252E@rfc-editor.org> In-Reply-To: <20190115220919.1F1B1B8252E@rfc-editor.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: multipart/signed; boundary="Apple-Mail=_C834DC74-4F14-4827-8065-4A86DAFD1018"; protocol="application/pkcs7-signature"; micalg=sha-256 MIME-Version: 1.0 Archived-At: Subject: Re: [Doh] [Ext] [Technical Errata Reported] RFC8484 (5603) X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Jan 2019 22:10:55 -0000 --Apple-Mail=_C834DC74-4F14-4827-8065-4A86DAFD1018 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii I agree with this erratum. --Paul Hoffman > On Jan 15, 2019, at 2:09 PM, RFC Errata System = wrote: >=20 > The following errata report has been submitted for RFC8484, > "DNS Queries over HTTPS (DoH)". >=20 > -------------------------------------- > You may review the report below and at: > = https://urldefense.proofpoint.com/v2/url?u=3Dhttp-3A__www.rfc-2Deditor.org= _errata_eid5603&d=3DDwIBaQ&c=3DFmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM= &r=3DyvHk3BrvY-tKWGRmaFbQS1aHXNfQjC40fPfI5u1VsFs&m=3DVzLcVlbkdAIA49v98uw45= 4RaR0ztfEM47wd9oJ041fA&s=3D_dbZ0_XVEL_UmId-dnaukR70mWZx3XP4MKQ2blvNYf4&e=3D= >=20 > -------------------------------------- > Type: Technical > Reported by: Carsten Bormann >=20 > Section: 4.1 >=20 > Original Text > ------------- > The URI Template defined in this document is processed without any > variables when the HTTP method is POST. When the HTTP method is = GET, > the single variable "dns" is defined as the content of the DNS > request (as described in Section 6), encoded with base64url > [RFC4648]. >=20 >=20 > Corrected Text > -------------- > The URI Template defined in this document is processed without any > variables when the HTTP method is POST. When the HTTP method is = GET, > the single variable "dns" is defined as the content of the DNS > request (as described in Section 6), encoded with base64url > [RFC4648]. Padding characters for base64url MUST NOT be included. >=20 >=20 > Notes > ----- > Note that Section 6 does say the same thing for a different usage of = base64url, and note that the examples in 4.1.1 even explicitly state = this, but the text that states the usual deviation from the default of = RFC 4648 should be in the defining part as well. (This is almost, but = not quite, an editorial erratum.) >=20 > Instructions: > ------------- > This erratum is currently posted as "Reported". If necessary, please > use "Reply All" to discuss whether it should be verified or > rejected. When a decision is reached, the verifying party =20 > can log in to change the status and edit the report, if necessary.=20 >=20 > -------------------------------------- > RFC8484 (draft-ietf-doh-dns-over-https-14) > -------------------------------------- > Title : DNS Queries over HTTPS (DoH) > Publication Date : October 2018 > Author(s) : P. Hoffman, P. McManus > Category : PROPOSED STANDARD > Source : DNS Over HTTPS > Area : Applications and Real-Time > Stream : IETF > Verifying Party : IESG --Apple-Mail=_C834DC74-4F14-4827-8065-4A86DAFD1018 Content-Disposition: attachment; filename="smime.p7s" Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCC/Qw ggWeMIIEhqADAgECAhAG83jiXlqePPrfwUUEH4ZnMA0GCSqGSIb3DQEBCwUAMGUxCzAJBgNVBAYT AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAi BgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQTAeFw0xODA2MTMwMDAwMDBaFw0yMTA2 MTMxMjAwMDBaMIG9MQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEUMBIGA1UEBxML TG9zIEFuZ2VsZXMxPDA6BgNVBAoTM0ludGVybmV0IENvcnBvcmF0aW9uIGZvciBBc3NpZ25lZCBO YW1lcyBhbmQgTnVtYmVyczEeMBwGA1UEAxMVUGF1bCBIb2ZmbWFuIDIwMTgwNjEzMSUwIwYJKoZI hvcNAQkBFhZwYXVsLmhvZmZtYW5AaWNhbm4ub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEArTbxBbfxbk1VxDQsOmEm14Yta2AE5cBcJ/ktMkC+aQrTCMSXrQJfjiMUUndnfAT1DWcf jg706vvITa1lkFaLoF9b6cNICMKsibFruFy8ZA2bsIPRXPPzSsY6zibdStNCpruNTQoiL9bIxlQp qRUx/BfvHAhS7g5dAOcRgkpW9Q4Si5bl6A2qS0ImIMzktNcVxrWAn0HsG9u8cKcSCBJxavRAnMt/ XhE7tCICjyoeoprYZ2ztmdZUL6UgMNrDz/KoeNHAWzTAH45hn1Jz1IguGLM/M2Vb8mF8eP3wAh4p MVIi2jCwNqC497R8x0lsNryoG+uy/26nK6fhCTqVfF6hgQIDAQABo4IB7zCCAeswHwYDVR0jBBgw FoAU5wIjgABP2Ne8lAvZP3Q5STI8inkwHQYDVR0OBBYEFD+ST5hEHbTuHJZT9husDN7VLQdgMAwG A1UdEwEB/wQCMAAwIQYDVR0RBBowGIEWcGF1bC5ob2ZmbWFuQGljYW5uLm9yZzAOBgNVHQ8BAf8E BAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMEMGA1UdIAQ8MDowOAYKYIZIAYb9 bAQBAjAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMIGIBgNVHR8E gYAwfjA9oDugOYY3aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFzc3VyZWRJ RENBLWcyLmNybDA9oDugOYY3aHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFz c3VyZWRJRENBLWcyLmNybDB5BggrBgEFBQcBAQRtMGswJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3Nw LmRpZ2ljZXJ0LmNvbTBDBggrBgEFBQcwAoY3aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0Rp Z2lDZXJ0U0hBMkFzc3VyZWRJRENBLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAA7vGiITVJvEIgFN3 UVszD4nyt8ks8d/Ik5Uj1jPuD8+NX4lBpDOIvfYkCn8KYSrx+sMQrpoS2enbOMwekef3tObl2hVK 2Q+tv1GksPq9tQ98Ab1Odv1IM9aYaU1alR5/EEhc0uqs1Ulz2WUc8x/anf3/IpbHyEPdOCLiL9mi b4GDM8z9mqvAE+MtisqRs2+wlMzC/63sNKpA6KdfBNKMLHnyqCAKF7luGWp612yPmGoh63bBLrpR JQorI/fsv5SE2pK3Xf53W/ELf6sxWMsXm9iEgMeoAOtDeJHrv+i+vlldwHHJK6zlXIdVrjxRklyg ISXmlsdHs/sDp1MEqZTOXDCCBk4wggU2oAMCAQICEASueWBmZpAaucV/pmxb3M0wDQYJKoZIhvcN AQELBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMB4XDTEz MTEwNTEyMDAwMFoXDTI4MTEwNTEyMDAwMFowZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lD ZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hB MiBBc3N1cmVkIElEIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3PgRIz9qte/A J3kbLQWHohBDMd8O1BUbT3ekIs4+jHDwvgeO3ScqvAEdtiwKyt1pWB9B7WoFH9pjeFkeIiwr+Lp+ yTU7VvEffEJ+JbAjGcZFONc9RPkgfGCuHLBaGAS+jzv3qfCUmqYMY0m2QRdTQDK9T+ZQelAfJUXo 8Ymvzf9e/1Dz8BcR/73FifW9YrnY+45FBIVtmc3FSE39JqsCNkXqNtdfauIagkEK3OnZ9ZEXjsYh rTg8E+Yef2ac1U3ZRtr2z1KnfTskw7TBUTXGm+vU737kewPhRL16CzfgT8uCig1xGOSm4IksG/Oy czzBsJKeGH29q33FfQihLMKfcwIDAQABo4IC+DCCAvQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNV HQ8BAf8EBAMCAYYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdp Y2VydC5jb20wgYEGA1UdHwR6MHgwOqA4oDaGNGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdp Q2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwOqA4oDaGNGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9E aWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwME MIIBswYDVR0gBIIBqjCCAaYwggGiBgpghkgBhv1sAAIEMIIBkjAoBggrBgEFBQcCARYcaHR0cHM6 Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMA ZQAgAG8AZgAgAHQAaABpAHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0 AHUAdABlAHMAIABhAGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMA ZQByAHQAIABDAFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABh AHIAdAB5ACAAQQBnAHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkA YQBiAGkAbABpAHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAg AGgAZQByAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjAdBgNVHQ4EFgQU5wIjgABP 2Ne8lAvZP3Q5STI8inkwHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcN AQELBQADggEBAE7UiSe5/R2Hd34PKAWQ8QovyTs+vZOckMav+pFRhzJUa+jKwXFRXJmOtfrgYhmZ pgeafBMn2+UCooQS2RX2CkRXxDSPbXMfOtagAT3e44LkRWuy6yX9gF4dOZC+W0L2zpFg4/mgVgxI EM4zaHvNk6vwastPWA+5e10bBIGepyLiV0kn7pKTCL5pCFMCOi5dyBn0UIBOAtmwXZG0k4f5lpaB VUCOZu2C2LsoX+1MYe0GWCgZUxFEvEcgKbIEbNiJVJk7ddtneCweknjGVT1YEhEybr1DDE0023vG QtvsvqubYUwGkuOO3yEqUFcEwGCiNdUknmY3CUnP1fhls+DibsIxggMpMIIDJQIBATB5MGUxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j b20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQQIQBvN44l5anjz638FFBB+G ZzANBglghkgBZQMEAgEFAKCCAYEwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0B CQUxDxcNMTkwMTE1MjIxMDUwWjAvBgkqhkiG9w0BCQQxIgQgu0edEZCQ2M8FZ67oCIrNsFqE1lou H2R21ZZrKq9GhTMwgYgGCSsGAQQBgjcQBDF7MHkwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERp Z2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQg U0hBMiBBc3N1cmVkIElEIENBAhAG83jiXlqePPrfwUUEH4ZnMIGKBgsqhkiG9w0BCRACCzF7oHkw ZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2lj ZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIENBAhAG83jiXlqePPrf wUUEH4ZnMA0GCSqGSIb3DQEBAQUABIIBAHf/l1eOGkY1KFCeKxdvbmgOnmIIXo/OvdDT9OgQJEat vWvuAKTz+QogjJkEhlnNobPQaaMhblTHdL/Jhwx70342F3lAjUwZzVa2AJwTR+72fFMHmOQ84hSJ 0v5XYrPm2uHfYh8GxWtAGm/SPzyljdyF+OU7mRw6jdMMsfRK9qMXellXPytmRrIADXKM9rBylqt+ QBKS+/hqN4Ok8COmf081aaaMm+us2s/CYg03p5HTXu3M17zBROo1rQ/S6UzzKc8MlWn4UqCXKU7U GI71bJ9+4jyKLKPQSKRQ3YZi/QhO1TCEDTmMweldq3FaX9QlUNyhzneWyklbqPI69akX7u4AAAAA AAA= --Apple-Mail=_C834DC74-4F14-4827-8065-4A86DAFD1018-- From nobody Tue Jan 15 14:19:12 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 01990127598 for ; Tue, 15 Jan 2019 14:09:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FIEB6R4oLnYy for ; Tue, 15 Jan 2019 14:09:21 -0800 (PST) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CB9D8130F13 for ; Tue, 15 Jan 2019 14:09:21 -0800 (PST) Received: by rfc-editor.org (Postfix, from userid 30) id 1F1B1B8252E; Tue, 15 Jan 2019 14:09:19 -0800 (PST) To: paul.hoffman@icann.org, mcmanus@ducksong.com, ben@nostrum.com, aamelnikov@fastmail.fm, adam@nostrum.com, bemasc@google.com, tale@dd.org X-PHP-Originating-Script: 30:errata_mail_lib.php From: RFC Errata System Cc: cabo@tzi.org, doh@ietf.org, rfc-editor@rfc-editor.org Content-Type: text/plain; charset=UTF-8 Message-Id: <20190115220919.1F1B1B8252E@rfc-editor.org> Date: Tue, 15 Jan 2019 14:09:19 -0800 (PST) Archived-At: X-Mailman-Approved-At: Tue, 15 Jan 2019 14:19:10 -0800 Subject: [Doh] [Technical Errata Reported] RFC8484 (5603) X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Jan 2019 22:09:24 -0000 The following errata report has been submitted for RFC8484, "DNS Queries over HTTPS (DoH)". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata/eid5603 -------------------------------------- Type: Technical Reported by: Carsten Bormann Section: 4.1 Original Text ------------- The URI Template defined in this document is processed without any variables when the HTTP method is POST. When the HTTP method is GET, the single variable "dns" is defined as the content of the DNS request (as described in Section 6), encoded with base64url [RFC4648]. Corrected Text -------------- The URI Template defined in this document is processed without any variables when the HTTP method is POST. When the HTTP method is GET, the single variable "dns" is defined as the content of the DNS request (as described in Section 6), encoded with base64url [RFC4648]. Padding characters for base64url MUST NOT be included. Notes ----- Note that Section 6 does say the same thing for a different usage of base64url, and note that the examples in 4.1.1 even explicitly state this, but the text that states the usual deviation from the default of RFC 4648 should be in the defining part as well. (This is almost, but not quite, an editorial erratum.) Instructions: ------------- This erratum is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party can log in to change the status and edit the report, if necessary. -------------------------------------- RFC8484 (draft-ietf-doh-dns-over-https-14) -------------------------------------- Title : DNS Queries over HTTPS (DoH) Publication Date : October 2018 Author(s) : P. Hoffman, P. McManus Category : PROPOSED STANDARD Source : DNS Over HTTPS Area : Applications and Real-Time Stream : IETF Verifying Party : IESG From nobody Tue Jan 15 16:26:02 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 867DC130F2F for ; Tue, 15 Jan 2019 16:26:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MNkE_zE0Mg0X for ; Tue, 15 Jan 2019 16:25:58 -0800 (PST) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4B16612D4F2 for ; Tue, 15 Jan 2019 16:25:58 -0800 (PST) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-2.pexch112.icann.org (64.78.40.23) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Tue, 15 Jan 2019 16:25:56 -0800 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1367.000; Tue, 15 Jan 2019 16:25:56 -0800 From: Paul Hoffman To: DoH WG Thread-Topic: Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh Thread-Index: AQHUrTILL2Y/75+a40yYwQM5QYeIWA== Date: Wed, 16 Jan 2019 00:25:55 +0000 Message-ID: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: multipart/signed; boundary="Apple-Mail=_699AC2E1-2CAA-4EF3-B70E-780747A21EE9"; protocol="application/pkcs7-signature"; micalg=sha-256 MIME-Version: 1.0 Archived-At: Subject: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Jan 2019 00:26:01 -0000 --Apple-Mail=_699AC2E1-2CAA-4EF3-B70E-780747A21EE9 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Greetings again after a long time. The still-alive DOH WG did not meet = at IETF 103. However, I did a short presentation on "Associating a DoH = Server with a Resolver" = (https://datatracker.ietf.org/doc/draft-hoffman-resolver-associated-doh/) = at the DNSOP WG. The presentation ended with the question of whether the = draft should be taken up in a WG, and if so, where. Since then, there = has been some off-list discussion that kinda ended up as "first see if = the DOH WG wants to take it up". People from a few browser vendors have expressed unofficial interest in = implementing at least parts of it if it gets standardized, so it seems = like a good idea to try to standardize it. There is still a reasonable = amount of work to be done in the document itself, and it certainly needs = input from both browser and DNS folks. So, does this WG want to adopt this as a work item? --Paul Hoffman= --Apple-Mail=_699AC2E1-2CAA-4EF3-B70E-780747A21EE9 Content-Disposition: attachment; filename="smime.p7s" Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCC/Qw ggWeMIIEhqADAgECAhAG83jiXlqePPrfwUUEH4ZnMA0GCSqGSIb3DQEBCwUAMGUxCzAJBgNVBAYT AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAi BgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQTAeFw0xODA2MTMwMDAwMDBaFw0yMTA2 MTMxMjAwMDBaMIG9MQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEUMBIGA1UEBxML TG9zIEFuZ2VsZXMxPDA6BgNVBAoTM0ludGVybmV0IENvcnBvcmF0aW9uIGZvciBBc3NpZ25lZCBO YW1lcyBhbmQgTnVtYmVyczEeMBwGA1UEAxMVUGF1bCBIb2ZmbWFuIDIwMTgwNjEzMSUwIwYJKoZI hvcNAQkBFhZwYXVsLmhvZmZtYW5AaWNhbm4ub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEArTbxBbfxbk1VxDQsOmEm14Yta2AE5cBcJ/ktMkC+aQrTCMSXrQJfjiMUUndnfAT1DWcf jg706vvITa1lkFaLoF9b6cNICMKsibFruFy8ZA2bsIPRXPPzSsY6zibdStNCpruNTQoiL9bIxlQp qRUx/BfvHAhS7g5dAOcRgkpW9Q4Si5bl6A2qS0ImIMzktNcVxrWAn0HsG9u8cKcSCBJxavRAnMt/ XhE7tCICjyoeoprYZ2ztmdZUL6UgMNrDz/KoeNHAWzTAH45hn1Jz1IguGLM/M2Vb8mF8eP3wAh4p MVIi2jCwNqC497R8x0lsNryoG+uy/26nK6fhCTqVfF6hgQIDAQABo4IB7zCCAeswHwYDVR0jBBgw FoAU5wIjgABP2Ne8lAvZP3Q5STI8inkwHQYDVR0OBBYEFD+ST5hEHbTuHJZT9husDN7VLQdgMAwG A1UdEwEB/wQCMAAwIQYDVR0RBBowGIEWcGF1bC5ob2ZmbWFuQGljYW5uLm9yZzAOBgNVHQ8BAf8E BAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMEMGA1UdIAQ8MDowOAYKYIZIAYb9 bAQBAjAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMIGIBgNVHR8E gYAwfjA9oDugOYY3aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFzc3VyZWRJ RENBLWcyLmNybDA9oDugOYY3aHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFz c3VyZWRJRENBLWcyLmNybDB5BggrBgEFBQcBAQRtMGswJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3Nw LmRpZ2ljZXJ0LmNvbTBDBggrBgEFBQcwAoY3aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0Rp Z2lDZXJ0U0hBMkFzc3VyZWRJRENBLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAA7vGiITVJvEIgFN3 UVszD4nyt8ks8d/Ik5Uj1jPuD8+NX4lBpDOIvfYkCn8KYSrx+sMQrpoS2enbOMwekef3tObl2hVK 2Q+tv1GksPq9tQ98Ab1Odv1IM9aYaU1alR5/EEhc0uqs1Ulz2WUc8x/anf3/IpbHyEPdOCLiL9mi b4GDM8z9mqvAE+MtisqRs2+wlMzC/63sNKpA6KdfBNKMLHnyqCAKF7luGWp612yPmGoh63bBLrpR JQorI/fsv5SE2pK3Xf53W/ELf6sxWMsXm9iEgMeoAOtDeJHrv+i+vlldwHHJK6zlXIdVrjxRklyg ISXmlsdHs/sDp1MEqZTOXDCCBk4wggU2oAMCAQICEASueWBmZpAaucV/pmxb3M0wDQYJKoZIhvcN AQELBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMB4XDTEz MTEwNTEyMDAwMFoXDTI4MTEwNTEyMDAwMFowZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lD ZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hB MiBBc3N1cmVkIElEIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3PgRIz9qte/A J3kbLQWHohBDMd8O1BUbT3ekIs4+jHDwvgeO3ScqvAEdtiwKyt1pWB9B7WoFH9pjeFkeIiwr+Lp+ yTU7VvEffEJ+JbAjGcZFONc9RPkgfGCuHLBaGAS+jzv3qfCUmqYMY0m2QRdTQDK9T+ZQelAfJUXo 8Ymvzf9e/1Dz8BcR/73FifW9YrnY+45FBIVtmc3FSE39JqsCNkXqNtdfauIagkEK3OnZ9ZEXjsYh rTg8E+Yef2ac1U3ZRtr2z1KnfTskw7TBUTXGm+vU737kewPhRL16CzfgT8uCig1xGOSm4IksG/Oy czzBsJKeGH29q33FfQihLMKfcwIDAQABo4IC+DCCAvQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNV HQ8BAf8EBAMCAYYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdp Y2VydC5jb20wgYEGA1UdHwR6MHgwOqA4oDaGNGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdp Q2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwOqA4oDaGNGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9E aWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwME MIIBswYDVR0gBIIBqjCCAaYwggGiBgpghkgBhv1sAAIEMIIBkjAoBggrBgEFBQcCARYcaHR0cHM6 Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMA ZQAgAG8AZgAgAHQAaABpAHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0 AHUAdABlAHMAIABhAGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMA ZQByAHQAIABDAFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABh AHIAdAB5ACAAQQBnAHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkA YQBiAGkAbABpAHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAg AGgAZQByAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjAdBgNVHQ4EFgQU5wIjgABP 2Ne8lAvZP3Q5STI8inkwHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcN AQELBQADggEBAE7UiSe5/R2Hd34PKAWQ8QovyTs+vZOckMav+pFRhzJUa+jKwXFRXJmOtfrgYhmZ pgeafBMn2+UCooQS2RX2CkRXxDSPbXMfOtagAT3e44LkRWuy6yX9gF4dOZC+W0L2zpFg4/mgVgxI EM4zaHvNk6vwastPWA+5e10bBIGepyLiV0kn7pKTCL5pCFMCOi5dyBn0UIBOAtmwXZG0k4f5lpaB VUCOZu2C2LsoX+1MYe0GWCgZUxFEvEcgKbIEbNiJVJk7ddtneCweknjGVT1YEhEybr1DDE0023vG QtvsvqubYUwGkuOO3yEqUFcEwGCiNdUknmY3CUnP1fhls+DibsIxggMpMIIDJQIBATB5MGUxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j b20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQQIQBvN44l5anjz638FFBB+G ZzANBglghkgBZQMEAgEFAKCCAYEwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0B CQUxDxcNMTkwMTE2MDAyNTU1WjAvBgkqhkiG9w0BCQQxIgQgdLaiT5Gz/H6cWh+dWcZsHPGREJ8x 2kvpfGsSVehV1YcwgYgGCSsGAQQBgjcQBDF7MHkwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERp Z2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQg U0hBMiBBc3N1cmVkIElEIENBAhAG83jiXlqePPrfwUUEH4ZnMIGKBgsqhkiG9w0BCRACCzF7oHkw ZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2lj ZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIENBAhAG83jiXlqePPrf wUUEH4ZnMA0GCSqGSIb3DQEBAQUABIIBAG3TjIa1dY76gpyowMmRIzQUFrJcIYxWuZwKM2zxBjH2 Oa+x7i8+dJfymiU9JcVrjXVYgs2o42l5ovOMjBmdK/aiQkD3TQAgHcuhweHGrhOVopEAKpnAfQ63 NKXw4md5ArFJe/QUnbw4A0oy8V4H5UOGIK9CI9unxS6QoOoHweT8EaO5GsDILy11K/uYgFrKRGAq x8i5euO7mEhDhtN3sgyQ4fL+Nuhce1t/YOT2gJ3KCVI7ssZBzdlPdZOLMjSB0M0Omhu43sGL01VR Fn5Lp1/g8gC123a1WJCIdJXVD4optBXJcrHS6pmsX+xdYolWNjjVw1Ql4QqDtoERJ6jvagsAAAAA AAA= --Apple-Mail=_699AC2E1-2CAA-4EF3-B70E-780747A21EE9-- From nobody Tue Jan 15 17:07:28 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 46974130F86 for ; Tue, 15 Jan 2019 17:07:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rIev3g8gwwyx for ; Tue, 15 Jan 2019 17:07:24 -0800 (PST) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 08652130F84 for ; Tue, 15 Jan 2019 17:07:24 -0800 (PST) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 2DBCF242109D; Wed, 16 Jan 2019 01:07:20 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> Date: Wed, 16 Jan 2019 01:07:19 +0000 Cc: DoH WG Content-Transfer-Encoding: 7bit Message-Id: <3C3A38F3-2F09-4A4E-9CFE-DD52F38DF6F9@rfc1035.com> References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> To: Paul Hoffman X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Jan 2019 01:07:25 -0000 > On 16 Jan 2019, at 00:25, Paul Hoffman wrote: > > So, does this WG want to adopt this as a work item? I think the WG should adopt this. From nobody Tue Jan 15 23:52:35 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 12E91131141 for ; Tue, 15 Jan 2019 23:52:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PHl5V569xrXz for ; Tue, 15 Jan 2019 23:52:24 -0800 (PST) Received: from smtp.guxx.net (smtp.guxx.net [IPv6:2a01:4f8:a0:322c::25:42]) by ietfa.amsl.com (Postfix) with ESMTP id A3A8C1310F9 for ; Tue, 15 Jan 2019 23:52:24 -0800 (PST) Received: by nyx.guxx.net (Postfix, from userid 107) id B135D5F4298B; Wed, 16 Jan 2019 08:52:21 +0100 (CET) Received: from [172.19.153.181] (p4FF530EE.dip0.t-ipconnect.de [79.245.48.238]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id 43BEE5F400D2; Wed, 16 Jan 2019 08:52:20 +0100 (CET) From: "Ralf Weber" To: "Jim Reid" Cc: "Paul Hoffman" , "DoH WG" Date: Wed, 16 Jan 2019 08:52:18 +0100 X-Mailer: MailMate (1.12.3r5579) Message-ID: In-Reply-To: <3C3A38F3-2F09-4A4E-9CFE-DD52F38DF6F9@rfc1035.com> References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> <3C3A38F3-2F09-4A4E-9CFE-DD52F38DF6F9@rfc1035.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Jan 2019 07:52:34 -0000 Moin! On 16 Jan 2019, at 2:07, Jim Reid wrote: >> On 16 Jan 2019, at 00:25, Paul Hoffman >> wrote: >> >> So, does this WG want to adopt this as a work item? > > I think the WG should adopt this. +1 I wonder if we should extend it to also find DoT servers. On the top of page 3 I think you mean /etc/resolv.conf and not /etc/named.conf. So long -Ralf —-- Ralf Weber From nobody Wed Jan 16 10:17:02 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B537B130E1C for ; Wed, 16 Jan 2019 10:17:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=neutral reason="invalid (unsupported algorithm ed25519-sha256)" header.d=andreasschulze.de header.b=gN0zN2fE; dkim=pass (2048-bit key) header.d=andreasschulze.de header.b=qjpaWPXi Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1DxCM9VOr-0K for ; Wed, 16 Jan 2019 10:16:57 -0800 (PST) Received: from mta.somaf.de (mta.somaf.de [IPv6:2001:470:77b3:103::25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ACC22130E0E for ; Wed, 16 Jan 2019 10:16:57 -0800 (PST) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=andreasschulze.de; i=@andreasschulze.de; q=dns/txt; s=ed25519; t=1547662612; h=subject : to : references : from : message-id : date : mime-version : in-reply-to : content-type : content-transfer-encoding : subject : from : date; bh=sY+fbxp3LvF822WOTj/s5iWtTeUMufDEB6ljcqU5How=; b=gN0zN2fEq1SDI8qjUPSvfxL+kslciAfa2yT5UphFOD0XTfvqGW0HJqmB EfOK6Yqfm1dEAr5JDRaWIq2stsrXCg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=andreasschulze.de; s=20181220-DFA7; t=1547662612; x=1552662612; bh=sY+fbxp3LvF822WOTj/s5iWtTeUMufDEB6ljcqU5How=; h=Subject:To:References:From:Message-ID:Date:In-Reply-To: Content-Type:from:reply-to:subject:date:to:cc:content-type: message-id; b=qjpaWPXiQZmeLFelm9kw4rxhcPFkadOYnT6ZnQy20AWxS+Q8/N5LLIfzg2EboDWDm xhbFgfkA+g81tn1SKFIkH//OVpy9D3H32fHuipcapwNC3UApQU3F6BRZoDJJshpNcD UZggyrwbJS+naPRwon2fmlwqljIecCK4Hwd+Ljv5iJSLsskjR+QVNf4uf1Q7a2R2k8 Ezsvz/81viDrl/2auKkGRQ/v6Gf1IEH55CMLc9yBDp6BPljQWG/M33rPKRRlAInzEt zvChUem0doG/gC55hUp1qEWs3si5bWoShu9rXfuLr/mUMUUon8uh5P3oG69zPaq4vO uX14AQCbR6VNA== To: doh@ietf.org References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> From: "A. Schulze" Openpgp: preference=signencrypt Message-ID: <6f2860bd-2a7f-01b5-2ec9-9667d71e3f38@andreasschulze.de> Date: Wed, 16 Jan 2019 19:16:14 +0100 MIME-Version: 1.0 In-Reply-To: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> Content-Type: text/plain; charset=windows-1252 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Jan 2019 18:17:01 -0000 Am 16.01.19 um 01:25 schrieb Paul Hoffman: > So, does this WG want to adopt this as a work item? Hello, adopt "DoH Servers by TXT" using unbound is fairly simple. Maybe someone could verify that config. unbound.conf: # option 1: # resolver that understands this protocol but has no associated DoH server server: local-data: 'resolver-associated-doh.arpa. TXT ""' # option 2: # resolver that understands this protocol and has one associated DoH server server: local-data: 'resolver-associated-doh.arpa. TXT "https://doh.example/"' # option 3: # resolver that understands this protocol and has multiple associated DoH server server: local-data: 'resolver-associated-doh.arpa. TXT "https://doh01.example/"' local-data: 'resolver-associated-doh.arpa. TXT "https://doh02.example/"' The second suggestion "DoH Servers by Addresses" isn't attractive to me. Getting a certificate for an IP isn't common these days. https://IPADDRESSGOESHERE/ -> Ask your favorite CA to issue a certificate for "IPADDRESSGOESHERE"... also: * https://[2001:db8::53]/ -> Address in [] * Certificate SAN Entry -> Address without [] can this work with IPv6? I simply never tried that... I agree with Ralf on defining something similar for DoT, too Andreas From nobody Wed Jan 16 10:28:24 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 33E00130E69 for ; Wed, 16 Jan 2019 10:28:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.641 X-Spam-Level: X-Spam-Status: No, score=-17.641 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.142, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y1ecfbJAa01b for ; Wed, 16 Jan 2019 10:28:18 -0800 (PST) Received: from mail-vs1-xe32.google.com (mail-vs1-xe32.google.com [IPv6:2607:f8b0:4864:20::e32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EB0CC130E67 for ; Wed, 16 Jan 2019 10:28:15 -0800 (PST) Received: by mail-vs1-xe32.google.com with SMTP id u11so4518834vsp.11 for ; Wed, 16 Jan 2019 10:28:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=KXy9uW+W7S8ZaiXA24+QDB9Bsi67D+PHENm6pC4tOcc=; b=rkz7oDGW1Cb1E6gTpUT334LDtXSTjuO6wc+YicBNmbJJ1m6/LokYckRMwSOumMBnsr DIzdyvzDjR+XGcTV4fWBgDZYfINNp/0nH7cFxB4dk0eMHavpsmvAyLJzwK9GDafvZQPZ kRMAuh4QUyRnFD/BwA6HgrNYOh9s9qq3u8mfV6Fv62EhlKP3LH6by45Lth991n1QAAmo t67WuH2d5gSGG988lCj/ziraDwJbpumsUdnF7fC4ik1MAJRZDjiNdp/EI+ndkO9Xz9FK JtodA1AOlMhL1RUzQYkW2NyDvflXXPE5ntO6q2SdvAM1V3r7JdyGIodjJSxs9qF/IHZi BWsA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=KXy9uW+W7S8ZaiXA24+QDB9Bsi67D+PHENm6pC4tOcc=; b=VIqYCfopTobrrQn5rctKFdsWI9KXF0+a0EyXWI7CGKMSnHONBJ/o2I1zRy2Z1wZXqS ieNBCERp1JJO3AigHE+p72vQj0jjfhelmHfuWfgzhRuM3NSyAWE6Bwm+sgAQpK3aP3a7 FqRNY4yRw1lq3NioM/pB52WUVyrZKulleCCGmiRxf7htvpIQPAUZhPDX2x0HDDyZqzUi DPsO1YQW3dm5UQ8i6KZDfnSAFDOHSPreJ1l/5JidFf4+p9H+ZI4C28nak/9UpKicM7FQ SrT3628gq9OSCCK1DQZhKiG68w9MHnfuWvYBYoIM36DvKzsqaqCrRHz9m0rD5JtE2B8v sj9g== X-Gm-Message-State: AJcUukf8rWr4VvxuTqWVb8Bse2/GBro8jCJwgEd2Pq+yNgYXKtDA4Gdl obbnxnyG81C/1MJAyj3erYK9r0GWSDFduy9ADuIJfZB/ X-Google-Smtp-Source: ALg8bN5LyY3vtXmNnJpwFujhLqowDWWqQiGaJfD0NwhDYBPg1L/HDTDWNqM5u/khCFnKN4wMnyA1ThmK2Mll+/eZAlA= X-Received: by 2002:a67:1203:: with SMTP id 3mr4389372vss.207.1547663294677; Wed, 16 Jan 2019 10:28:14 -0800 (PST) MIME-Version: 1.0 References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> <6f2860bd-2a7f-01b5-2ec9-9667d71e3f38@andreasschulze.de> In-Reply-To: <6f2860bd-2a7f-01b5-2ec9-9667d71e3f38@andreasschulze.de> From: Ben Schwartz Date: Wed, 16 Jan 2019 13:28:03 -0500 Message-ID: To: "A. Schulze" Cc: DoH WG Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="000000000000f017d7057f9770da" Archived-At: Subject: Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Jan 2019 18:28:23 -0000 --000000000000f017d7057f9770da Content-Type: multipart/alternative; boundary="000000000000e9a8c2057f9770d2" --000000000000e9a8c2057f9770d2 Content-Type: text/plain; charset="UTF-8" DNS over TLS already supports a way for clients to upgrade from unencrypted DNS, by probing port 853 on the server's IP address. I presume that's why DNS over TLS discovery was not mentioned in this draft. Is probing port 853 sufficient for your use case? On Wed, Jan 16, 2019 at 1:17 PM A. Schulze wrote: > > > Am 16.01.19 um 01:25 schrieb Paul Hoffman: > > So, does this WG want to adopt this as a work item? > > Hello, > > adopt "DoH Servers by TXT" using unbound is fairly simple. > Maybe someone could verify that config. > > unbound.conf: > # option 1: > # resolver that understands this protocol but has no associated > DoH server > server: > local-data: 'resolver-associated-doh.arpa. TXT ""' > > # option 2: > # resolver that understands this protocol and has one associated > DoH server > server: > local-data: 'resolver-associated-doh.arpa. TXT " > https://doh.example/"' > > # option 3: > # resolver that understands this protocol and has multiple > associated DoH server > server: > local-data: 'resolver-associated-doh.arpa. TXT " > https://doh01.example/"' > local-data: 'resolver-associated-doh.arpa. TXT " > https://doh02.example/"' > > The second suggestion "DoH Servers by Addresses" isn't attractive to me. > Getting a certificate for an IP isn't common these days. > > https://IPADDRESSGOESHERE/ -> Ask your favorite CA to issue a certificate > for "IPADDRESSGOESHERE"... > > also: > * https://[2001:db8::53]/ -> Address in [] > * Certificate SAN Entry -> Address without [] > can this work with IPv6? I simply never tried that... > > I agree with Ralf on defining something similar for DoT, too > > Andreas > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --000000000000e9a8c2057f9770d2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
DNS over TLS already supports a way for clients to upgrade= from unencrypted DNS, by probing port 853 on the server's IP address.= =C2=A0 I presume that's why DNS over TLS discovery was not mentioned in= this draft.=C2=A0 Is probing port 853 sufficient for your use case?
<= br>
On Wed, Jan 16, 2019 at 1:17= PM A. Schulze <sca@andreasschu= lze.de> wrote:


Am 16.01.19 um 01:25 schrieb Paul Hoffman:
> So, does this WG want to adopt this as a work item?

Hello,

adopt "DoH Servers by TXT" using unbound is fairly simple.
Maybe someone could verify that config.

unbound.conf:
=C2=A0 =C2=A0 =C2=A0 =C2=A0 # option 1:
=C2=A0 =C2=A0 =C2=A0 =C2=A0 # resolver that understands this protocol but h= as no associated DoH server
=C2=A0 =C2=A0 =C2=A0 =C2=A0 server:
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0local-data: 'resolver-associated-doh.= arpa. TXT ""'

=C2=A0 =C2=A0 =C2=A0 =C2=A0 # option 2:
=C2=A0 =C2=A0 =C2=A0 =C2=A0 # resolver that understands this protocol and h= as one associated DoH server
=C2=A0 =C2=A0 =C2=A0 =C2=A0 server:
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0local-data: 'resolver-associated-doh.= arpa. TXT "https://doh.example/"'

=C2=A0 =C2=A0 =C2=A0 =C2=A0 # option 3:
=C2=A0 =C2=A0 =C2=A0 =C2=A0 # resolver that understands this protocol and h= as multiple associated DoH server
=C2=A0 =C2=A0 =C2=A0 =C2=A0 server:
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0local-data: 'resolver-associated-doh.= arpa. TXT "https://doh01.example/"'
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0local-data: 'resolver-associated-doh.= arpa. TXT "https://doh02.example/"'

The second suggestion "DoH Servers by Addresses" isn't attrac= tive to me.
Getting a certificate for an IP isn't common these days.

https://IPADDRESSGOESHERE/ -> Ask your favorite CA to issue a certi= ficate for "IPADDRESSGOESHERE"...

also:
=C2=A0* https://[2001:db8::53]/ -> Address in []
=C2=A0* Certificate SAN Entry=C2=A0 =C2=A0-> Address without []
can this work with IPv6? I simply never tried that...

I agree with Ralf on defining something similar for DoT, too

Andreas

_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
--000000000000e9a8c2057f9770d2-- --000000000000f017d7057f9770da Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMYJWDwudxwNjwu8B4MA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE4MTAxNDA4MjIxMloXDTE5MDQx MjA4MjIxMlowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCjAFK2jxl2SbwdLgmpNj92zrqk75pYCWjsHhvdBpOYu7YqUel7 tZEj5mGxVhKL8jbTW9bEM/iB1XBfK+JjPXV+WADiV+9+yRRDRugD0oy5iTiEFNVATSd4G5Su+lfw aCM7aa4opbbXPkehb7Gkx3zks54gj2F5KH7dvmvMdAVZuH6Ff4TnUkzolgu/llEzjYArUXHDaAR4 WE02VO3FbyLV97Y68Z3gtHbzsyAOXK6hjLiVwGBTaWaApt9i+d0jR0SDWClPDyK3Vq3QhLVpewN8 bRR1rb72UKt2an3n95SrvbhD639vfyy/cHR09HxDXXlTfyugAk0kYIQiqwS1X74zAgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFDPcHr72CmAhHX2sPCeQbgmPbXZWMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQATQwVzUhwG45UvRH44 Ls0IDXKJb9GVoZurKcd19M1EtjywGT6ZfFDW1DenoGaf/gizTDc0dHMLV79yXlj6yLtsDkP6rb7f zOyczFMqHbXRXT9YDJlPcOrtp3E2wA/HHph+nimVhrmfcGMndO5AV2DzTD2oOQe5C/mh9RUT5z6/ CrUQ0dAaBZweRC8agj/PQ4Jnen/kqDBE/TgK0ChQ7Q44MkuENG0dp2bPuHG7ZPKkqZ2V5LGhrba4 c4MtQvK9dyNE8urDPL70ogUS3pwBvfui1H1gbHJwe3npqkBvuqswxS7IvDmW88A1wGeWt/02LLQP ysd6YM+XWMe3rBB1zzJDMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMYJWDwudx wNjwu8B4MA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCAsSV/5ng/LZGqHORs0N4VU U4RVSmJsGdayX4+3BYiAGTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTAxMTYxODI4MTVaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAAQHJ+7fQx2xshnIo32PrVAJ2vKDRBCN4MYuwRKc3 fsgAIX+Fst2KTc3u8tmx7z3z80Gr+8wUYU2oTnwChnazkPGrQJWqnJO1+jo8qudonYEyZ9aJJHiL oW8im/8Du5WY6iGKMLTYqOhJ5GYbwAczr2EF7l3dF+NDgJFIJsmeQM/I52+LbMyvAJRxUm1FQ203 OJFMxOO6AmtR4qbuOaQ3dH2r0U+3M6TFf1q7WI3o16ojAw4iYFO/1UsGIema3iGYqx2EaXuOIFAG AfKCW4rlmXf6rtfM/qFbHwirVyR0m18eBRojegNUUMnzKVgIuWuTV7HEGgFiv6/9/avz6uh2Kg== --000000000000f017d7057f9770da-- From nobody Wed Jan 16 10:29:52 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A2F11130E69 for ; Wed, 16 Jan 2019 10:29:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NH4Dn0MwV6GC for ; Wed, 16 Jan 2019 10:29:50 -0800 (PST) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 821C2130E71 for ; Wed, 16 Jan 2019 10:29:50 -0800 (PST) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 3F71E242109D; Wed, 16 Jan 2019 18:29:45 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Wed, 16 Jan 2019 18:29:44 +0000 Cc: Paul Hoffman , DoH WG Content-Transfer-Encoding: quoted-printable Message-Id: <72D949E7-3470-42F1-AFB1-19B91535D6E6@rfc1035.com> References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> <3C3A38F3-2F09-4A4E-9CFE-DD52F38DF6F9@rfc1035.com> To: Ralf Weber X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Jan 2019 18:29:52 -0000 > On 16 Jan 2019, at 07:52, Ralf Weber wrote: >=20 > I wonder if we should extend it to also find DoT servers. IMO that=E2=80=99s something for the dprive WG to decide. From nobody Wed Jan 16 10:46:20 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8AC76130E91 for ; Wed, 16 Jan 2019 10:46:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=neutral reason="invalid (unsupported algorithm ed25519-sha256)" header.d=andreasschulze.de header.b=swkw+Orh; dkim=pass (2048-bit key) header.d=andreasschulze.de header.b=mq/QCXX+ Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yUqCqCb0hAPY for ; Wed, 16 Jan 2019 10:46:17 -0800 (PST) Received: from mta.somaf.de (mta.somaf.de [IPv6:2001:470:77b3:103::25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 63C7B130E8E for ; Wed, 16 Jan 2019 10:46:17 -0800 (PST) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=andreasschulze.de; i=@andreasschulze.de; q=dns/txt; s=ed25519; t=1547664375; h=subject : to : references : from : message-id : date : mime-version : in-reply-to : content-type : content-transfer-encoding : subject : from : date; bh=TaIBUPQcTw/qH0DypwPCktMNtIb2a4isSdELDuYFIQQ=; b=swkw+OrhtK1/L607CBXrY4QH8TH8ylJUYP40q3IpdyNJsa/1z3QX8w7O bPZelE/92ZVXdWtoAf4FrVyXEx6CCQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=andreasschulze.de; s=20181220-DFA7; t=1547664375; x=1552664375; bh=TaIBUPQcTw/qH0DypwPCktMNtIb2a4isSdELDuYFIQQ=; h=Subject:To:References:From:Message-ID:Date:In-Reply-To: Content-Type:from:reply-to:subject:date:to:cc:content-type: message-id; b=mq/QCXX+p1QtK+seAtZ/ROTFEJjUfBg7avbNV4clF4dK5PACO5ooofkMId4PLO2k8 u0b+NF5ueUrGpfv7DT+EkXQFbb8KwFXDHII3NRV9MHLSt6y9yeC5uWAe0y1vb763A+ GjIYq2FB7QtdAM8F+UHO0XiOxvzQiW9E2EOcOzqEGjBY+Lm/K54aMH1YXWiYdwZ7zD Zo1FOBNIwHbrQ1O/d5Vvkt4DBk8udwCeaFBOtP/4/PgK/jusHavvNYUUMxzdH2jWgU l5ysU9ykhb7XOaLWgFNDafqMZ6HUeJTW+zPuTI3HLreGW1QapKcvG7lEE+436MvYCv kOKHMl3Xmxv7A== To: doh@ietf.org References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> <6f2860bd-2a7f-01b5-2ec9-9667d71e3f38@andreasschulze.de> From: "A. Schulze" Openpgp: preference=signencrypt Message-ID: <2d1f4c8b-d157-d775-d4fa-8414257170b6@andreasschulze.de> Date: Wed, 16 Jan 2019 19:45:36 +0100 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Jan 2019 18:46:19 -0000 Am 16.01.19 um 19:28 schrieb Ben Schwartz: > DNS over TLS already supports a way for clients to upgrade from unencrypted DNS, by probing port 853 on the server's IP address.  I presume that's why DNS over TLS discovery was not mentioned in this draft.  Is probing port 853 sufficient for your use case? Ah! right! port probing is _the_ obvious option I failed to see. A short sentence in the spec shouldn't hurt... Andreas From nobody Wed Jan 16 11:44:05 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 714C21310F7 for ; Wed, 16 Jan 2019 11:44:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T-b-0fG1oPIT for ; Wed, 16 Jan 2019 11:44:01 -0800 (PST) Received: from smtp.guxx.net (nyx.guxx.net [85.10.208.173]) by ietfa.amsl.com (Postfix) with ESMTP id 0BFE31310EF for ; Wed, 16 Jan 2019 11:44:00 -0800 (PST) Received: by nyx.guxx.net (Postfix, from userid 107) id 695F45F4298D; Wed, 16 Jan 2019 20:43:58 +0100 (CET) Received: from [172.19.153.181] (p4FF53CB0.dip0.t-ipconnect.de [79.245.60.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id A04EE5F40292; Wed, 16 Jan 2019 20:43:57 +0100 (CET) From: "Ralf Weber" To: "Ben Schwartz" Cc: "A. Schulze" , "DoH WG" Date: Wed, 16 Jan 2019 20:43:55 +0100 X-Mailer: MailMate (1.12.3r5579) Message-ID: <88CFA2C4-BBE7-402D-ADFF-DE17339305DB@fl1ger.de> In-Reply-To: References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> <6f2860bd-2a7f-01b5-2ec9-9667d71e3f38@andreasschulze.de> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Jan 2019 19:44:03 -0000 Moin! On 16 Jan 2019, at 19:28, Ben Schwartz wrote: > DNS over TLS already supports a way for clients to upgrade from > unencrypted > DNS, by probing port 853 on the server's IP address. I presume that's > why > DNS over TLS discovery was not mentioned in this draft. Is probing > port > 853 sufficient for your use case? Well the performance characteristics for DNS over UDP and DNS over TLS or HTTP are different, so it would be good to have different platforms for these. Also to answer Jim Reid I thought I was answering on dnsop and not doh (wasn’t sufficiently caffeinated ;-) which is why I brought up DoT. I really don’t care to much which working group does the work as long as it is done and I’ll do my best to contribute. So long -Ralf —-- Ralf Weber From nobody Wed Jan 16 13:29:10 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9CBCF1311A1 for ; Wed, 16 Jan 2019 13:29:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=S1OVKbk7; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=UrKUQDlk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mkpvY4tLRtyO for ; Wed, 16 Jan 2019 13:29:06 -0800 (PST) Received: from new3-smtp.messagingengine.com (new3-smtp.messagingengine.com [66.111.4.229]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7E6F313119F for ; Wed, 16 Jan 2019 13:29:03 -0800 (PST) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailnew.nyi.internal (Postfix) with ESMTP id AC62427A97 for ; Wed, 16 Jan 2019 16:29:02 -0500 (EST) Received: from web4 ([10.202.2.214]) by compute1.internal (MEProxy); Wed, 16 Jan 2019 16:29:02 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=message-id:from:to:mime-version:content-transfer-encoding :content-type:subject:references:date:in-reply-to; s=fm1; bh=lhq MGVp157gbg/uQHslTiB84/O9nbCzyle3Gy5E4iRs=; b=S1OVKbk7DBP5JTKFQEK oXyjyXF6eQGbM93ZRr/4luPuReZ9EkbWBJBkOGj5GXtvDl0BtBsA4IPIf9f4q0Ih Lw0QtD99xn+N0+dvDLaeJZ6ujied2F6rMaEY9liwlvmGGmjdKq4PFGT6BDI9q9jw Ffi+dcL9xqVAW4nnPxHweIebRjY4qrBSPLymBl+/SYJ+DriEUN8yrpORXesZV+W5 RHjdl5cWZKsyXErTBzU6Uj2jTE+gBQAu9DLsU+qgURs5hTMN+WJYzm4yL3ZqoYwC Wl4xA/1f3BmXpRmN+ISIJxCo0n2eB6UFcva9JY7i2pU3iY1WvFYGBcK/41MFEuzJ ubA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm1; bh=lhqMGVp157gbg/uQHslTiB84/O9nbCzyle3Gy5E4i Rs=; b=UrKUQDlkFHUo9VpCj69eWTUu6yUrmfBhWEX7ReGXP1KjjiYNnxk0w6Hq7 9tnC1PkRtG2jCHsEmbQZFqWppss27oiHcRvZvki1uEv1O6WGgzhKirN396VOCB2s Z+Xy+REvGdmg5VfAcpQIErHqFy1yZNodHPGmfxJO9tGSJhLFHDFL2KqOlJEeSGkM E8yxY+2jRcgCtsu8frzSBTZ+hmbRgwppErf88xV3r/Oz/GjkVIiKiLvvksGkRGfD k8yWr1ZRiQw4BRfPEYz5blvyty1ugBe9jBASJOk2/K4wBiXJjasm/0/6+y23DjjC uiReUTWBo2DLZiF7VrB7EnZrL1swg== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedtledrgeehgdduhedvucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfquhhtnecuuegrihhlohhuthemucef tddtnecunecujfgurhepkffhvfgggfgtoffufhffjgesthejredtredtjeenucfhrhhomh epofgrrhhtihhnucfvhhhomhhsohhnuceomhhtsehlohifvghnthhrohhphidrnhgvtheq necurfgrrhgrmhepmhgrihhlfhhrohhmpehmtheslhhofigvnhhtrhhophihrdhnvghtne cuvehluhhsthgvrhfuihiivgeptd X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 99) id 02D71BA783; Wed, 16 Jan 2019 16:29:01 -0500 (EST) Message-Id: <1547674141.291889.1636540384.54D5BB3E@webmail.messagingengine.com> From: Martin Thomson To: doh@ietf.org MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="utf-8" X-Mailer: MessagingEngine.com Webmail Interface - ajax-36e4bfd3 References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> Date: Thu, 17 Jan 2019 08:29:01 +1100 In-Reply-To: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> Archived-At: Subject: Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Jan 2019 21:29:09 -0000 On Wed, Jan 16, 2019, at 11:25, Paul Hoffman wrote: > People from a few browser vendors have expressed unofficial interest in > implementing at least parts of it if it gets standardized, so it seems > like a good idea to try to standardize it. There is still a reasonable > amount of work to be done in the document itself, and it certainly needs > input from both browser and DNS folks. What happened to DRIU? It seemed like there was an effort to work on the problem more generally. But I see the DoT comment down-thread and wonder whether this is the right place for doing this sort of work. From nobody Wed Jan 16 14:32:17 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F02031311E9 for ; Wed, 16 Jan 2019 14:32:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fw6dole7wWXr for ; Wed, 16 Jan 2019 14:32:14 -0800 (PST) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DF8051311E8 for ; Wed, 16 Jan 2019 14:32:09 -0800 (PST) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-2.pexch112.icann.org (64.78.40.23) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Wed, 16 Jan 2019 14:32:07 -0800 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1367.000; Wed, 16 Jan 2019 14:32:07 -0800 From: Paul Hoffman To: Martin Thomson CC: "doh@ietf.org" Thread-Topic: [Ext] [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh Thread-Index: AQHUretP0VTIQeZ7IkaYZj9E95gW+g== Date: Wed, 16 Jan 2019 22:32:06 +0000 Message-ID: <78C9AA8D-1599-46F1-91C7-356E58DD960A@icann.org> References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> <1547674141.291889.1636540384.54D5BB3E@webmail.messagingengine.com> In-Reply-To: <1547674141.291889.1636540384.54D5BB3E@webmail.messagingengine.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: multipart/signed; boundary="Apple-Mail=_1FCD5282-8F7B-4323-9B25-B3C9D8DA8C0F"; protocol="application/pkcs7-signature"; micalg=sha-256 MIME-Version: 1.0 Archived-At: Subject: Re: [Doh] [Ext] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Jan 2019 22:32:16 -0000 --Apple-Mail=_1FCD5282-8F7B-4323-9B25-B3C9D8DA8C0F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On Jan 16, 2019, at 1:29 PM, Martin Thomson wrote: >=20 > On Wed, Jan 16, 2019, at 11:25, Paul Hoffman wrote: >> People from a few browser vendors have expressed unofficial interest = in=20 >> implementing at least parts of it if it gets standardized, so it = seems=20 >> like a good idea to try to standardize it. There is still a = reasonable=20 >> amount of work to be done in the document itself, and it certainly = needs=20 >> input from both browser and DNS folks. >=20 > What happened to DRIU? It seemed like there was an effort to work on = the problem more generally. =20 There was little interest in anything other than this part. > But I see the DoT comment down-thread and wonder whether this is the = right place for doing this sort of work. DPRIVE is (sadly very slowly) working on draft-ietf-dprive-bcp-op, where = DoT discovery would fit just fine. --Paul= --Apple-Mail=_1FCD5282-8F7B-4323-9B25-B3C9D8DA8C0F Content-Disposition: attachment; filename="smime.p7s" Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCC/Qw ggWeMIIEhqADAgECAhAG83jiXlqePPrfwUUEH4ZnMA0GCSqGSIb3DQEBCwUAMGUxCzAJBgNVBAYT AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAi BgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQTAeFw0xODA2MTMwMDAwMDBaFw0yMTA2 MTMxMjAwMDBaMIG9MQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEUMBIGA1UEBxML TG9zIEFuZ2VsZXMxPDA6BgNVBAoTM0ludGVybmV0IENvcnBvcmF0aW9uIGZvciBBc3NpZ25lZCBO YW1lcyBhbmQgTnVtYmVyczEeMBwGA1UEAxMVUGF1bCBIb2ZmbWFuIDIwMTgwNjEzMSUwIwYJKoZI hvcNAQkBFhZwYXVsLmhvZmZtYW5AaWNhbm4ub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEArTbxBbfxbk1VxDQsOmEm14Yta2AE5cBcJ/ktMkC+aQrTCMSXrQJfjiMUUndnfAT1DWcf jg706vvITa1lkFaLoF9b6cNICMKsibFruFy8ZA2bsIPRXPPzSsY6zibdStNCpruNTQoiL9bIxlQp qRUx/BfvHAhS7g5dAOcRgkpW9Q4Si5bl6A2qS0ImIMzktNcVxrWAn0HsG9u8cKcSCBJxavRAnMt/ XhE7tCICjyoeoprYZ2ztmdZUL6UgMNrDz/KoeNHAWzTAH45hn1Jz1IguGLM/M2Vb8mF8eP3wAh4p MVIi2jCwNqC497R8x0lsNryoG+uy/26nK6fhCTqVfF6hgQIDAQABo4IB7zCCAeswHwYDVR0jBBgw FoAU5wIjgABP2Ne8lAvZP3Q5STI8inkwHQYDVR0OBBYEFD+ST5hEHbTuHJZT9husDN7VLQdgMAwG A1UdEwEB/wQCMAAwIQYDVR0RBBowGIEWcGF1bC5ob2ZmbWFuQGljYW5uLm9yZzAOBgNVHQ8BAf8E BAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMEMGA1UdIAQ8MDowOAYKYIZIAYb9 bAQBAjAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMIGIBgNVHR8E gYAwfjA9oDugOYY3aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFzc3VyZWRJ RENBLWcyLmNybDA9oDugOYY3aHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFz c3VyZWRJRENBLWcyLmNybDB5BggrBgEFBQcBAQRtMGswJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3Nw LmRpZ2ljZXJ0LmNvbTBDBggrBgEFBQcwAoY3aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0Rp Z2lDZXJ0U0hBMkFzc3VyZWRJRENBLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAA7vGiITVJvEIgFN3 UVszD4nyt8ks8d/Ik5Uj1jPuD8+NX4lBpDOIvfYkCn8KYSrx+sMQrpoS2enbOMwekef3tObl2hVK 2Q+tv1GksPq9tQ98Ab1Odv1IM9aYaU1alR5/EEhc0uqs1Ulz2WUc8x/anf3/IpbHyEPdOCLiL9mi b4GDM8z9mqvAE+MtisqRs2+wlMzC/63sNKpA6KdfBNKMLHnyqCAKF7luGWp612yPmGoh63bBLrpR JQorI/fsv5SE2pK3Xf53W/ELf6sxWMsXm9iEgMeoAOtDeJHrv+i+vlldwHHJK6zlXIdVrjxRklyg ISXmlsdHs/sDp1MEqZTOXDCCBk4wggU2oAMCAQICEASueWBmZpAaucV/pmxb3M0wDQYJKoZIhvcN AQELBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMB4XDTEz MTEwNTEyMDAwMFoXDTI4MTEwNTEyMDAwMFowZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lD ZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hB MiBBc3N1cmVkIElEIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3PgRIz9qte/A J3kbLQWHohBDMd8O1BUbT3ekIs4+jHDwvgeO3ScqvAEdtiwKyt1pWB9B7WoFH9pjeFkeIiwr+Lp+ yTU7VvEffEJ+JbAjGcZFONc9RPkgfGCuHLBaGAS+jzv3qfCUmqYMY0m2QRdTQDK9T+ZQelAfJUXo 8Ymvzf9e/1Dz8BcR/73FifW9YrnY+45FBIVtmc3FSE39JqsCNkXqNtdfauIagkEK3OnZ9ZEXjsYh rTg8E+Yef2ac1U3ZRtr2z1KnfTskw7TBUTXGm+vU737kewPhRL16CzfgT8uCig1xGOSm4IksG/Oy czzBsJKeGH29q33FfQihLMKfcwIDAQABo4IC+DCCAvQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNV HQ8BAf8EBAMCAYYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdp Y2VydC5jb20wgYEGA1UdHwR6MHgwOqA4oDaGNGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdp Q2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwOqA4oDaGNGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9E aWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwME MIIBswYDVR0gBIIBqjCCAaYwggGiBgpghkgBhv1sAAIEMIIBkjAoBggrBgEFBQcCARYcaHR0cHM6 Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMA ZQAgAG8AZgAgAHQAaABpAHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0 AHUAdABlAHMAIABhAGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMA ZQByAHQAIABDAFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABh AHIAdAB5ACAAQQBnAHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkA YQBiAGkAbABpAHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAg AGgAZQByAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjAdBgNVHQ4EFgQU5wIjgABP 2Ne8lAvZP3Q5STI8inkwHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcN AQELBQADggEBAE7UiSe5/R2Hd34PKAWQ8QovyTs+vZOckMav+pFRhzJUa+jKwXFRXJmOtfrgYhmZ pgeafBMn2+UCooQS2RX2CkRXxDSPbXMfOtagAT3e44LkRWuy6yX9gF4dOZC+W0L2zpFg4/mgVgxI EM4zaHvNk6vwastPWA+5e10bBIGepyLiV0kn7pKTCL5pCFMCOi5dyBn0UIBOAtmwXZG0k4f5lpaB VUCOZu2C2LsoX+1MYe0GWCgZUxFEvEcgKbIEbNiJVJk7ddtneCweknjGVT1YEhEybr1DDE0023vG QtvsvqubYUwGkuOO3yEqUFcEwGCiNdUknmY3CUnP1fhls+DibsIxggMpMIIDJQIBATB5MGUxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j b20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQQIQBvN44l5anjz638FFBB+G ZzANBglghkgBZQMEAgEFAKCCAYEwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0B CQUxDxcNMTkwMTE2MjIzMjA2WjAvBgkqhkiG9w0BCQQxIgQg84Xsmxb6ojjV7xa7trytCR3iVXn/ rb2W5+aweBNoOCUwgYgGCSsGAQQBgjcQBDF7MHkwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERp Z2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQg U0hBMiBBc3N1cmVkIElEIENBAhAG83jiXlqePPrfwUUEH4ZnMIGKBgsqhkiG9w0BCRACCzF7oHkw ZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2lj ZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIENBAhAG83jiXlqePPrf wUUEH4ZnMA0GCSqGSIb3DQEBAQUABIIBAHcJ/DD1vKhWaSJl4QHurFyFPbk/e+0GI/TsRK2c+LGi /+YYNc7OEmXNsuwBWycFaWk2dKkrsn+wAzs6StvkMF8vl3OcL7AqIfINe7sRZLz0Ao0EUbG/Kpnn pRjAjG1qB6PCTI/hvgT6KrMis7Qu7BGGLKdV562c/Fb+ZEieuUqrAkcMAXbjKaokTjyT6t6yPCCG AUGE+ZgCBhyUKuk2CEFpp7rKHYSUA/L+VnYlz6JxL+n9Z6jvgLI3rIuel4MbA3/SC1jX2h0D/AvE xRAtNd8ZlnbdjFcvT9Fi9xqIAdgGTW1HuerObEz8eYZA6gO+zPSdX9lGwArooW1WFnu6cbAAAAAA AAA= --Apple-Mail=_1FCD5282-8F7B-4323-9B25-B3C9D8DA8C0F-- From nobody Thu Jan 17 02:18:27 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6FAE5128B14 for ; Thu, 17 Jan 2019 02:18:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.554 X-Spam-Level: X-Spam-Status: No, score=-6.554 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-4.553, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sky.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3Xx18oIwIGQP for ; Thu, 17 Jan 2019 02:18:23 -0800 (PST) Received: from EUR04-HE1-obe.outbound.protection.outlook.com (mail-he1eur04on0619.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe0d::619]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7C503130DFA for ; Thu, 17 Jan 2019 02:18:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sky.uk; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Cuidk2Lq9vBWFwS7n7LL+aTsUXWaNRNSXIkrXTiRgW0=; b=MIuIwOmHX6iPWLGAhKFhgagr11ToOsDLYuKIRcg4KDhrNOuA/Y5dmtW43QBpQXWBvSt7lxxxldmUiUkHZspzXBKmIedolLi0jTBUpUperQhVu5F4o2wGwOtPFiIOesJWqA3Z28Y//QPAsmVNpRRnKxtbxDMtxW3KxFrENZhhQ/g= Received: from DB6PR0601MB2184.eurprd06.prod.outlook.com (10.168.57.137) by DB6PR0601MB2216.eurprd06.prod.outlook.com (10.168.57.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1537.26; Thu, 17 Jan 2019 10:18:20 +0000 Received: from DB6PR0601MB2184.eurprd06.prod.outlook.com ([fe80::b5e6:9692:98b9:83]) by DB6PR0601MB2184.eurprd06.prod.outlook.com ([fe80::b5e6:9692:98b9:83%6]) with mapi id 15.20.1537.018; Thu, 17 Jan 2019 10:18:20 +0000 From: "Winfield, Alister" To: "doh@ietf.org" Thread-Topic: [EXTERNAL] Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh Thread-Index: AQHUreJ/oWEZWxkEakamBfJ6NkBIVaWzQCqA Date: Thu, 17 Jan 2019 10:18:20 +0000 Message-ID: <9053D84B-4238-4AC2-9B51-5602CBBFDC9B@sky.uk> References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> <1547674141.291889.1636540384.54D5BB3E@webmail.messagingengine.com> In-Reply-To: <1547674141.291889.1636540384.54D5BB3E@webmail.messagingengine.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.14.0.181208 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Alister.Winfield@sky.uk; x-originating-ip: [90.216.150.239] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; DB6PR0601MB2216; 6:SLZsqGtkQO7Wi1Refo0CcAkB9QUjdOvFEhhzSn57VxOH2sxVOK0f8np5OJyUnr9jk8QCa0HjX2Zk4rBXBivtWLs1sn0hE4RmIQOJgtzMDLgYKaNXIBOF32vHSGxRv1tSHqwqLJuw7UkvCEYJKoKwh7R1/MLkT9tHausm5hrGcWwse603nZwaxf0ZV+CMtZlz29jNqTcQsUIF+vPskXZXoJswgi7FWPXporq4CE8Z4pAVp0fhqUZRDsEHlZzYJUCs2meWdhCQbDkiMZuWLhs1DFR36MinG/F+9lFK8AM3K9g0xGXmZu8NmelPoT7iQRfXPQKVjxS/Eufv/gengl1Da/XKDMmI71o4X6Mqk88LG4uq9OKv8G4pP3uN2lIeCmh9lxgE9Eo8jj8rbpIqfco6Vh4z60QsRRs0MXFPdz0Nw8ZqIPEwwU0hDpbyAaCUqgN6qqkJkotr4NV+cijYG+Vc8A==; 5:CXCSFO7r6mgEYBwu+9btcKsM4VGXIhtngr80f3eTPLmu4r4E9QsjnJW+2nSyKAhgmwSWArOO5GNkrYHcVDZB/qfPtUUEBfz9TnS5Ql7B15X2ctkLOWT/71Y9dvZpGT8hyGTzYY7SngkG4mjc9nUNFHy8cVPgBr4680uEdm1+K9dNsKbYtmNyzpJbUeya/oQfcKi3kIB/PSlXFCdtvlK6Hg==; 7:I5aQV+2Pp6DI+AsFNpSW6bhmaeHXPdaguv55x7Ou2DUmlGiNEjCDNjqSDyHw6/LlodLry0IXyd8UpLUN33/ay/Z04QtwyUjQesEM3nmC58FuuCI4sEd2sWc5sxl+RlJZoCwkj/TMTfR8Au6iutZGjw== x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 5ae4ed69-ea21-406a-e05e-08d67c651ac4 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600109)(711020)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7153060)(7193020); SRVR:DB6PR0601MB2216; x-ms-traffictypediagnostic: DB6PR0601MB2216: x-microsoft-antispam-prvs: x-forefront-prvs: 0920602B08 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(39860400002)(346002)(396003)(376002)(136003)(199004)(189003)(256004)(105586002)(33896004)(6506007)(99286004)(6246003)(14444005)(76176011)(316002)(68736007)(72206003)(5660300001)(5024004)(305945005)(7736002)(58126008)(3846002)(6306002)(5640700003)(6116002)(6512007)(97736004)(25786009)(2906002)(53936002)(229853002)(6436002)(66066001)(2501003)(36756003)(33656002)(74482002)(6486002)(83716004)(71200400001)(6916009)(71190400001)(66574012)(486006)(478600001)(11346002)(476003)(446003)(106356001)(2616005)(8676002)(86362001)(102836004)(966005)(14454004)(186003)(8936002)(82746002)(26005)(81156014)(2351001)(81166006)(1730700003); DIR:OUT; SFP:1101; SCL:1; SRVR:DB6PR0601MB2216; H:DB6PR0601MB2184.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:0; MX:1; received-spf: None (protection.outlook.com: sky.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: ylFTEryugPR0AHhlT82MCx9PgULzke3t5yM2GLUBNo7kTZinwZdmVppamnC84lhvG2G5JdoxjYiLiTYmdlGVZsQt6zdMc1VbA1KQpMoMmzo82cKsTS4mZr8ZoFLKQ52QF4mvamJ8JbUNSCxzGlqubOzSJswfXu/OVIrGAvw/w6XIRI8gf11AiiSCQfvWJwhk5ENs6MTtfxWTJkoGKjguwRxIjpYZdiDR12dEpfVqZVABNgU+AsOucB6OmrbEwGLCcmBfkXpV7+DF771VdwvNNtgUKqLfNs/949GhioxWXsS9+0ibOGzmuuBp1smMBDSEZ/KZ2HZFNp2UiC9Z9f548+ZMnmNxOOxCOtPgotSKCPvo/PcGz4PORU4KOP9YfASiOr5zKvA80gYoVnhtCuj+v7b4w7dtN5z0A+T3CTsB/j0= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-ID: <8BFE6D8FC01B93419E287721ACC4A249@eurprd06.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: sky.uk X-MS-Exchange-CrossTenant-Network-Message-Id: 5ae4ed69-ea21-406a-e05e-08d67c651ac4 X-MS-Exchange-CrossTenant-originalarrivaltime: 17 Jan 2019 10:18:20.0833 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 68b865d5-cf18-4b2b-82a4-a4eddb9c5237 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0601MB2216 Archived-At: Subject: Re: [Doh] [EXTERNAL] Re: Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Jan 2019 10:18:26 -0000 SSdtIGN1cmlvdXMgZGlkIGFueSBvZiB0aG9zZSBicm93c2VycyB3cml0ZXJzIHNheSBhbnl0aGlu ZyBhYm91dCBob3cgdGhpcyB3b3VsZCBiZSBpbXBsZW1lbnRlZD8NCg0KTXkgZ3Vlc3NlcyBhcmU6 DQoNCkFzIGEgd2F5IHRoYXQgbG9jYWwgZGVmaW5lZCBETlMgc2VydmVycyBjYW4gb2ZmZXIgRG9I IHNlcnZpY2UgPw0KQXMgYSB3YXkgdG8gc2ltcGxpZnkgY29uZmlndXJhdGlvbiBvZiBEb0ggPw0K U29tZXRoaW5nIGVsc2UgPw0KDQpPciwgaXQncyB0b28gc29vbiBhbmQgd2UgY2FuL3Nob3VsZCBt YWtlIHN1Z2dlc3Rpb25zIGFzIHRvIHRoZSBpbnRlbnQgaGVyZS4NCg0KKHBsZWFzZSBmb3JnaXZl IG1lIGlmIHRoaXMgaGFzIGJlZW4gYXNrZWQgYmVmb3JlKQ0KDQpBbGlzdGVyIFdpbmZpZWxkDQoN Cg0KDQrvu79PbiAxNi8wMS8yMDE5LCAyMToyOSwgIkRvaCBvbiBiZWhhbGYgb2YgTWFydGluIFRo b21zb24iIDxkb2gtYm91bmNlc0BpZXRmLm9yZyBvbiBiZWhhbGYgb2YgbXRAbG93ZW50cm9weS5u ZXQ+IHdyb3RlOg0KDQogICAgT24gV2VkLCBKYW4gMTYsIDIwMTksIGF0IDExOjI1LCBQYXVsIEhv ZmZtYW4gd3JvdGU6DQogICAgPiBQZW9wbGUgZnJvbSBhIGZldyBicm93c2VyIHZlbmRvcnMgaGF2 ZSBleHByZXNzZWQgdW5vZmZpY2lhbCBpbnRlcmVzdCBpbg0KICAgID4gaW1wbGVtZW50aW5nIGF0 IGxlYXN0IHBhcnRzIG9mIGl0IGlmIGl0IGdldHMgc3RhbmRhcmRpemVkLCBzbyBpdCBzZWVtcw0K ICAgID4gbGlrZSBhIGdvb2QgaWRlYSB0byB0cnkgdG8gc3RhbmRhcmRpemUgaXQuIFRoZXJlIGlz IHN0aWxsIGEgcmVhc29uYWJsZQ0KICAgID4gYW1vdW50IG9mIHdvcmsgdG8gYmUgZG9uZSBpbiB0 aGUgZG9jdW1lbnQgaXRzZWxmLCBhbmQgaXQgY2VydGFpbmx5IG5lZWRzDQogICAgPiBpbnB1dCBm cm9tIGJvdGggYnJvd3NlciBhbmQgRE5TIGZvbGtzLg0KDQogICAgV2hhdCBoYXBwZW5lZCB0byBE UklVPyAgSXQgc2VlbWVkIGxpa2UgdGhlcmUgd2FzIGFuIGVmZm9ydCB0byB3b3JrIG9uIHRoZSBw cm9ibGVtIG1vcmUgZ2VuZXJhbGx5LiAgQnV0IEkgc2VlIHRoZSBEb1QgY29tbWVudCBkb3duLXRo cmVhZCBhbmQgd29uZGVyIHdoZXRoZXIgdGhpcyBpcyB0aGUgcmlnaHQgcGxhY2UgZm9yIGRvaW5n IHRoaXMgc29ydCBvZiB3b3JrLg0KDQogICAgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX18NCiAgICBEb2ggbWFpbGluZyBsaXN0DQogICAgRG9oQGlldGYub3Jn DQogICAgaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9kb2gNCiAgICAtLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLQ0KICAgIFRoaXMgZW1haWwgaXMgZnJvbSBhbiBleHRlcm5hbCBzb3VyY2UuIFBsZWFz ZSBkbyBub3Qgb3BlbiBhdHRhY2htZW50cyBvciBjbGljayBsaW5rcyBmcm9tIGFuIHVua25vd24g b3Igc3VzcGljaW91cyBvcmlnaW4uIFBoaXNoaW5nIGF0dGVtcHRzIGNhbiBiZSByZXBvcnRlZCBi eSBzZW5kaW5nIHRoZW0gdG8gcGhpc2hpbmdAc2t5LnVrIGFzIGF0dGFjaG1lbnRzLiBUaGFuayB5 b3UNCiAgICAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLQ0KDQoNCg0KSW5mb3JtYXRpb24gaW4gdGhpcyBlbWFpbCBpbmNs dWRpbmcgYW55IGF0dGFjaG1lbnRzIG1heSBiZSBwcml2aWxlZ2VkLCBjb25maWRlbnRpYWwgYW5k IGlzIGludGVuZGVkIGV4Y2x1c2l2ZWx5IGZvciB0aGUgYWRkcmVzc2VlLiBUaGUgdmlld3MgZXhw cmVzc2VkIG1heSBub3QgYmUgb2ZmaWNpYWwgcG9saWN5LCBidXQgdGhlIHBlcnNvbmFsIHZpZXdz IG9mIHRoZSBvcmlnaW5hdG9yLiBJZiB5b3UgaGF2ZSByZWNlaXZlZCBpdCBpbiBlcnJvciwgcGxl YXNlIG5vdGlmeSB0aGUgc2VuZGVyIGJ5IHJldHVybiBlLW1haWwgYW5kIGRlbGV0ZSBpdCBmcm9t IHlvdXIgc3lzdGVtLiBZb3Ugc2hvdWxkIG5vdCByZXByb2R1Y2UsIGRpc3RyaWJ1dGUsIHN0b3Jl LCByZXRyYW5zbWl0LCB1c2Ugb3IgZGlzY2xvc2UgaXRzIGNvbnRlbnRzIHRvIGFueW9uZS4gUGxl YXNlIG5vdGUgd2UgcmVzZXJ2ZSB0aGUgcmlnaHQgdG8gbW9uaXRvciBhbGwgZS1tYWlsIGNvbW11 bmljYXRpb24gdGhyb3VnaCBvdXIgaW50ZXJuYWwgYW5kIGV4dGVybmFsIG5ldHdvcmtzLiBTS1kg YW5kIHRoZSBTS1kgbWFya3MgYXJlIHRyYWRlbWFya3Mgb2YgU2t5IExpbWl0ZWQgYW5kIFNreSBJ bnRlcm5hdGlvbmFsIEFHIGFuZCBhcmUgdXNlZCB1bmRlciBsaWNlbmNlLg0KDQpTa3kgVUsgTGlt aXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAyOTA2OTkxKSwgU2t5LUluLUhvbWUgU2VydmljZSBMaW1p dGVkIChSZWdpc3RyYXRpb24gTm8uIDIwNjcwNzUpLCBTa3kgU3Vic2NyaWJlcnMgU2VydmljZXMg TGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAyMzQwMTUwKSBhbmQgU2t5IENQIExpbWl0ZWQgKFJl Z2lzdHJhdGlvbiBOby4gOTUxMzI1OSkgYXJlIGRpcmVjdCBvciBpbmRpcmVjdCBzdWJzaWRpYXJp ZXMgb2YgU2t5IExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gMjI0NzczNSkuIEFsbCBvZiB0aGUg Y29tcGFuaWVzIG1lbnRpb25lZCBpbiB0aGlzIHBhcmFncmFwaCBhcmUgaW5jb3Jwb3JhdGVkIGlu IEVuZ2xhbmQgYW5kIFdhbGVzIGFuZCBzaGFyZSB0aGUgc2FtZSByZWdpc3RlcmVkIG9mZmljZSBh dCBHcmFudCBXYXksIElzbGV3b3J0aCwgTWlkZGxlc2V4IFRXNyA1UUQNCg== From nobody Thu Jan 17 12:01:55 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9FCD9130FF4 for ; Thu, 17 Jan 2019 12:01:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.642 X-Spam-Level: X-Spam-Status: No, score=-17.642 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.142, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rUBjuHOL7dOM for ; Thu, 17 Jan 2019 12:01:44 -0800 (PST) Received: from mail-vs1-xe36.google.com (mail-vs1-xe36.google.com [IPv6:2607:f8b0:4864:20::e36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B315D130FA5 for ; Thu, 17 Jan 2019 12:01:43 -0800 (PST) Received: by mail-vs1-xe36.google.com with SMTP id z3so7000562vsf.7 for ; Thu, 17 Jan 2019 12:01:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=TPNFBe0Vl4ep3YHG/iY99QjYlqNSYu7PqCV6d/2mu/U=; b=SMYCeupOpRdy8T8d1I4c+KjcbEwXdfxLdnKj8lpTupMuE0cMkuRlkh6UuZJ9hzSe8W 9Z+9GK65g3RgTHcH68tMu7tzzr0B+gWgVzfLRIpHAKdK1lBdw79Uwr5SKfDTBMxGiIVr uJEsUri9NK29FTb7ybwzXFgx0GsfPyr+Tr0A+2xsZ8B6BkLErv7GJj8XfzRi6/pXK5EB B6ChjsTepqn2a/zf6HOWYzaPoMLZ0naCvZV3B/6KbuYvau1XgScwgL/lZEkJILgm+LRu rxPJEtgEr6T02NR7+XUlxowvKGknQBLme+gk6UVkv/R5EPKTFV75ika1tpp152Hf5Ga8 7Iyw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=TPNFBe0Vl4ep3YHG/iY99QjYlqNSYu7PqCV6d/2mu/U=; b=qnQXAjy4UMsJFDD44aFztKeuqa5EmW5/ScvPp6DX/EmT75YZM8Qtw3lT2WvHZmgsaZ mvP2lNGyoD4RjDqdQHC21W/ocz1gD347DxGGUp/nPRH6Tecltmv+fTxJa/nU5g5O5eb4 9N7Trfe0fjpJut3n0EUyqKCMVnMDvc+D5V/bqZYGiKXbUlzNhLmybz2JSDmKW94D9q/I XrjXXNO2d2qhToQAL2MwfKtdBxqEJTc3af65Cfg4pK+yu1Ts84aQXCrnhQwFGcOM2JKE RAlfmpP0wLIMGOgWzHAeYfyTgyaD9l0pc9fg4MsNrnzIz/5sOVQLwu3jouCeurChCOo4 SEEg== X-Gm-Message-State: AJcUukcUjhJaERNkEtWEtIgJjJsbka+6Zwu/Fjf0FhAsrtEGa+/w2oWc kLmb+HGzAGelMi+dRIuPSavNhRT/v/RgUaXic0foTQ== X-Google-Smtp-Source: ALg8bN7/DH78zIy9JFd85jS9cZE9YEr2Riq9/I+n4SAq9EwVw1DjXhhHgodARL4J/f0VE0QhYxfdQR1+LAfBo8DfoGA= X-Received: by 2002:a67:ad02:: with SMTP id t2mr6271732vsl.170.1547755302348; Thu, 17 Jan 2019 12:01:42 -0800 (PST) MIME-Version: 1.0 References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> <1547674141.291889.1636540384.54D5BB3E@webmail.messagingengine.com> <9053D84B-4238-4AC2-9B51-5602CBBFDC9B@sky.uk> In-Reply-To: <9053D84B-4238-4AC2-9B51-5602CBBFDC9B@sky.uk> From: Ben Schwartz Date: Thu, 17 Jan 2019 15:01:30 -0500 Message-ID: To: "Winfield, Alister" Cc: "doh@ietf.org" Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="000000000000085e0a057facdd46" Archived-At: Subject: Re: [Doh] [EXTERNAL] Re: Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Jan 2019 20:01:54 -0000 --000000000000085e0a057facdd46 Content-Type: multipart/alternative; boundary="000000000000ff6102057facdc40" --000000000000ff6102057facdc40 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Jan 17, 2019 at 5:18 AM Winfield, Alister wrote: > I'm curious did any of those browsers writers say anything about how this > would be implemented? > > My guesses are: > > As a way that local defined DNS servers can offer DoH service ? > As a way to simplify configuration of DoH ? > Something else ? > > Or, it's too soon and we can/should make suggestions as to the intent her= e. > Previously [1] on this list, a Google employee who works on Chrome described a use case relevant to Chrome. Does this answer your question? [1] https://mailarchive.ietf.org/arch/msg/doh/37zSj-gLYhuHTnFhMb01Yfaixbg > > (please forgive me if this has been asked before) > > Alister Winfield > > > > =EF=BB=BFOn 16/01/2019, 21:29, "Doh on behalf of Martin Thomson" < > doh-bounces@ietf.org on behalf of mt@lowentropy.net> wrote: > > On Wed, Jan 16, 2019, at 11:25, Paul Hoffman wrote: > > People from a few browser vendors have expressed unofficial interes= t > in > > implementing at least parts of it if it gets standardized, so it > seems > > like a good idea to try to standardize it. There is still a > reasonable > > amount of work to be done in the document itself, and it certainly > needs > > input from both browser and DNS folks. > > What happened to DRIU? It seemed like there was an effort to work on > the problem more generally. But I see the DoT comment down-thread and > wonder whether this is the right place for doing this sort of work. > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > -------------------------------------------------------------------- > This email is from an external source. Please do not open attachments > or click links from an unknown or suspicious origin. Phishing attempts ca= n > be reported by sending them to phishing@sky.uk as attachments. Thank you > -------------------------------------------------------------------- > > > > Information in this email including any attachments may be privileged, > confidential and is intended exclusively for the addressee. The views > expressed may not be official policy, but the personal views of the > originator. If you have received it in error, please notify the sender by > return e-mail and delete it from your system. You should not reproduce, > distribute, store, retransmit, use or disclose its contents to anyone. > Please note we reserve the right to monitor all e-mail communication > through our internal and external networks. SKY and the SKY marks are > trademarks of Sky Limited and Sky International AG and are used under > licence. > > Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited > (Registration No. 2067075), Sky Subscribers Services Limited (Registratio= n > No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or > indirect subsidiaries of Sky Limited (Registration No. 2247735). All of t= he > companies mentioned in this paragraph are incorporated in England and Wal= es > and share the same registered office at Grant Way, Isleworth, Middlesex T= W7 > 5QD > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --000000000000ff6102057facdc40 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Thu, Jan 17, 2019 at = 5:18 AM Winfield, Alister <Alister.Winfield=3D40sky.uk@dmarc.ietf.org> wrote:
I'm = curious did any of those browsers writers say anything about how this would= be implemented?

My guesses are:

As a way that local defined DNS servers can offer DoH service ?
As a way to simplify configuration of DoH ?
Something else ?

Or, it's too soon and we can/should make suggestions as to the intent h= ere.

Previously [1] on this list, a Goo= gle employee who works on Chrome described a use case relevant to Chrome.= =C2=A0 Does this answer your question?

=C2=A0

(please forgive me if this has been asked before)

Alister Winfield



=EF=BB=BFOn 16/01/2019, 21:29, "Doh on behalf of Martin Thomson" = <doh-bounces@i= etf.org on behalf of mt@lowentropy.net> wrote:

=C2=A0 =C2=A0 On Wed, Jan 16, 2019, at 11:25, Paul Hoffman wrote:
=C2=A0 =C2=A0 > People from a few browser vendors have expressed unoffic= ial interest in
=C2=A0 =C2=A0 > implementing at least parts of it if it gets standardize= d, so it seems
=C2=A0 =C2=A0 > like a good idea to try to standardize it. There is stil= l a reasonable
=C2=A0 =C2=A0 > amount of work to be done in the document itself, and it= certainly needs
=C2=A0 =C2=A0 > input from both browser and DNS folks.

=C2=A0 =C2=A0 What happened to DRIU?=C2=A0 It seemed like there was an effo= rt to work on the problem more generally.=C2=A0 But I see the DoT comment d= own-thread and wonder whether this is the right place for doing this sort o= f work.

=C2=A0 =C2=A0 _______________________________________________
=C2=A0 =C2=A0 Doh mailing list
=C2=A0 =C2=A0 Doh@ietf.or= g
=C2=A0 =C2=A0 https://www.ietf.org/mailman/listinfo/doh=
=C2=A0 =C2=A0 -------------------------------------------------------------= -------
=C2=A0 =C2=A0 This email is from an external source. Please do not open att= achments or click links from an unknown or suspicious origin. Phishing atte= mpts can be reported by sending them to phishing@sky.uk as attachments. Thank you
=C2=A0 =C2=A0 -------------------------------------------------------------= -------



Information in this email including any attachments may be privileged, conf= idential and is intended exclusively for the addressee. The views expressed= may not be official policy, but the personal views of the originator. If y= ou have received it in error, please notify the sender by return e-mail and= delete it from your system. You should not reproduce, distribute, store, r= etransmit, use or disclose its contents to anyone. Please note we reserve t= he right to monitor all e-mail communication through our internal and exter= nal networks. SKY and the SKY marks are trademarks of Sky Limited and Sky I= nternational AG and are used under licence.

Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Reg= istration No. 2067075), Sky Subscribers Services Limited (Registration No. = 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indire= ct subsidiaries of Sky Limited (Registration No. 2247735). All of the compa= nies mentioned in this paragraph are incorporated in England and Wales and = share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD=
_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
--000000000000ff6102057facdc40-- --000000000000085e0a057facdd46 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMYJWDwudxwNjwu8B4MA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE4MTAxNDA4MjIxMloXDTE5MDQx MjA4MjIxMlowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCjAFK2jxl2SbwdLgmpNj92zrqk75pYCWjsHhvdBpOYu7YqUel7 tZEj5mGxVhKL8jbTW9bEM/iB1XBfK+JjPXV+WADiV+9+yRRDRugD0oy5iTiEFNVATSd4G5Su+lfw aCM7aa4opbbXPkehb7Gkx3zks54gj2F5KH7dvmvMdAVZuH6Ff4TnUkzolgu/llEzjYArUXHDaAR4 WE02VO3FbyLV97Y68Z3gtHbzsyAOXK6hjLiVwGBTaWaApt9i+d0jR0SDWClPDyK3Vq3QhLVpewN8 bRR1rb72UKt2an3n95SrvbhD639vfyy/cHR09HxDXXlTfyugAk0kYIQiqwS1X74zAgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFDPcHr72CmAhHX2sPCeQbgmPbXZWMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQATQwVzUhwG45UvRH44 Ls0IDXKJb9GVoZurKcd19M1EtjywGT6ZfFDW1DenoGaf/gizTDc0dHMLV79yXlj6yLtsDkP6rb7f zOyczFMqHbXRXT9YDJlPcOrtp3E2wA/HHph+nimVhrmfcGMndO5AV2DzTD2oOQe5C/mh9RUT5z6/ CrUQ0dAaBZweRC8agj/PQ4Jnen/kqDBE/TgK0ChQ7Q44MkuENG0dp2bPuHG7ZPKkqZ2V5LGhrba4 c4MtQvK9dyNE8urDPL70ogUS3pwBvfui1H1gbHJwe3npqkBvuqswxS7IvDmW88A1wGeWt/02LLQP ysd6YM+XWMe3rBB1zzJDMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMYJWDwudx wNjwu8B4MA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCDobp6XWEL1vpLwZo4dQgo9 1I60Ncxt0j5HHm2qlBDNgzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTAxMTcyMDAxNDJaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAoIFgBwBg4VJaBWCSmOLdVg8/dV/6cG3lgykTtJIJ 54PlzBllAiieQ5GpR66IKaIlkTpI4fRdpnKP8hyyfPaNOHN3nsOBH3YJZUW/kDJ2o28tCN5QyJVw Y6x7FRPbhlNOdrMPD+uZBpUlOUszNAu9Mele7Th+NtA29sR8lg6ahrr/huRuhjyu/il/tw1vgL7a vpQjOOS6DKOjm5nfZ2JTpoXSCZ3FvJA5sbos9h3EWgnUr6kH1/tpJbFzbRWw8DGuRQUf/xOXeBLQ dmbjvSoj1XUZaX0zeDxjh2yZVStnJ5q92G4NK+aZm0fsCGAtNGj7BPotwEfmGE4YbG+4D0RAqw== --000000000000085e0a057facdd46-- From nobody Tue Jan 22 03:59:27 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 795C4130F04 for ; Tue, 22 Jan 2019 03:59:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=sinodun.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eUXcmdPfHtT6 for ; Tue, 22 Jan 2019 03:59:22 -0800 (PST) Received: from balrog.mythic-beasts.com (balrog.mythic-beasts.com [IPv6:2a00:1098:0:82:1000:0:2:1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C39581228B7 for ; Tue, 22 Jan 2019 03:59:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sinodun.com ; s=balrog-2018; h=Date:Subject:To:From; bh=M2m/Qq/Op+KAs/vYDmSO//OvMICa0amDn2itXM9sV7Y=; b=qyolkazmMpFTCVNselmRJusfG7 YMYCbag9CysquDCNM+rTivCTmoh4kFNUQQz7s3TXELOS1m04Co/CFrXQrcjBR0oQM7DO2I1AlcReo xfVLLFb7NH8uezuuMY7sp9ES33Ac44MTcKurLTiuJSXh2hHkQFhxbmuiTwoTxyRoOTb0qfPdzaPmQ 53gsbC1WhrPohMjr6L2ZP0yW8Y/1JEDpeLKqGqVJxHwi+VLliRbPS80g3k/5FFCVHnWfeVaj4ualu qgb3vncohcvufqv11IOZg2+RXo15pSZyoaJFCu8UrfGSSTdA9INXqluG/wAOX56u2lRySJ05E+q3L E9DgVpRQ==; Received: from [2001:b98:204:102:fff1::f145] (port=61034 helo=[192.168.12.13]) by balrog.mythic-beasts.com with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1glui5-0003wZ-5N; Tue, 22 Jan 2019 11:59:21 +0000 From: "John Dickinson" To: "Paul Hoffman" , doh@ietf.org Date: Tue, 22 Jan 2019 11:58:33 +0000 X-Mailer: MailMate (1.12.3r5579) Message-ID: In-Reply-To: <78C9AA8D-1599-46F1-91C7-356E58DD960A@icann.org> References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> <1547674141.291889.1636540384.54D5BB3E@webmail.messagingengine.com> <78C9AA8D-1599-46F1-91C7-356E58DD960A@icann.org> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_1F311ABC-4F6C-4DBD-BEF8-61AB71A0458D_="; micalg=pgp-sha512; protocol="application/pgp-signature" X-BlackCat-Spam-Score: -21 Archived-At: Subject: Re: [Doh] [Ext] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Jan 2019 11:59:26 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_1F311ABC-4F6C-4DBD-BEF8-61AB71A0458D_= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 16 Jan 2019, at 22:32, Paul Hoffman wrote: > On Jan 16, 2019, at 1:29 PM, Martin Thomson wrote: >> >> On Wed, Jan 16, 2019, at 11:25, Paul Hoffman wrote: >>> People from a few browser vendors have expressed unofficial interest = in >>> implementing at least parts of it if it gets standardized, so it seem= s >>> like a good idea to try to standardize it. There is still a reasonabl= e >>> amount of work to be done in the document itself, and it certainly ne= eds >>> input from both browser and DNS folks. >> >> What happened to DRIU? It seemed like there was an effort to work on = the problem more generally. > > There was little interest in anything other than this part. > >> But I see the DoT comment down-thread and wonder whether this is the r= ight place for doing this sort of work. > > DPRIVE is (sadly very slowly) working on draft-ietf-dprive-bcp-op, wher= e DoT discovery would fit just fine. > I don=E2=80=99t think so. The BCP is Informational, I see server discover= y (requiring extensions to the protocol) as well out of scope for the BCP= =2E As mentioned by Ben, for opportunistic DoT port 853 can be probed, but th= ere is still no DNS or DHCP solution for Strict DoT (i.e. securely obtain= ing the authentication domain name). My understanding of this draft is that it provides only an =E2=80=98oppor= tunistic=E2=80=99 discovery mechanism for DoH where the resulting URI tem= plate cannot be DNSSEC validated by the system resolver or the requesting= application/browser. If that is the case the resulting HTTPS connection = _could_ have been re-directed and so I think that should be spelt out mor= e clearly. For example, I think that at least the title should be somethi= ng more like =E2=80=98Associating a DoH Server with a Resolver for Opport= unistic DoH=E2=80=99. Other comments: I find this draft extremely difficult to read. For example, I am unable t= o easily parse Section 1, Para. 2, Sentence 1: =E2=80=9CThere is a use case for browsers and web applications to want= the DNS recursive resolver(s) configured in the operating system to use DoH for DNS resolution instead of normal DNS, but to do so to at a DoH server specified by the configured resolver.=E2=80=9D I find the rest of the Introduction just as difficult to read. Please add SUDN to the Terminology section and to the next DNS Terminolog= y -bis draft. Section 2.1 =E2=80=9Cthe zone resolver-associated-doh.arpa is not actually delegated and never will be.=E2=80=9D So it can never be DNSSEC signed unless you use a local trust anchor. Section 2.2 =E2=80=9CTo find the DoH servers associated with a resolver, the clien= t sends a query to https://IPADDRESSGOESHERE/.well-known/doh-servers-associated/=E2=80=9D= Need to make it clear that this is a DoH query not a regular =E2=80=9C= http query=E2=80=9D Section 3 makes no mention of the fact that the OS stub resolver typicall= y has more than 1 resolver configured. Section 4 =E2=80=9CThat wording might say something like "DoH server associated with my current resolver" (or "servidor DoH asociado con mi resolucion actual" or "serveur DoH associe a mon resolveur actuel=E2=80=9D).=E2=80=9D Is this intended to be read only configuration? It doesn=E2=80=99t sou= nd like a configuration item for a User to edit. I do not think this draft should be adopted until a separate use cases do= cument is written (I am happy to help write it). regards John John Dickinson https://sinodun.com Sinodun Internet Technologies Ltd. Magdalen Centre Oxford Science Park Robert Robinson Avenue Oxford OX4 4GA U.K. --=_MailMate_1F311ABC-4F6C-4DBD-BEF8-61AB71A0458D_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQJEBAEBCgAuFiEEkBPk5F7sVwWxxZAfLcYUQj0n4iwFAlxHBWkQHGphZEBzaW5v ZHVuLmNvbQAKCRAtxhRCPSfiLO+cEAC3VIVIGg4gVzsZL5PtRRm2+sQQNmg0BSG6 NOsKit3JVFsTWKE0oCUC70YDuteyZLQ4qMrCUsUCQDKDNHjxlwYCJW5W4HQGO3dK kGNxgWhq5TcnTEjR+4BOis+TCY8N13Sm8WFVWLW/bQpOI/S9Fc2c4L+h6qoz8lyh kW3rnjQCykMnifHjUkUk5qxH2LwTpliUiuEipmapDLkc11mnJLBmyyJSYMwZhKK4 iAbBiYsIgL0UMr8fnhFPbGilN5sMS9UbftjRBVSb6dRtYQ7zygGSSgux2Z8yASUW hejmvC4TnOqTQ9tHfRLTA6xcXCBrIt48pG/in5z9ycyTnZbL/F48Qmokgd8WUwtR hDczwBm7iLPhH3tWzVy7S9jYzc7r+Scf3PIPKrsa+mTFc9Q7aKGtMrCB32c0h+z+ mnfj4LMcshymW4GCWUXOiziT5CYH4QJLOiEBnBQP/7hdJRYGB5npUgNfR26jn4nV bfopLqB2ikOMMrdREnvcBp0iaZ1GhXB2j3CRsC2ZZmcQK6o7eOMysC2AHnxB58D5 A0O7dSgr13Dm0x4/Udac4OE2l7+KWlj2GrOmfgtPujGXOVsrLilYuN2P4me6lomF AZz+f7J6YI2qskCKNXC2Y8SVMxBtH1mL5b3yxUiU45oUDAOroebtTSnE6u5CNpvf yPFNH8vb/Q== =leB9 -----END PGP SIGNATURE----- --=_MailMate_1F311ABC-4F6C-4DBD-BEF8-61AB71A0458D_=-- From nobody Tue Jan 22 04:15:33 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EF2DB130F28 for ; Tue, 22 Jan 2019 04:15:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.553 X-Spam-Level: X-Spam-Status: No, score=-6.553 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-4.553, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sky.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qz0gstEnY2kd for ; Tue, 22 Jan 2019 04:15:29 -0800 (PST) Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-eopbgr150055.outbound.protection.outlook.com [40.107.15.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4DEF2130F21 for ; Tue, 22 Jan 2019 04:15:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sky.uk; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=PiT0H1OEgi/dBwmx2FtByUn9si+ckB5vyLphuClF4as=; b=fKNcySb3fpeYLe4AXfC7NNJkfBii5fQFh9+/SCGVYhnQVraY0zXeiNaFMwXIgiu/SiboHgfQI09Aag15XDRL3/DqNCxucXc0hckDWoBesg/EUcBdhSGRkEbQDh9DVi5+gqpb2ww55z+wnJCsjm4pcSkfwMKgbWf43jVr+j5CS7s= Received: from DB6PR0601MB2184.eurprd06.prod.outlook.com (10.168.57.137) by DB6PR0601MB2151.eurprd06.prod.outlook.com (10.168.57.134) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1537.27; Tue, 22 Jan 2019 12:15:26 +0000 Received: from DB6PR0601MB2184.eurprd06.prod.outlook.com ([fe80::b5e6:9692:98b9:83]) by DB6PR0601MB2184.eurprd06.prod.outlook.com ([fe80::b5e6:9692:98b9:83%6]) with mapi id 15.20.1537.031; Tue, 22 Jan 2019 12:15:26 +0000 From: "Winfield, Alister" To: John Dickinson , Paul Hoffman , "doh@ietf.org" Thread-Topic: [EXTERNAL] Re: [Doh] [Ext] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh Thread-Index: AQHUretdwnoFIE+c3UubPsBPQiKgY6W7N8GAgAAEuAA= Date: Tue, 22 Jan 2019 12:15:26 +0000 Message-ID: References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> <1547674141.291889.1636540384.54D5BB3E@webmail.messagingengine.com> <78C9AA8D-1599-46F1-91C7-356E58DD960A@icann.org> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.15.0.190115 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Alister.Winfield@sky.uk; x-originating-ip: [90.216.150.239] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; DB6PR0601MB2151; 6:skBOamSmKKoKfLyEvAckA3BMEZRcjNTi5+0DXXcWh78pt4jgAThjpj62RGzZrAZ0iUZ5z0zOujldW9hl6qhwoZXufgya/EpmOSWkfw2JauT7iNDpBzm5dUAz/nxiz2CNHTc0K3LN4J2Ph8Lhe3tI9a9ghV9Wxd7QkL2UeHn0YoMPmGxITOPuePS/ZGphJN/JulC68YLIJIVWlDNDhwf7WVvxSLaLHnoKlVMTdXm4ffwuB3QCnkEFt/qMLmra1V1AAxGOqH6kDzgKh80ADA5aFL+y5ZlKXZly5cbCFmN5txbOd5USuVlxFMdi7F8xQ6UCFRM0SQTGadVfTy5ORac83fm0ACckQdLUiVHs1CSw7rvhvNSa/HaUgGqEv1XHR97qJvq1ouodKX+Ln19sr0q8n5wEEqAg/SCrf22pfwyumiJ8qMypNixrhzdu3vWEw3zleQwBJErF7J/+rFEf4bbuRg==; 5:MPiFoYgNJpI15dnaXjQ8pJU8RikZHl2+3pBkoVxpxH9MkdWWfMjFBTtvKqlg7t5Bo4YBoxTNUC0X4DQncMJEPF4Ciuf2Cm1q1ME/P2nPVrBdkKA+b4XRHPh8kgLo4gSqZbRJN5HUqQZn/nFFO2AIImB9Xt2F7jUDbF1VOr4VMPChCjgr+2fNYvZN0RyIVXEhwPH+2+GXkRvAOJldfZZfnA==; 7:Ves9UPq6v8kEbgv5w8PDoVAwHEq/xGolkOrNmjD3PLENJcPxAgdkgibn3T446bHz5ASUvVBl62M5VcwK+gaaHV5FA3gjBMxjdd6fju7thISYdxzsbI4BZyeFJVu9ln3k+RAI8aV0bSzwVoERUEKCwg== x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 92f99038-cfe0-40ad-c2cb-08d680634af7 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600109)(711020)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7153060)(7193020); SRVR:DB6PR0601MB2151; x-ms-traffictypediagnostic: DB6PR0601MB2151: x-microsoft-antispam-prvs: x-forefront-prvs: 0925081676 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(136003)(39860400002)(366004)(346002)(396003)(199004)(189003)(25786009)(2501003)(6436002)(26005)(76176011)(82746002)(99286004)(14444005)(186003)(229853002)(71200400001)(486006)(6512007)(2616005)(476003)(102836004)(446003)(86362001)(256004)(5024004)(71190400001)(11346002)(6486002)(6306002)(83716004)(305945005)(7736002)(316002)(110136005)(105586002)(6116002)(8936002)(81166006)(81156014)(74482002)(53936002)(8676002)(6506007)(36756003)(33656002)(33896004)(68736007)(6246003)(3846002)(72206003)(14454004)(93886005)(97736004)(66066001)(106356001)(58126008)(478600001)(2906002); DIR:OUT; SFP:1101; SCL:1; SRVR:DB6PR0601MB2151; H:DB6PR0601MB2184.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:0; MX:1; received-spf: None (protection.outlook.com: sky.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: jUYkbP3g7tqgiYUNkZ4e6CwyU2YQ5Vhga/g+dA0e6njBodTtXHEmRInAAyZRDNeyVpXHWet4GLgEmNvOLtFixyYArYAQgr2Yt2ZXBxAFYYOwJVCpB21aRSXs6tmOgNnXYo+OOPJoo81OyeWYgChCqQiMTTPIlOQaoAJhWV7KB7I7ZggMMrKPSrNE2Q6CNWUpRua7RUdL3wRMn29KzyNtXyq3j8bmy8+wY7C7v3QNQaaTb2CFVwMw+RlbqxSMTDbKneOF12Vh9O6gFkSg2XfJKhhtI2aoYEG04fvGCnVGeRK2xlhado0+uCYfNa1eLOVHt7LFu4XILa2js+3ovetYb0B41Sl6F2ahcerUZ9xqZR7NHxXecpBuhvk/ooCcnaY9ZiqW/NWFd32ofNd3GurbrLS/ktPKesoKa1d4h82WobQ= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-ID: <406594460D17C84AA0894012FD727767@eurprd06.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: sky.uk X-MS-Exchange-CrossTenant-Network-Message-Id: 92f99038-cfe0-40ad-c2cb-08d680634af7 X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jan 2019 12:15:26.5790 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 68b865d5-cf18-4b2b-82a4-a4eddb9c5237 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0601MB2151 Archived-At: Subject: Re: [Doh] [EXTERNAL] Re: [Ext] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Jan 2019 12:15:32 -0000 DQogICAgU2VjdGlvbiAyLjENCiAgICAgICDigJx0aGUgem9uZSByZXNvbHZlci1hc3NvY2lhdGVk LWRvaC5hcnBhIGlzDQogICAgICAgbm90IGFjdHVhbGx5IGRlbGVnYXRlZCBhbmQgbmV2ZXIgd2ls bCBiZS7igJ0NCg0KICAgICAgIFNvIGl0IGNhbiBuZXZlciBiZSBETlNTRUMgc2lnbmVkIHVubGVz cyB5b3UgdXNlIGEgbG9jYWwgdHJ1c3QgYW5jaG9yLg0KDQoNCkluc3RlYWQgb2YgdGhpcyBob3cg YWJvdXQgcHV0dGluZyB0aGUgaW5mb3JtYXRpb24gaW4gdGhlIHJldmVyc2Ugem9uZSBmb3IgdGhl IHJlc29sdmVyLiBGb3IgZXhhbXBsZQ0KSWYgbXkgcmVzb2x2ZXIgaXMgYS5iLmMuZCB0aGVuIHlv dSBjb3VsZCBwdXQgVFhUIHJlY29yZHMgaW4gdGhlIHJldmVyc2UuLg0KDQpkLmMuYi5hLmluLWFk ZHIuYXJwYS4gVFhUIGRvaDpodHRwczovL2F0cnVzdGVkLmV4YW1wbGUuY29tL3Jlc29sdmUNCg0K VGhpcyBpcyBkZWxlZ2F0ZWQgYW5kIGNvdWxkIGJlIEROU1NFQyBzaWduZWQuDQoNCi0tDQpBbGlz dGVyIFdpbmZpZWxkLg0KDQpJbmZvcm1hdGlvbiBpbiB0aGlzIGVtYWlsIGluY2x1ZGluZyBhbnkg YXR0YWNobWVudHMgbWF5IGJlIHByaXZpbGVnZWQsIGNvbmZpZGVudGlhbCBhbmQgaXMgaW50ZW5k ZWQgZXhjbHVzaXZlbHkgZm9yIHRoZSBhZGRyZXNzZWUuIFRoZSB2aWV3cyBleHByZXNzZWQgbWF5 IG5vdCBiZSBvZmZpY2lhbCBwb2xpY3ksIGJ1dCB0aGUgcGVyc29uYWwgdmlld3Mgb2YgdGhlIG9y aWdpbmF0b3IuIElmIHlvdSBoYXZlIHJlY2VpdmVkIGl0IGluIGVycm9yLCBwbGVhc2Ugbm90aWZ5 IHRoZSBzZW5kZXIgYnkgcmV0dXJuIGUtbWFpbCBhbmQgZGVsZXRlIGl0IGZyb20geW91ciBzeXN0 ZW0uIFlvdSBzaG91bGQgbm90IHJlcHJvZHVjZSwgZGlzdHJpYnV0ZSwgc3RvcmUsIHJldHJhbnNt aXQsIHVzZSBvciBkaXNjbG9zZSBpdHMgY29udGVudHMgdG8gYW55b25lLiBQbGVhc2Ugbm90ZSB3 ZSByZXNlcnZlIHRoZSByaWdodCB0byBtb25pdG9yIGFsbCBlLW1haWwgY29tbXVuaWNhdGlvbiB0 aHJvdWdoIG91ciBpbnRlcm5hbCBhbmQgZXh0ZXJuYWwgbmV0d29ya3MuIFNLWSBhbmQgdGhlIFNL WSBtYXJrcyBhcmUgdHJhZGVtYXJrcyBvZiBTa3kgTGltaXRlZCBhbmQgU2t5IEludGVybmF0aW9u YWwgQUcgYW5kIGFyZSB1c2VkIHVuZGVyIGxpY2VuY2UuDQoNClNreSBVSyBMaW1pdGVkIChSZWdp c3RyYXRpb24gTm8uIDI5MDY5OTEpLCBTa3ktSW4tSG9tZSBTZXJ2aWNlIExpbWl0ZWQgKFJlZ2lz dHJhdGlvbiBOby4gMjA2NzA3NSksIFNreSBTdWJzY3JpYmVycyBTZXJ2aWNlcyBMaW1pdGVkIChS ZWdpc3RyYXRpb24gTm8uIDIzNDAxNTApIGFuZCBTa3kgQ1AgTGltaXRlZCAoUmVnaXN0cmF0aW9u IE5vLiA5NTEzMjU5KSBhcmUgZGlyZWN0IG9yIGluZGlyZWN0IHN1YnNpZGlhcmllcyBvZiBTa3kg TGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAyMjQ3NzM1KS4gQWxsIG9mIHRoZSBjb21wYW5pZXMg bWVudGlvbmVkIGluIHRoaXMgcGFyYWdyYXBoIGFyZSBpbmNvcnBvcmF0ZWQgaW4gRW5nbGFuZCBh bmQgV2FsZXMgYW5kIHNoYXJlIHRoZSBzYW1lIHJlZ2lzdGVyZWQgb2ZmaWNlIGF0IEdyYW50IFdh eSwgSXNsZXdvcnRoLCBNaWRkbGVzZXggVFc3IDVRRA0K From nobody Tue Jan 22 04:50:18 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5CBEE130F53 for ; Tue, 22 Jan 2019 04:50:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f5Nuu91bkZA8 for ; Tue, 22 Jan 2019 04:50:10 -0800 (PST) Received: from shaun.rfc1035.com (smtp.v6.rfc1035.com [IPv6:2001:4b10:100:7::25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EA6AF130F3E for ; Tue, 22 Jan 2019 04:50:09 -0800 (PST) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id EA20E242109D; Tue, 22 Jan 2019 12:50:07 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Tue, 22 Jan 2019 12:50:07 +0000 Cc: DoH Working Group Content-Transfer-Encoding: quoted-printable Message-Id: <9DD0939A-4678-4AAD-867E-1C2C36E124DD@rfc1035.com> References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> <1547674141.291889.1636540384.54D5BB3E@webmail.messagingengine.com> <78C9AA8D-1599-46F1-91C7-356E58DD960A@icann.org> To: "Winfield, Alister" X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Doh] [EXTERNAL] Re: [Ext] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Jan 2019 12:50:15 -0000 On 22 Jan 2019, at 12:15, Winfield, Alister = wrote: >=20 > how about putting the information in the reverse zone for the = resolver. > ... This is delegated and could be DNSSEC signed. It won't work for RFC1918 address space. The bootstrapping problem isn=E2=80=99t solved either. Presumably = you=E2=80=99d still be relying on DHCP or something equally insecure to = get the IP addresses of the resolving servers. If a stub resolver gets configured in some other way -- editing = /etc/resolv.conf for instance -- that might as well include whatever = voodoo is needed for trusted DoH or DoT servers. And what if that reverse zone isn=E2=80=99t signed?=20 Then there are the issues when that zone isn=E2=80=99t managed by the = same entity which manages the corresponding forward zone. This is quite = common. For example, if I was a Sky customer I very much doubt I=E2=80=99d= be able to add/remove/replace one of these hypothetical RRs in whatever = Sky reverse zone happens to be =E2=80=9Chosting=E2=80=9D the IP address = of my DoH server today. And if/when I reconnect to your net and get a = different IP address, what happens to the old TXT record? > If my resolver is a.b.c.d then you could put TXT records in the = reverse.. That=E2=80=99s a Bad Idea. TXT records are already overloaded (abused?) = for all sorts of things. A discrete RRtype would be better. Assuming = this suggestion got picked up.= From nobody Tue Jan 22 06:04:52 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8B942124C04 for ; Tue, 22 Jan 2019 06:04:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.553 X-Spam-Level: X-Spam-Status: No, score=-6.553 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-4.553, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sky.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0wBc7JgoKGIg for ; Tue, 22 Jan 2019 06:04:48 -0800 (PST) Received: from EUR04-DB3-obe.outbound.protection.outlook.com (mail-eopbgr60082.outbound.protection.outlook.com [40.107.6.82]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B73D71200D7 for ; Tue, 22 Jan 2019 06:04:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sky.uk; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=PJmreqjnvy5svesdeFf4U6gz+dXYsjL0QCd+wyISjfQ=; b=ZlYykDKbLlZYnyGhx2vOUXAZui1UifIAMu7p1zFtUXI4lhHN+Rh9e1L1t7O47/Af3QS7EzsboYzLT9/6HWMGMxapsQ1dC06QreC3FY3t3UrgFASyAKb0DSnGDCIE5FqT7Des82aQptSprm327JqAlALMgAx21AlyP2tnSwEikLI= Received: from DB6PR0601MB2184.eurprd06.prod.outlook.com (10.168.57.137) by DB6PR0601MB2167.eurprd06.prod.outlook.com (10.168.57.26) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1537.27; Tue, 22 Jan 2019 14:04:44 +0000 Received: from DB6PR0601MB2184.eurprd06.prod.outlook.com ([fe80::b5e6:9692:98b9:83]) by DB6PR0601MB2184.eurprd06.prod.outlook.com ([fe80::b5e6:9692:98b9:83%6]) with mapi id 15.20.1537.031; Tue, 22 Jan 2019 14:04:44 +0000 From: "Winfield, Alister" To: Jim Reid CC: DoH Working Group Thread-Topic: [Doh] [EXTERNAL] Re: [Ext] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh Thread-Index: AQHUslEIlnzst8DIDkS2zkVSxN7g/KW7UjcA Date: Tue, 22 Jan 2019 14:04:44 +0000 Message-ID: <84884EF0-5CA5-4D3E-9C7F-F441801ACCCD@sky.uk> References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> <1547674141.291889.1636540384.54D5BB3E@webmail.messagingengine.com> <78C9AA8D-1599-46F1-91C7-356E58DD960A@icann.org> <9DD0939A-4678-4AAD-867E-1C2C36E124DD@rfc1035.com> In-Reply-To: <9DD0939A-4678-4AAD-867E-1C2C36E124DD@rfc1035.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.15.0.190115 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Alister.Winfield@sky.uk; x-originating-ip: [90.216.150.239] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; DB6PR0601MB2167; 6:a/+DxY1UAxxlwr0psqm8grqz1MyFXP7yM+v6a/ufB3QkqLL+VAJomcp2Qw960qwmcjb87fj4hTsR3+/6/3HroR7JYsx59pGC6SboNL9AH/n/eL/oXKugSS/yPC5GI9jQ21JJvdEE/bo+MawaWlttWawGkFH2Wn7kl87mQhcqBPvI0rfEZEbb+5eLzqGIBcqNmAtmWqhpXHEuEF7NlUhC0+5ESWYKOo7rdV9BJuPIZva6saYcDsCBcezCW+NsSmsL6sHgaAny+8pOuzIyWKmZ9BUzPetzcN7SYPdfIJclEE5s5e7Ozq0OF8I4tYsd5xQzxaB0+94bWVzDjV+HQQVKMNXTC0uye6IZPiAColrN87MsB1N6+y0NvBVbRmoGeQZkADUgvOuTiy5KCrvSdxGQjJkDu3dGi/5QJnnoVUJn+ght8hI6Ec7E4pGaRycwEVNAVsUcSuw2wNDZV5bCprqaKg==; 5:6ZIVclPgn0vSd+0lLbuiCpt9L5QfcDg6hvQKl6aMFpZGyidByPLiGjpqFgI/jxa4I05SV3HUk9vkSeSKt2faz5P/jCr6aiyWzBkPBHsKp9+xjsqzqtnbp95aszPrRvetuX1nAPhSNusU9/jCmJzJBKHM65w3QD5nmHAnhE2jFl+q1ktKcFIuHK6W4Vu5ihsiWrbpCAtIe6ZrzMmqDMsniQ==; 7:zqoq5x9e8L2HHpPep0+txfi4CgwT4YAlaBztcg+jYXPxTeLKXlbW3sJHxQx2OMKYZdXCH9WfvZcaaq+MESJMptKZyWx34XZHVp6QzuT/+DQPrWUkwfAHSra1g4gPEN0UVo2yN97SgeKFKqw6EjJ+4w== x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 21697d0b-00d3-4065-6f6f-08d680728fcc x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600109)(711020)(2017052603328)(7153060)(7193020); SRVR:DB6PR0601MB2167; x-ms-traffictypediagnostic: DB6PR0601MB2167: x-microsoft-antispam-prvs: x-forefront-prvs: 0925081676 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(346002)(136003)(396003)(39860400002)(366004)(189003)(199004)(446003)(256004)(14444005)(5024004)(8936002)(6512007)(81166006)(2906002)(81156014)(316002)(54075001)(8676002)(58126008)(2616005)(86362001)(14454004)(11346002)(82746002)(476003)(93886005)(74482002)(72206003)(478600001)(97736004)(6916009)(7736002)(83716004)(305945005)(186003)(4326008)(33656002)(6506007)(71200400001)(53546011)(26005)(6486002)(33896004)(71190400001)(486006)(68736007)(53936002)(102836004)(6436002)(6116002)(3846002)(66066001)(99286004)(36756003)(25786009)(6246003)(105586002)(106356001)(229853002)(76176011); DIR:OUT; SFP:1101; SCL:1; SRVR:DB6PR0601MB2167; H:DB6PR0601MB2184.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:0; received-spf: None (protection.outlook.com: sky.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 6wuHob3Omr2jfgEndm/rIMdSTNR1vgs47tYZcdAziG8UglQQSFjv2qtOFzwB+Zj01J2YjQloScIpk/2lMwk7ZS6vn/Hh4aCp8tZiJZKUaGwzAHKliUaFnhw+l2NM0tLw8Ym4aO+G6HwrV3RDOeYcs2LI21qndd9PLJGGKRqB73Zqq3n1Ek7KkHVzuegPGdmaF48mDixpn+7EhTXcpgVfjTWjD8rGTAkm7gM/y3q7IL/uzCRxYhBIMn2GV6KDzS2OMSj3Fm55kiaLrTAnzJrFX9Zfn0vCtg78dz0Yk13LZP6MY40ZsCcWsZRPt6nFSUDDLGA0/TVu9O5h9vfiz1q9YwrOS2zORAQJ3LXUC1OMptlIw5dDYwqCS9efCyOixEFOkleoc787WHFW/AIV4nkPy2NR6iQv+atbegCpl7OaVqk= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-ID: <5BC83828DC89C14DA0584D783FDBBF60@eurprd06.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: sky.uk X-MS-Exchange-CrossTenant-Network-Message-Id: 21697d0b-00d3-4065-6f6f-08d680728fcc X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jan 2019 14:04:44.5940 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 68b865d5-cf18-4b2b-82a4-a4eddb9c5237 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0601MB2167 Archived-At: Subject: Re: [Doh] [EXTERNAL] Re: [Ext] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Jan 2019 14:04:50 -0000 SSBhZ3JlZSBqdXN0IGxvb2tpbmcgYXQgd2hlcmUgaW5mb3JtYXRpb24gJ2NvdWxkJyByZXNpZGUg dXNlIGF2YWlsYWJsZSBpbmZvcm1hdGlvbiBhbmQgYmUgc2lnbmVkIHVzaW5nIGV4aXN0aW5nIG1l Y2hhbmlzbXMuIE5vdGUsIEkgaGF0ZSBUWFQgdG9vLCBOQVBUUiAoKyBTUlYpICBpcyBjbG9zZXN0 IHRvIHRoZSByZXF1aXJlbWVudCBpbiB0aGUgZXhpc3RpbmcgUlIgdHlwZXMgYnV0IGV2ZW4gdGhh dCBpc24ndCBwZXJmZWN0Lg0KDQpJc3N1ZXMgdGhpcyBuZWVkcyB0byBzaG93Og0KVGhlIHNlY3Vy aXR5IG9mIHRoZSBkaXNjb3ZlcnkgbWVjaGFuaXNtLA0KSG93IGEgZGlzY292ZXJlZCBET0ggZW5k LXBvaW50IGNhbiBiZSB0cnVzdGVkIChUaGlzIGlzIHJlbGF0ZWQgdG8gd2hhdCB0aGUgZW5kLXVz ZXIgYmVsaWV2ZXMgaXMgcmVxdWlyZWQgdG8gdHJ1c3QgdGhlIFRSUi4gQ2xlYXJseSBzb21lIHRy dXN0IHRoZWlyIElTUCBvdGhlcnMgd291bGQgdHJ1c3QgR29vZ2xlIHlldCBtb3JlIHdvdWxkIG9u bHkgdHJ1c3QgdGhlaXIgY29ycG9yYXRlIEROUyBzZXJ2aWNlKQ0KDQpJcyB0aGVyZSBhbnl3aGVy ZSB0aG91Z2h0cyBvbiBob3cgdG8gZGVmaW5lICd0cnVzdCcgYW5kIGhvdyB0aGF0IGlzIHB1Ymxp c2hlZCwgYXVkaXRlZCwgZXRjIGVzcGVjaWFsbHkgd2hlbiB5b3UgY29uc2lkZXIgdGhpcyBmb3Jt IG9mIGRpc2NvdmVyeSBvZiBhIERPSCBjYXBhYmlsaXR5Pw0KDQpBLg0KDQoNCu+7v09uIDIyLzAx LzIwMTksIDEyOjUwLCAiSmltIFJlaWQiIDxqaW1AcmZjMTAzNS5jb20+IHdyb3RlOg0KDQogICAg T24gMjIgSmFuIDIwMTksIGF0IDEyOjE1LCBXaW5maWVsZCwgQWxpc3RlciA8QWxpc3Rlci5XaW5m aWVsZD00MHNreS51a0BkbWFyYy5pZXRmLm9yZz4gd3JvdGU6DQogICAgPg0KICAgID4gaG93IGFi b3V0IHB1dHRpbmcgdGhlIGluZm9ybWF0aW9uIGluIHRoZSByZXZlcnNlIHpvbmUgZm9yIHRoZSBy ZXNvbHZlci4NCiAgICA+ICAuLi4gVGhpcyBpcyBkZWxlZ2F0ZWQgYW5kIGNvdWxkIGJlIEROU1NF QyBzaWduZWQuDQoNCiAgICBJdCB3b24ndCB3b3JrIGZvciBSRkMxOTE4IGFkZHJlc3Mgc3BhY2Uu DQoNCiAgICBUaGUgYm9vdHN0cmFwcGluZyBwcm9ibGVtIGlzbuKAmXQgc29sdmVkIGVpdGhlci4g UHJlc3VtYWJseSB5b3XigJlkIHN0aWxsIGJlIHJlbHlpbmcgb24gREhDUCBvciBzb21ldGhpbmcg ZXF1YWxseSBpbnNlY3VyZSB0byBnZXQgdGhlIElQIGFkZHJlc3NlcyBvZiB0aGUgcmVzb2x2aW5n IHNlcnZlcnMuDQoNCiAgICBJZiBhIHN0dWIgcmVzb2x2ZXIgZ2V0cyBjb25maWd1cmVkIGluIHNv bWUgb3RoZXIgd2F5IC0tIGVkaXRpbmcgL2V0Yy9yZXNvbHYuY29uZiBmb3IgaW5zdGFuY2UgLS0g dGhhdCBtaWdodCBhcyB3ZWxsIGluY2x1ZGUgd2hhdGV2ZXIgdm9vZG9vIGlzIG5lZWRlZCBmb3Ig dHJ1c3RlZCBEb0ggb3IgRG9UIHNlcnZlcnMuDQoNCiAgICBBbmQgd2hhdCBpZiB0aGF0IHJldmVy c2Ugem9uZSBpc27igJl0IHNpZ25lZD8NCg0KICAgIFRoZW4gdGhlcmUgYXJlIHRoZSBpc3N1ZXMg d2hlbiB0aGF0IHpvbmUgaXNu4oCZdCBtYW5hZ2VkIGJ5IHRoZSBzYW1lIGVudGl0eSB3aGljaCBt YW5hZ2VzIHRoZSBjb3JyZXNwb25kaW5nIGZvcndhcmQgem9uZS4gVGhpcyBpcyBxdWl0ZSBjb21t b24uIEZvciBleGFtcGxlLCBpZiBJIHdhcyBhIFNreSBjdXN0b21lciBJIHZlcnkgbXVjaCBkb3Vi dCBJ4oCZZCBiZSBhYmxlIHRvIGFkZC9yZW1vdmUvcmVwbGFjZSBvbmUgb2YgdGhlc2UgaHlwb3Ro ZXRpY2FsIFJScyBpbiB3aGF0ZXZlciBTa3kgcmV2ZXJzZSB6b25lIGhhcHBlbnMgdG8gYmUg4oCc aG9zdGluZ+KAnSB0aGUgSVAgYWRkcmVzcyBvZiBteSBEb0ggc2VydmVyIHRvZGF5LiBBbmQgaWYv d2hlbiBJIHJlY29ubmVjdCB0byB5b3VyIG5ldCBhbmQgZ2V0IGEgZGlmZmVyZW50IElQIGFkZHJl c3MsIHdoYXQgaGFwcGVucyB0byB0aGUgb2xkIFRYVCByZWNvcmQ/DQoNCiAgICA+IElmIG15IHJl c29sdmVyIGlzIGEuYi5jLmQgdGhlbiB5b3UgY291bGQgcHV0IFRYVCByZWNvcmRzIGluIHRoZSBy ZXZlcnNlLi4NCg0KICAgIFRoYXTigJlzIGEgQmFkIElkZWEuIFRYVCByZWNvcmRzIGFyZSBhbHJl YWR5IG92ZXJsb2FkZWQgKGFidXNlZD8pIGZvciBhbGwgc29ydHMgb2YgdGhpbmdzLiBBIGRpc2Ny ZXRlIFJSdHlwZSB3b3VsZCBiZSBiZXR0ZXIuIEFzc3VtaW5nIHRoaXMgc3VnZ2VzdGlvbiBnb3Qg cGlja2VkIHVwLg0KDQpJbmZvcm1hdGlvbiBpbiB0aGlzIGVtYWlsIGluY2x1ZGluZyBhbnkgYXR0 YWNobWVudHMgbWF5IGJlIHByaXZpbGVnZWQsIGNvbmZpZGVudGlhbCBhbmQgaXMgaW50ZW5kZWQg ZXhjbHVzaXZlbHkgZm9yIHRoZSBhZGRyZXNzZWUuIFRoZSB2aWV3cyBleHByZXNzZWQgbWF5IG5v dCBiZSBvZmZpY2lhbCBwb2xpY3ksIGJ1dCB0aGUgcGVyc29uYWwgdmlld3Mgb2YgdGhlIG9yaWdp bmF0b3IuIElmIHlvdSBoYXZlIHJlY2VpdmVkIGl0IGluIGVycm9yLCBwbGVhc2Ugbm90aWZ5IHRo ZSBzZW5kZXIgYnkgcmV0dXJuIGUtbWFpbCBhbmQgZGVsZXRlIGl0IGZyb20geW91ciBzeXN0ZW0u IFlvdSBzaG91bGQgbm90IHJlcHJvZHVjZSwgZGlzdHJpYnV0ZSwgc3RvcmUsIHJldHJhbnNtaXQs IHVzZSBvciBkaXNjbG9zZSBpdHMgY29udGVudHMgdG8gYW55b25lLiBQbGVhc2Ugbm90ZSB3ZSBy ZXNlcnZlIHRoZSByaWdodCB0byBtb25pdG9yIGFsbCBlLW1haWwgY29tbXVuaWNhdGlvbiB0aHJv dWdoIG91ciBpbnRlcm5hbCBhbmQgZXh0ZXJuYWwgbmV0d29ya3MuIFNLWSBhbmQgdGhlIFNLWSBt YXJrcyBhcmUgdHJhZGVtYXJrcyBvZiBTa3kgTGltaXRlZCBhbmQgU2t5IEludGVybmF0aW9uYWwg QUcgYW5kIGFyZSB1c2VkIHVuZGVyIGxpY2VuY2UuDQoNClNreSBVSyBMaW1pdGVkIChSZWdpc3Ry YXRpb24gTm8uIDI5MDY5OTEpLCBTa3ktSW4tSG9tZSBTZXJ2aWNlIExpbWl0ZWQgKFJlZ2lzdHJh dGlvbiBOby4gMjA2NzA3NSksIFNreSBTdWJzY3JpYmVycyBTZXJ2aWNlcyBMaW1pdGVkIChSZWdp c3RyYXRpb24gTm8uIDIzNDAxNTApIGFuZCBTa3kgQ1AgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5v LiA5NTEzMjU5KSBhcmUgZGlyZWN0IG9yIGluZGlyZWN0IHN1YnNpZGlhcmllcyBvZiBTa3kgTGlt aXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAyMjQ3NzM1KS4gQWxsIG9mIHRoZSBjb21wYW5pZXMgbWVu dGlvbmVkIGluIHRoaXMgcGFyYWdyYXBoIGFyZSBpbmNvcnBvcmF0ZWQgaW4gRW5nbGFuZCBhbmQg V2FsZXMgYW5kIHNoYXJlIHRoZSBzYW1lIHJlZ2lzdGVyZWQgb2ZmaWNlIGF0IEdyYW50IFdheSwg SXNsZXdvcnRoLCBNaWRkbGVzZXggVFc3IDVRRA0K From nobody Tue Jan 22 08:11:27 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 871A0130F32 for ; Tue, 22 Jan 2019 08:11:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YCC5sm_P42Aq for ; Tue, 22 Jan 2019 08:11:23 -0800 (PST) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 41D6012E043 for ; Tue, 22 Jan 2019 08:11:23 -0800 (PST) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-2.pexch112.icann.org (64.78.40.23) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Tue, 22 Jan 2019 08:11:20 -0800 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1367.000; Tue, 22 Jan 2019 08:11:20 -0800 From: Paul Hoffman To: John Dickinson CC: "doh@ietf.org" Thread-Topic: [Doh] [Ext] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh Thread-Index: AQHUsknwWd0ToIteakqp5mhlx5MwG6W7+8EA Date: Tue, 22 Jan 2019 16:11:20 +0000 Message-ID: References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> <1547674141.291889.1636540384.54D5BB3E@webmail.messagingengine.com> <78C9AA8D-1599-46F1-91C7-356E58DD960A@icann.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: text/plain; charset="utf-8" Content-ID: <2317048862D002419BD72F4884BA91F0@pexch112.icann.org> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [Doh] [Ext] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Jan 2019 16:11:26 -0000 T24gSmFuIDIyLCAyMDE5LCBhdCAzOjU4IEFNLCBKb2huIERpY2tpbnNvbiA8amFkQHNpbm9kdW4u Y29tPiB3cm90ZToNCj4gDQo+IE9uIDE2IEphbiAyMDE5LCBhdCAyMjozMiwgUGF1bCBIb2ZmbWFu IHdyb3RlOg0KPiANCj4+IE9uIEphbiAxNiwgMjAxOSwgYXQgMToyOSBQTSwgTWFydGluIFRob21z b24gPG10QGxvd2VudHJvcHkubmV0PiB3cm90ZToNCj4+PiANCj4+PiBPbiBXZWQsIEphbiAxNiwg MjAxOSwgYXQgMTE6MjUsIFBhdWwgSG9mZm1hbiB3cm90ZToNCj4+Pj4gUGVvcGxlIGZyb20gYSBm ZXcgYnJvd3NlciB2ZW5kb3JzIGhhdmUgZXhwcmVzc2VkIHVub2ZmaWNpYWwgaW50ZXJlc3QgaW4N Cj4+Pj4gaW1wbGVtZW50aW5nIGF0IGxlYXN0IHBhcnRzIG9mIGl0IGlmIGl0IGdldHMgc3RhbmRh cmRpemVkLCBzbyBpdCBzZWVtcw0KPj4+PiBsaWtlIGEgZ29vZCBpZGVhIHRvIHRyeSB0byBzdGFu ZGFyZGl6ZSBpdC4gVGhlcmUgaXMgc3RpbGwgYSByZWFzb25hYmxlDQo+Pj4+IGFtb3VudCBvZiB3 b3JrIHRvIGJlIGRvbmUgaW4gdGhlIGRvY3VtZW50IGl0c2VsZiwgYW5kIGl0IGNlcnRhaW5seSBu ZWVkcw0KPj4+PiBpbnB1dCBmcm9tIGJvdGggYnJvd3NlciBhbmQgRE5TIGZvbGtzLg0KPj4+IA0K Pj4+IFdoYXQgaGFwcGVuZWQgdG8gRFJJVT8gIEl0IHNlZW1lZCBsaWtlIHRoZXJlIHdhcyBhbiBl ZmZvcnQgdG8gd29yayBvbiB0aGUgcHJvYmxlbSBtb3JlIGdlbmVyYWxseS4NCj4+IA0KPj4gVGhl cmUgd2FzIGxpdHRsZSBpbnRlcmVzdCBpbiBhbnl0aGluZyBvdGhlciB0aGFuIHRoaXMgcGFydC4N Cj4+IA0KPj4+IEJ1dCBJIHNlZSB0aGUgRG9UIGNvbW1lbnQgZG93bi10aHJlYWQgYW5kIHdvbmRl ciB3aGV0aGVyIHRoaXMgaXMgdGhlIHJpZ2h0IHBsYWNlIGZvciBkb2luZyB0aGlzIHNvcnQgb2Yg d29yay4NCj4+IA0KPj4gRFBSSVZFIGlzIChzYWRseSB2ZXJ5IHNsb3dseSkgd29ya2luZyBvbiBk cmFmdC1pZXRmLWRwcml2ZS1iY3Atb3AsIHdoZXJlIERvVCBkaXNjb3Zlcnkgd291bGQgZml0IGp1 c3QgZmluZS4NCj4+IA0KPiANCj4gSSBkb27igJl0IHRoaW5rIHNvLiBUaGUgQkNQIGlzIEluZm9y bWF0aW9uYWwsDQoNCkFzIGEgcHJvY2VzcyBub3RlLCBCQ1BzIGFyZSBzdGFuZGFyZHMsIG5vdCBJ bmZvcm1hdGlvbmFsLiANCg0KPiBJIHNlZSBzZXJ2ZXIgZGlzY292ZXJ5IChyZXF1aXJpbmcgZXh0 ZW5zaW9ucyB0byB0aGUgcHJvdG9jb2wpIGFzIHdlbGwgb3V0IG9mIHNjb3BlIGZvciB0aGUgQkNQ Lg0KDQpGb3IgdGhhdCwgSSBhZ3JlZS4gRm9yIERvVCwgInRyeSBpdCBhbmQgc2VlIiB3b3JrcyBq dXN0IGZpbmUuDQoNCj4gQXMgbWVudGlvbmVkIGJ5IEJlbiwgZm9yIG9wcG9ydHVuaXN0aWMgRG9U IHBvcnQgODUzIGNhbiBiZSBwcm9iZWQsIGJ1dCB0aGVyZSBpcyBzdGlsbCBubyBETlMgb3IgREhD UCBzb2x1dGlvbiBmb3IgU3RyaWN0IERvVCAoaS5lLiBzZWN1cmVseSBvYnRhaW5pbmcgdGhlIGF1 dGhlbnRpY2F0aW9uIGRvbWFpbiBuYW1lKS4NCg0KQWdyZWUuIFRoZXJlIGhhcyBiZWVuIGxpdHRs ZSBpbnRlcmVzdCBpbiB0aGlzIHNvIGZhci4NCg0KPiBNeSB1bmRlcnN0YW5kaW5nIG9mIHRoaXMg ZHJhZnQgaXMgdGhhdCBpdCBwcm92aWRlcyBvbmx5IGFuIOKAmG9wcG9ydHVuaXN0aWPigJkgZGlz Y292ZXJ5IG1lY2hhbmlzbSBmb3IgRG9IIHdoZXJlIHRoZSByZXN1bHRpbmcgVVJJIHRlbXBsYXRl IGNhbm5vdCBiZSBETlNTRUMgdmFsaWRhdGVkIGJ5IHRoZSBzeXN0ZW0gcmVzb2x2ZXIgb3IgdGhl IHJlcXVlc3RpbmcgYXBwbGljYXRpb24vYnJvd3Nlci4gSWYgdGhhdCBpcyB0aGUgY2FzZSB0aGUg cmVzdWx0aW5nIEhUVFBTIGNvbm5lY3Rpb24gX2NvdWxkXyBoYXZlIGJlZW4gcmUtZGlyZWN0ZWQg YW5kIHNvIEkgdGhpbmsgdGhhdCBzaG91bGQgYmUgc3BlbHQgb3V0IG1vcmUgY2xlYXJseS4gDQoN Ckdvb2QgcG9pbnQsIHdpbGwgZG8uDQoNCj4gRm9yIGV4YW1wbGUsIEkgdGhpbmsgdGhhdCBhdCBs ZWFzdCB0aGUgdGl0bGUgc2hvdWxkIGJlIHNvbWV0aGluZyBtb3JlIGxpa2Ug4oCYQXNzb2NpYXRp bmcgYSBEb0ggU2VydmVyIHdpdGggYSBSZXNvbHZlciBmb3IgT3Bwb3J0dW5pc3RpYyBEb0jigJku DQoNCkkgd291bGQgcHVzaCBiYWNrIG9uIHRoaXMgY2hhbmdlIGJlY2F1c2UgIkRvSCBTZXJ2ZXJz IGJ5IFRYVCIgaXMgb3Bwb3J0dW5pc3RpYyB3aGlsZSAiRG9IIFNlcnZlcnMgYnkgQWRkcmVzc2Vz IiBpcyBub3QuDQoNCg0KDQo+IA0KPiBPdGhlciBjb21tZW50czoNCj4gDQo+IEkgZmluZCB0aGlz IGRyYWZ0IGV4dHJlbWVseSBkaWZmaWN1bHQgdG8gcmVhZC4gRm9yIGV4YW1wbGUsIEkgYW0gdW5h YmxlIHRvIGVhc2lseSBwYXJzZSBTZWN0aW9uIDEsIFBhcmEuIDIsIFNlbnRlbmNlIDE6DQo+ICAg 4oCcVGhlcmUgaXMgYSB1c2UgY2FzZSBmb3IgYnJvd3NlcnMgYW5kIHdlYiBhcHBsaWNhdGlvbnMg dG8gd2FudCB0aGUgRE5TDQo+ICAgcmVjdXJzaXZlIHJlc29sdmVyKHMpIGNvbmZpZ3VyZWQgaW4g dGhlIG9wZXJhdGluZyBzeXN0ZW0gdG8gdXNlIERvSA0KPiAgIGZvciBETlMgcmVzb2x1dGlvbiBp bnN0ZWFkIG9mIG5vcm1hbCBETlMsIGJ1dCB0byBkbyBzbyB0byBhdCBhIERvSA0KPiAgIHNlcnZl ciBzcGVjaWZpZWQgYnkgdGhlIGNvbmZpZ3VyZWQgcmVzb2x2ZXIu4oCdDQo+IA0KPiBJIGZpbmQg dGhlIHJlc3Qgb2YgdGhlIEludHJvZHVjdGlvbiBqdXN0IGFzIGRpZmZpY3VsdCB0byByZWFkLg0K PiANCj4gUGxlYXNlIGFkZCBTVUROIHRvIHRoZSBUZXJtaW5vbG9neSBzZWN0aW9uIGFuZCB0byB0 aGUgbmV4dCBETlMgVGVybWlub2xvZ3kgLWJpcyBkcmFmdC4NCj4gDQo+IFNlY3Rpb24gMi4xDQo+ ICAg4oCcdGhlIHpvbmUgcmVzb2x2ZXItYXNzb2NpYXRlZC1kb2guYXJwYSBpcw0KPiAgIG5vdCBh Y3R1YWxseSBkZWxlZ2F0ZWQgYW5kIG5ldmVyIHdpbGwgYmUu4oCdDQo+IA0KPiAgIFNvIGl0IGNh biBuZXZlciBiZSBETlNTRUMgc2lnbmVkIHVubGVzcyB5b3UgdXNlIGEgbG9jYWwgdHJ1c3QgYW5j aG9yLg0KPiANCj4gU2VjdGlvbiAyLjINCj4gICDigJxUbyBmaW5kIHRoZSBEb0ggc2VydmVycyBh c3NvY2lhdGVkIHdpdGggYSByZXNvbHZlciwgdGhlIGNsaWVudCBzZW5kcw0KPiAgIGEgcXVlcnkg dG8NCj4gDQo+ICAgaHR0cHM6Ly9JUEFERFJFU1NHT0VTSEVSRS8ud2VsbC1rbm93bi9kb2gtc2Vy dmVycy1hc3NvY2lhdGVkL+KAnQ0KPiANCj4gICBOZWVkIHRvIG1ha2UgaXQgY2xlYXIgdGhhdCB0 aGlzIGlzIGEgRG9IIHF1ZXJ5IG5vdCBhIHJlZ3VsYXIg4oCcaHR0cCBxdWVyeeKAnQ0KPiANCj4g U2VjdGlvbiAzIG1ha2VzIG5vIG1lbnRpb24gb2YgdGhlIGZhY3QgdGhhdCB0aGUgT1Mgc3R1YiBy ZXNvbHZlciB0eXBpY2FsbHkgaGFzIG1vcmUgdGhhbiAxIHJlc29sdmVyIGNvbmZpZ3VyZWQuDQo+ IA0KPiBTZWN0aW9uIDQNCj4gICDigJxUaGF0IHdvcmRpbmcgbWlnaHQgc2F5DQo+ICAgc29tZXRo aW5nIGxpa2UgIkRvSCBzZXJ2ZXIgYXNzb2NpYXRlZCB3aXRoIG15IGN1cnJlbnQgcmVzb2x2ZXIi IChvcg0KPiAgICJzZXJ2aWRvciBEb0ggYXNvY2lhZG8gY29uIG1pIHJlc29sdWNpb24gYWN0dWFs IiBvciAic2VydmV1ciBEb0gNCj4gICBhc3NvY2llIGEgbW9uIHJlc29sdmV1ciBhY3R1ZWzigJ0p LuKAnQ0KPiANCj4gICBJcyB0aGlzIGludGVuZGVkIHRvIGJlIHJlYWQgb25seSBjb25maWd1cmF0 aW9uPyBJdCBkb2VzbuKAmXQgc291bmQgbGlrZSBhIGNvbmZpZ3VyYXRpb24gaXRlbSBmb3IgYSBV c2VyIHRvIGVkaXQuDQo+IA0KDQpUaGUgcHVycG9zZSBvZiBoYXZpbmcgYSBXRyByZXZpZXcgdGhl IGRyYWZ0IGlzIHRvIG1ha2UgaXQgZWFzaWVyIHRvIHJlYWQuIEFsbCB0aGUgYWJvdmUgc2VlbSBs aWtlIGdvb2QgY2hhbmdlcy4NCg0KPiBJIGRvIG5vdCB0aGluayB0aGlzIGRyYWZ0IHNob3VsZCBi ZSBhZG9wdGVkIHVudGlsIGEgc2VwYXJhdGUgdXNlIGNhc2VzIGRvY3VtZW50IGlzIHdyaXR0ZW4g KEkgYW0gaGFwcHkgdG8gaGVscCB3cml0ZSBpdCkuDQoNCldlIGRpc2FncmVlIGhlcmUuIEluIHdo aWNoIFdHIGhhcyB0aGUgc2VwYXJhdGUgdXNlIGNhc2VzIGRvY3VtZW50IGJlaW5nIGZpbmlzaGVk IGJlZm9yZSB0aGUgcHJvdG9jb2wgc3RhcnRlZCB3b3JrZWQgb3V0IHdlbGw/DQoNCi0tUGF1bCBI b2ZmbWFu From nobody Tue Jan 22 09:09:25 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D8367130F3C for ; Tue, 22 Jan 2019 09:09:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=sinodun.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GBRR6vHpuQTN for ; Tue, 22 Jan 2019 09:09:21 -0800 (PST) Received: from haggis.mythic-beasts.com (haggis.mythic-beasts.com [IPv6:2a00:1098:0:86:1000:0:2:1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 71F9D126CC7 for ; Tue, 22 Jan 2019 09:09:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sinodun.com ; s=haggis-2018; h=Date:Subject:To:From; bh=loyu2zpI1a1XKiPaXhZ8EbicToMLIwgqYMkuNEFD7pw=; b=MB0xLHeg1lwhY3MMpxATYlRBmP awFh/v2GDbnQX8rheROSNN7lTRWzxVhGJFm5iSP8/k7HQJ9W4d2wlYuXIQm2gijURjKNFmCK+AO5C ekOKbThhUohoMrvg86fFNDZualqEDYZRoMgbN/yHJJjs6r5LBYxtgwBtxYdoR0FyWPwgVGzRb0ptV 74DOf8aSugCZeSFHGPLyiGXb6t4RieWP+E8OS/dZxeQMB28m1kMKnrg7JEBwl4OO/nXFwVOyxL25z zCn6eewyjdS4+pxAm7hBU+xYiqe4q3gwPrrJGRGz6hFuhGL6kREwl2HWne1Ba8vr2DkPG3bIVeLEp s4FZgy7w==; Received: from [2001:b98:204:102:fff1::f145] (port=63797 helo=[192.168.12.13]) by haggis.mythic-beasts.com with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1glzY3-0005eo-Jf; Tue, 22 Jan 2019 17:09:19 +0000 From: "John Dickinson" To: "Paul Hoffman" , doh@ietf.org Date: Tue, 22 Jan 2019 17:08:32 +0000 X-Mailer: MailMate (1.12.3r5579) Message-ID: <428AFD9B-4E48-4A43-8BFC-6DF44F3ABBCD@sinodun.com> In-Reply-To: References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> <1547674141.291889.1636540384.54D5BB3E@webmail.messagingengine.com> <78C9AA8D-1599-46F1-91C7-356E58DD960A@icann.org> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_509A3587-1239-4F30-91ED-EA40174CE92C_="; micalg=pgp-sha512; protocol="application/pgp-signature" X-BlackCat-Spam-Score: -21 Archived-At: Subject: Re: [Doh] [Ext] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Jan 2019 17:09:24 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_509A3587-1239-4F30-91ED-EA40174CE92C_= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 22 Jan 2019, at 16:11, Paul Hoffman wrote: > On Jan 22, 2019, at 3:58 AM, John Dickinson wrote: >> >> On 16 Jan 2019, at 22:32, Paul Hoffman wrote: >> >>> On Jan 16, 2019, at 1:29 PM, Martin Thomson wrote= : >>>> >>>> On Wed, Jan 16, 2019, at 11:25, Paul Hoffman wrote: >>>>> People from a few browser vendors have expressed unofficial interes= t in >>>>> implementing at least parts of it if it gets standardized, so it se= ems >>>>> like a good idea to try to standardize it. There is still a reasona= ble >>>>> amount of work to be done in the document itself, and it certainly = needs >>>>> input from both browser and DNS folks. >>>> >>>> What happened to DRIU? It seemed like there was an effort to work o= n the problem more generally. >>> >>> There was little interest in anything other than this part. >>> >>>> But I see the DoT comment down-thread and wonder whether this is the= right place for doing this sort of work. >>> >>> DPRIVE is (sadly very slowly) working on draft-ietf-dprive-bcp-op, wh= ere DoT discovery would fit just fine. >>> >> >> I don=E2=80=99t think so. The BCP is Informational, > > As a process note, BCPs are standards, not Informational. OK, my bad. > >> I see server discovery (requiring extensions to the protocol) as well = out of scope for the BCP. > > For that, I agree. For DoT, "try it and see" works just fine. > >> As mentioned by Ben, for opportunistic DoT port 853 can be probed, but= there is still no DNS or DHCP solution for Strict DoT (i.e. securely obt= aining the authentication domain name). > > Agree. There has been little interest in this so far. > >> My understanding of this draft is that it provides only an =E2=80=98op= portunistic=E2=80=99 discovery mechanism for DoH where the resulting URI = template cannot be DNSSEC validated by the system resolver or the request= ing application/browser. If that is the case the resulting HTTPS connecti= on _could_ have been re-directed and so I think that should be spelt out = more clearly. > > Good point, will do. > >> For example, I think that at least the title should be something more = like =E2=80=98Associating a DoH Server with a Resolver for Opportunistic = DoH=E2=80=99. > > I would push back on this change because "DoH Servers by TXT" is opport= unistic while "DoH Servers by Addresses" is not. As you mention in Section 8. This is only true if the application _knows_= how the OS resolver was configured or if the lookup of resolver-addresse= s.arpa was DNSSEC validated and the application _knows_ it was DNSSEC val= idated. > > > >> >> Other comments: >> >> I find this draft extremely difficult to read. For example, I am unabl= e to easily parse Section 1, Para. 2, Sentence 1: >> =E2=80=9CThere is a use case for browsers and web applications to wa= nt the DNS >> recursive resolver(s) configured in the operating system to use DoH >> for DNS resolution instead of normal DNS, but to do so to at a DoH >> server specified by the configured resolver.=E2=80=9D >> >> I find the rest of the Introduction just as difficult to read. >> >> Please add SUDN to the Terminology section and to the next DNS Termino= logy -bis draft. >> >> Section 2.1 >> =E2=80=9Cthe zone resolver-associated-doh.arpa is >> not actually delegated and never will be.=E2=80=9D >> >> So it can never be DNSSEC signed unless you use a local trust anchor= =2E >> >> Section 2.2 >> =E2=80=9CTo find the DoH servers associated with a resolver, the cli= ent sends >> a query to >> >> https://IPADDRESSGOESHERE/.well-known/doh-servers-associated/=E2=80=9D= >> >> Need to make it clear that this is a DoH query not a regular =E2=80=9C= http query=E2=80=9D >> >> Section 3 makes no mention of the fact that the OS stub resolver typic= ally has more than 1 resolver configured. >> >> Section 4 >> =E2=80=9CThat wording might say >> something like "DoH server associated with my current resolver" (or >> "servidor DoH asociado con mi resolucion actual" or "serveur DoH >> associe a mon resolveur actuel=E2=80=9D).=E2=80=9D >> >> Is this intended to be read only configuration? It doesn=E2=80=99t s= ound like a configuration item for a User to edit. >> > > The purpose of having a WG review the draft is to make it easier to rea= d. All the above seem like good changes. > >> I do not think this draft should be adopted until a separate use cases= document is written (I am happy to help write it). > > We disagree here. In which WG has the separate use cases document being= finished before the protocol started worked out well? Well it would be good practice especially since we are trying to bring to= gether DNS and HTTP folks. However, I take your point so I guess I would = be happy if the use cases you are considering were very explicit and more= clearly described in this draft. regards John > > --Paul Hoffman > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh John Dickinson https://sinodun.com Sinodun Internet Technologies Ltd. Magdalen Centre Oxford Science Park Robert Robinson Avenue Oxford OX4 4GA U.K. --=_MailMate_509A3587-1239-4F30-91ED-EA40174CE92C_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQJEBAEBCgAuFiEEkBPk5F7sVwWxxZAfLcYUQj0n4iwFAlxHThAQHGphZEBzaW5v ZHVuLmNvbQAKCRAtxhRCPSfiLB8cD/9z5kkYGdNSqWbYltVMWp9XSVhR3tNEHBec Css2a6Tm9TG4EjTiUWrIfErex/1RlJLQFoLlqc47EjqmBuHT/WfyDE6xaOQ6gelk wFOVYIiDIDwyD5/jI1QSmY0Xt2AtcWimJBCglJAispHDobuY48VvfSUy70KdnSwC cEWMX6yOz6xx8byvvv0mKA+16F9xJEbUpGI6g7IvHROPcnzd6OrhpJq4i/unFNvZ l6bbNfUcUed62QG+b+TT6A9ps++PClqD/XDE6YMdIiZB3lEhOh95U1PXFltyr+nY ITog015HrndNgMKU6H3pMkEH0N9Cjs0nOHU0QbHIni+6KMiNvSxA6X9rMK5uCcWk xuhUGJ3PbW9w2cu3a7Yip09pW0ii8Zz6iLWJdBrTOPUSP2iGBEiQv7l3JEea1xAF xw++5YfHxCc+QzRTexiUsCTQL1Zdcq4Xjf9EWnJp+QYR3zVN/qybOCjFi9+G7HJi 1UteknPvcs8pV+wey17pzQHYbaCh5cRERmFA7NXmvGzG7RUf93fCYJXV0PcV10ZJ ThX3Sq5hHoLAqYK5aijTwpaTVEkdTHBL2TxxDUYMnCdTzNRX9da5yk3K92kk3HIQ GFnRqKlgKun0Ess2tndRFdh7hvnenqyqgQl28nYWW0GrKqoWwe/NH3vwYxbUJEWw RLpy/1usOg== =XA+i -----END PGP SIGNATURE----- --=_MailMate_509A3587-1239-4F30-91ED-EA40174CE92C_=-- From nobody Tue Jan 22 23:26:12 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4ADD412D84D for ; Tue, 22 Jan 2019 23:26:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JLorSY42i5EP for ; Tue, 22 Jan 2019 23:26:08 -0800 (PST) Received: from giant.haxx.se (www.haxx.se [IPv6:2a00:1a28:1200:9::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0A68E1294D0 for ; Tue, 22 Jan 2019 23:26:07 -0800 (PST) Received: from giant.haxx.se (mail [127.0.0.1]) by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTPS id x0N7PdIq007098 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 23 Jan 2019 08:25:39 +0100 Received: from localhost (dast@localhost) by giant.haxx.se (8.15.2/8.15.2/Submit) with ESMTP id x0N7PbsX007083; Wed, 23 Jan 2019 08:25:38 +0100 X-Authentication-Warning: giant.haxx.se: dast owned process doing -bs Date: Wed, 23 Jan 2019 08:25:37 +0100 (CET) From: Daniel Stenberg X-X-Sender: dast@giant.haxx.se To: Paul Hoffman cc: DoH WG In-Reply-To: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> Message-ID: References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) X-fromdanielhimself: yes MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Jan 2019 07:26:10 -0000 On Wed, 16 Jan 2019, Paul Hoffman wrote: > So, does this WG want to adopt this as a work item? Disclaimer: I used to work for a browser company but I no longer do. I never spoke for them anyway. For me, one of the key elements and features with DoH is that I as a user have picked a DNS provider I decide to trust. Be it a global CDN provider or my own cloud instance. Any other way, with the ISP or my local network admins telling me what server to use, is a major setback in my view. All forms of opportunistic DoH will make it no better than opportunistic DoT, which ultimately will fail to protect my privacy. At the same time I of course appreciate that there's a problem/challenge here with figuring out what DoH server to use and how to even find out that there is one offered. If I don't know any servers, getting one or a few suggestions might help. For this, this spec offers ways and I'm for the working group adopting this. -- / daniel.haxx.se From nobody Wed Jan 23 00:18:50 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4698B130E5D for ; Wed, 23 Jan 2019 00:18:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OQpvFLBA6Yhh for ; Wed, 23 Jan 2019 00:18:46 -0800 (PST) Received: from smtp.guxx.net (nyx.guxx.net [85.10.208.173]) by ietfa.amsl.com (Postfix) with ESMTP id 06609128D52 for ; Wed, 23 Jan 2019 00:18:46 -0800 (PST) Received: by nyx.guxx.net (Postfix, from userid 107) id BEA8F5F4034A; Wed, 23 Jan 2019 09:18:44 +0100 (CET) Received: from [172.19.152.127] (p4FF53CB0.dip0.t-ipconnect.de [79.245.60.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id EB7F35F40022; Wed, 23 Jan 2019 09:18:43 +0100 (CET) From: "Ralf Weber" To: "Daniel Stenberg" Cc: "Paul Hoffman" , "DoH WG" Date: Wed, 23 Jan 2019 09:18:42 +0100 X-Mailer: MailMate (1.12.3r5579) Message-ID: In-Reply-To: References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Jan 2019 08:18:47 -0000 Moin! On 23 Jan 2019, at 8:25, Daniel Stenberg wrote: > For me, one of the key elements and features with DoH is that I as a > user have picked a DNS provider I decide to trust. That is a decision maybe you or me can take as an informed user with knowledge of how networks work. Most users and I’m using all of my wider family that I support technically as an example could not make such a decision. Sure they could click somewhere like they clicked ignore cert or enhance your computer multiple times which lead to tons of work on my side. This is why I’d like only informed users to make that change and let the ISP or network admin running DNS enhance their security by pointing them to DoH server. > Be it a global CDN provider or my own cloud instance. Well if you run your own DNS instance you soon find out that your Web performance especially video is bad, when you are not near your DNS server, as none of the big CDN companies will look at the client subnet extension you send. > Any other way, with the ISP or my local network admins telling me what > server to use, is a major setback in my view. > > All forms of opportunistic DoH will make it no better than > opportunistic DoT, which ultimately will fail to protect my privacy. Well you can protect your privacy today by manually changing you DNS/DoH provider already. So the use case described in here is not for you, but instead for those that can not make these informed changes. So long -Ralf —-- Ralf Weber From nobody Wed Jan 23 05:23:52 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DD19E12DF71 for ; Wed, 23 Jan 2019 05:23:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.19 X-Spam-Level: X-Spam-Status: No, score=-4.19 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, T_FILL_THIS_FORM_SHORT=0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CWBnUXIn9F40 for ; Wed, 23 Jan 2019 05:23:48 -0800 (PST) Received: from ppsw-32.csi.cam.ac.uk (ppsw-32.csi.cam.ac.uk [131.111.8.132]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AD59B12D84C for ; Wed, 23 Jan 2019 05:23:48 -0800 (PST) X-Cam-AntiVirus: no malware found X-Cam-ScannerInfo: http://help.uis.cam.ac.uk/email-scanner-virus Received: from grey.csi.cam.ac.uk ([131.111.57.57]:51234) by ppsw-32.csi.cam.ac.uk (ppsw.cam.ac.uk [131.111.8.138]:25) with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) id 1gmIVJ-000gd5-2E (Exim 4.91) (return-path ); Wed, 23 Jan 2019 13:23:41 +0000 Date: Wed, 23 Jan 2019 13:23:41 +0000 From: Tony Finch To: Daniel Stenberg cc: Paul Hoffman , DoH WG In-Reply-To: Message-ID: References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Jan 2019 13:23:51 -0000 Daniel Stenberg wrote: > > For me, one of the key elements and features with DoH is that I as a user have > picked a DNS provider I decide to trust. Be it a global CDN provider or my own > cloud instance. Any other way, with the ISP or my local network admins telling > me what server to use, is a major setback in my view. As a University DNS admin, I provide DoH to my users so that they can do interesting things with it. I'm not going to provide DoH to the world because it would cost too much effort. And people on our network ultimately have to use my servers because of all our private names and addresses. I'm not against them using other servers for off-site names (after all they can usually just use their mobile provider instead) but there should at least be a way for their device to automatically locate a local DNS server with a transport it likes. Tony. -- f.anthony.n.finch http://dotat.at/ each generation is responsible for the fate of our planet From nobody Wed Jan 23 06:17:28 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3073712DF71 for ; Wed, 23 Jan 2019 06:17:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id d-begWjmYHS0 for ; Wed, 23 Jan 2019 06:17:24 -0800 (PST) Received: from giant.haxx.se (www.haxx.se [IPv6:2a00:1a28:1200:9::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 110CF128CE4 for ; Wed, 23 Jan 2019 06:17:23 -0800 (PST) Received: from giant.haxx.se (mail [127.0.0.1]) by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTPS id x0NEGr3c005171 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 23 Jan 2019 15:16:53 +0100 Received: from localhost (dast@localhost) by giant.haxx.se (8.15.2/8.15.2/Submit) with ESMTP id x0NEGrrk005160; Wed, 23 Jan 2019 15:16:53 +0100 X-Authentication-Warning: giant.haxx.se: dast owned process doing -bs Date: Wed, 23 Jan 2019 15:16:53 +0100 (CET) From: Daniel Stenberg X-X-Sender: dast@giant.haxx.se To: Tony Finch cc: Paul Hoffman , DoH WG In-Reply-To: Message-ID: References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) X-fromdanielhimself: yes MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Jan 2019 14:17:26 -0000 On Wed, 23 Jan 2019, Tony Finch wrote: > I'm not against them using other servers for off-site names (after all they > can usually just use their mobile provider instead) but there should at > least be a way for their device to automatically locate a local DNS server > with a transport it likes. In this regard it is truly unfortunate that a user (application) can't tell if name is "local" or "remote" or perhaps which server it should ask for what names. While you want your users to use that local server that you announce to them, when I go to my coffee shop or visit a friend of mine I'd rather *not* use whatever local server they advertise... Right now the only way a user can use both local private names as well as remote names is by telling one of the resolvers *all* names and hope that it fails for the one set it doesn't know of so that the client can switch over and use the other server for those names. Not ideal, for privacy reasons and more. -- / daniel.haxx.se From nobody Wed Jan 23 06:37:27 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AD844123FFD for ; Wed, 23 Jan 2019 06:37:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RZP2cR4suCuW for ; Wed, 23 Jan 2019 06:37:24 -0800 (PST) Received: from xs.powerdns.com (xs.powerdns.com [82.94.213.34]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 287E5124408 for ; Wed, 23 Jan 2019 06:37:23 -0800 (PST) Received: from server.ds9a.nl (ip565244ed.adsl-surfen.hetnet.nl [86.82.68.237]) by xs.powerdns.com (Postfix) with ESMTPS id EF7869FD6E; Wed, 23 Jan 2019 14:37:14 +0000 (UTC) Received: by server.ds9a.nl (Postfix, from userid 1000) id C8236ACC4E1; Wed, 23 Jan 2019 15:37:14 +0100 (CET) Date: Wed, 23 Jan 2019 15:37:14 +0100 From: bert hubert To: Ben Schwartz Cc: "A. Schulze" , DoH WG Message-ID: <20190123143714.GB18473@server.ds9a.nl> References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> <6f2860bd-2a7f-01b5-2ec9-9667d71e3f38@andreasschulze.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.24 (2015-08-30) Archived-At: Subject: Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Jan 2019 14:37:26 -0000 On Wed, Jan 16, 2019 at 01:28:03PM -0500, Ben Schwartz wrote: > DNS over TLS already supports a way for clients to upgrade from unencrypted > DNS, by probing port 853 on the server's IP address. I presume that's why > DNS over TLS discovery was not mentioned in this draft. Is probing port > 853 sufficient for your use case? With my "large scale internet service provider constituency" hat on, a major problem for them is that many deployed CPEs announce themselves as nameserver. So over DHCP they will tell clients to use 192.168.1.1 for DNS. This leads opportunistic DNS over TLS clients to probe the modem/router/CPE for TLS support. For many reasons, CPEs are hard to change substantially, so it is not that easy to add 853 proxying or an actual DoT server on these boxes. So service providers would love to be able to configure a DoT server that lives on a different IP address than the regularly configured plaintext nameserver. Bert From nobody Wed Jan 23 06:39:50 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E0038123FFD for ; Wed, 23 Jan 2019 06:39:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 16KSGoQRrRaT for ; Wed, 23 Jan 2019 06:39:47 -0800 (PST) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 82159124408 for ; Wed, 23 Jan 2019 06:39:47 -0800 (PST) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 95E596A262; Wed, 23 Jan 2019 15:39:45 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1548254385; bh=SXUuMZCLB43Q92SyQpKCFLXj3XbgWRxHiT7pTDhCp1k=; h=Date:From:To:Cc:In-Reply-To:References:Subject:From; b=IGN/PXrp3XmI4BxdruYCKYROSHtm/B3nos3FAN+WrJDSgnZWyalXnF33ltmaQ3W+5 yw4LxVz0uTpLRYGZs2nCi01S9oeaVj9tDR8SjKHzTthbrbVJk0G4OiTpKLO/v1lV2x 2DGs4qt8dWFfT8KbB/L5uEakalJbSm7uWuKY9CAIRxcRIYoRBZePqokBJzfmBRpjK2 tUMn8i/QAUmcDFh5HXzk9oa5X3D6lbXS9xT6Z18YVKSqQPVmw96WRkh8/6XBKUO0FG Fm+6ihuIPofpc3pIBTuHfwIu8zwZWPc3lxjJGPgK2aFfDeXHztv/8pa7nTK4fCRjeE CdZFLRElXgqXQ== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 8879C3C084D; Wed, 23 Jan 2019 15:39:45 +0100 (CET) Date: Wed, 23 Jan 2019 15:39:45 +0100 (CET) From: Vittorio Bertola To: Daniel Stenberg Cc: DoH WG Message-ID: <2112742428.56808.1548254385497@appsuite.open-xchange.com> In-Reply-To: References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.1-Rev3 X-Originating-Client: open-xchange-appsuite Archived-At: Subject: Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Jan 2019 14:39:49 -0000 > Il 23 gennaio 2019 alle 8.25 Daniel Stenberg ha scritto: > > For me, one of the key elements and features with DoH is that I as a user have > picked a DNS provider I decide to trust. Be it a global CDN provider or my own > cloud instance. Any other way, with the ISP or my local network admins telling > me what server to use, is a major setback in my view. This could be true for you and me, but average users have no idea of what the DNS is - they only make one choice, they pick an *ISP* that they decide to trust. They pay to get "Internet access" from that company and expect that company to provide all it takes for "the Internet to work", including DNS resolution, without them having to do anything; this has been the default situation for the last 20 years at least. So it's fine if smarter users make changes to this default and pick a DNS provider different from their connectivity provider, and it's fine to empower them to do so, but it's not fine to break the way the Internet normally works for most people, which includes an automated and effortless mechanism to get the DNS resolution service from the ISP when connecting to the network. Regards, -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy From nobody Wed Jan 23 10:52:49 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4A36D1310C3 for ; Wed, 23 Jan 2019 10:52:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.042 X-Spam-Level: X-Spam-Status: No, score=-2.042 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.142, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FBdO_QSWm1Cd for ; Wed, 23 Jan 2019 10:52:35 -0800 (PST) Received: from mail-qt1-x82b.google.com (mail-qt1-x82b.google.com [IPv6:2607:f8b0:4864:20::82b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1D44913126A for ; Wed, 23 Jan 2019 10:17:07 -0800 (PST) Received: by mail-qt1-x82b.google.com with SMTP id n32so3434103qte.11 for ; Wed, 23 Jan 2019 10:17:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=BskkAHOVFas6sMq63wVavmT8+H1xd6RiVBXNU+lsnzE=; b=f7mIrWfvSuQl4su/XqsyHoKWsfg5qg0aFUx0kyS+GEgQTXJ1RXau8Y+yrZxrAo76Sd IGee4by90EJcAmg0dHcrNDMIKv5qefYzw1jdcctbt7+I0Wp2OIlDTs32GqtInZnipiOY vkmSC86KcVGXxwxplP0IJaBQgG1jYX+zc2fSrdM0HireGq88kmL1lcPVQjD48KUC0+df 3AtsOuXpy6ZSm1W+lnEHa7B05ZY5iqqoTUmO8NsVOtAg8l+J/F/ZOEkgdStyQmd7WSdS OWiLfliIU5oFrxN0RapgrCPmuBTtV4RVZvSc9A33R5VAzSVpGjROAycp8XNov3RFv/UJ yYFQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=BskkAHOVFas6sMq63wVavmT8+H1xd6RiVBXNU+lsnzE=; b=TPXHqZv6zZ65SuTgEjG/aIh/+6nCgnERO/vNwzIrh/sO7c28/gSMow5bGG1w42lsE8 JcpDWBvj2h9LcsanwB8xTouOhGRXuUsr2E7cw14ZPU/jYplZiJkV4nEndzbHDbvPCDe4 k+DRsFBKWPM1WCre9vp2hgXasvkAFOZ6xXhzxPZ0CeSCp+SkelG+z2/h5nWnbkJO3zpu xQlHJaME5YrC5x3WDn7VLYl3LuGQmzxWXKdp8Mwr46l3HKlcI8uH2v27OEkEHUcbUSZA PoVZ57fubwhWeA81bp/TABWemoy94skh/DNLqntA+Ip865n4TbTsTWeCmPuhXD/e0HHt gZ2A== X-Gm-Message-State: AJcUukcTKfuhnAvIVUbvVhar6KV6D7YXx5d1Bcgo9C+Y13ai/zG2mrKf dUISxQoAHXlwqC3MJDEFYe3+ByE0CkiyPDCon13LLvnn X-Google-Smtp-Source: ALg8bN6l7Z7bJfrNNMJpH99Wu/fBHnnXksby4ffK9BK1xEyIhp4640AaTO4QyVtYQbJ2IdyLq/a3eqg5ocRkvlDDJAg= X-Received: by 2002:a0c:d4a7:: with SMTP id u36mr2824005qvh.38.1548267426224; Wed, 23 Jan 2019 10:17:06 -0800 (PST) MIME-Version: 1.0 References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> <2112742428.56808.1548254385497@appsuite.open-xchange.com> In-Reply-To: <2112742428.56808.1548254385497@appsuite.open-xchange.com> From: Ted Lemon Date: Wed, 23 Jan 2019 13:16:30 -0500 Message-ID: To: Vittorio Bertola Cc: Daniel Stenberg , DoH WG Content-Type: multipart/alternative; boundary="000000000000f531e705802419b1" Archived-At: Subject: Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Jan 2019 18:52:43 -0000 --000000000000f531e705802419b1 Content-Type: text/plain; charset="UTF-8" Okay, but for that use case, why not DoT rather than DoH? What's the advantage of DoH in this use case? On Wed, Jan 23, 2019 at 9:39 AM Vittorio Bertola wrote: > > Il 23 gennaio 2019 alle 8.25 Daniel Stenberg ha > scritto: > > > > For me, one of the key elements and features with DoH is that I as a > user have > > picked a DNS provider I decide to trust. Be it a global CDN provider or > my own > > cloud instance. Any other way, with the ISP or my local network admins > telling > > me what server to use, is a major setback in my view. > > This could be true for you and me, but average users have no idea of what > the DNS is - they only make one choice, they pick an *ISP* that they decide > to trust. They pay to get "Internet access" from that company and expect > that company to provide all it takes for "the Internet to work", including > DNS resolution, without them having to do anything; this has been the > default situation for the last 20 years at least. > > So it's fine if smarter users make changes to this default and pick a DNS > provider different from their connectivity provider, and it's fine to > empower them to do so, but it's not fine to break the way the Internet > normally works for most people, which includes an automated and effortless > mechanism to get the DNS resolution service from the ISP when connecting to > the network. > > Regards, > -- > > Vittorio Bertola | Head of Policy & Innovation, Open-Xchange > vittorio.bertola@open-xchange.com > Office @ Via Treviso 12, 10144 Torino, Italy > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --000000000000f531e705802419b1 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Okay, but for that use case, why not DoT rather than DoH?= =C2=A0 =C2=A0What's the advantage of DoH in this use case?

On Wed, Jan 2= 3, 2019 at 9:39 AM Vittorio Bertola <vittorio.bertola=3D40open-xchange.com@dmarc.ietf.org&= gt; wrote:
> = Il 23 gennaio 2019 alle 8.25 Daniel Stenberg <daniel@haxx.se> ha scritto:
>
> For me, one of the key elements and features with DoH is that I as a u= ser have
> picked a DNS provider I decide to trust. Be it a global CDN provider o= r my own
> cloud instance. Any other way, with the ISP or my local network admins= telling
> me what server to use, is a major setback in my view.

This could be true for you and me, but average users have no idea of what t= he DNS is - they only make one choice, they pick an *ISP* that they decide = to trust. They pay to get "Internet access" from that company and= expect that company to provide all it takes for "the Internet to work= ", including DNS resolution, without them having to do anything; this = has been the default situation for the last 20 years at least.

So it's fine if smarter users make changes to this default and pick a D= NS provider different from their connectivity provider, and it's fine t= o empower them to do so, but it's not fine to break the way the Interne= t normally works for most people, which includes an automated and effortles= s mechanism to get the DNS resolution service from the ISP when connecting = to the network.

Regards,
--

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
vitt= orio.bertola@open-xchange.com
Office @ Via Treviso 12, 10144 Torino, Italy

_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
--000000000000f531e705802419b1-- From nobody Wed Jan 23 10:53:24 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7A193130EEC for ; Wed, 23 Jan 2019 10:53:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1t9eoxhOl6Tb for ; Wed, 23 Jan 2019 10:53:20 -0800 (PST) Received: from xs.powerdns.com (xs.powerdns.com [82.94.213.34]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 622F7131294 for ; Wed, 23 Jan 2019 10:23:33 -0800 (PST) Received: from server.ds9a.nl (ip565244ed.adsl-surfen.hetnet.nl [86.82.68.237]) by xs.powerdns.com (Postfix) with ESMTPS id 5C9229FD6E; Wed, 23 Jan 2019 18:23:25 +0000 (UTC) Received: by server.ds9a.nl (Postfix, from userid 1000) id 3D0F7ACC443; Wed, 23 Jan 2019 19:23:25 +0100 (CET) Date: Wed, 23 Jan 2019 19:23:25 +0100 From: bert hubert To: Paul Hoffman Cc: DoH WG Message-ID: <20190123182325.GA3163@server.ds9a.nl> References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> User-Agent: Mutt/1.5.24 (2015-08-30) Archived-At: Subject: Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Jan 2019 18:53:23 -0000 On Wed, Jan 16, 2019 at 12:25:55AM +0000, Paul Hoffman wrote: > So, does this WG want to adopt this as a work item? Yes. My reasoning is as follows. Even though it is a challenging subject, if we don't do it bad things will happen. As long as there is no way to associate a network with an encrypted DNS provider (DoH in this case), we can not rebut the argument "we simply HAVE to centralize the DNS on this cloud provider because there is no alternative". Regardless of what we think about the desireability of centralized or decentralized DNS, it is never good if there are no options. So I hope we can give this a very hard think to see what we can come up with. To stimulate the discussion a bit, it turns out browsers already contain a list of providers they are willing to trust. It may be that the solution for provisioning DoH securely also involves having a list of providers who are allowed to provision DoH. The existing list of trusted parties that can (not) be trusted is of course the list of trusted certificate authorities. Bert From nobody Wed Jan 23 11:16:16 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9F320128B01 for ; Wed, 23 Jan 2019 11:16:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mozilla.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u1b6Z8m9an2V for ; Wed, 23 Jan 2019 11:16:12 -0800 (PST) Received: from mail-it1-x12e.google.com (mail-it1-x12e.google.com [IPv6:2607:f8b0:4864:20::12e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D14971277BB for ; Wed, 23 Jan 2019 11:16:11 -0800 (PST) Received: by mail-it1-x12e.google.com with SMTP id w18so922343ite.1 for ; Wed, 23 Jan 2019 11:16:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mozilla.com; s=google; h=subject:to:cc:references:from:openpgp:autocrypt:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=YCJZ7Iya3i7ENEEVRUJXdfzeJCksr4WdHzOdXOYbDKw=; b=JGszZe1DQHmttmtb5vb15EcFZc1tz9iBdPGxXQMg/16Qw1BE5v2rDH9YsLx8x3/oaX jNbJpCsoHMBOyd65vZI1hJnu8ixEJYK+6rz0p2ppSldH961l+DIsiew78Gsv8ggpYn3U 8Bw+1StJ+2dhqFYYgOIhv3vRZBsu3+0hj5NFI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:openpgp:autocrypt :message-id:date:user-agent:mime-version:in-reply-to :content-language:content-transfer-encoding; bh=YCJZ7Iya3i7ENEEVRUJXdfzeJCksr4WdHzOdXOYbDKw=; b=seUorpFzniUJ42t0f7gN7IDBLRvuBJpw/wMtsF7sb6HJQMNAsc0t28apOvU26/Knxr 6nZ656FwGgL3OLLJWeW2U7t6+moJWGdfIje9a+1jZVjZvuFTkKT/iBAelAC2x6fXOsE5 iRn4+HDncPDr72tsSE4dDghDlc0rfDJaD3Lp48oz7kgWJdo764mElWX6+ae+wbXHsOn1 ul9+FrootqqxPHY82eufpZs1yvY1BA5dv1wDvf6zBGAOnSr+mZP/7mnCZKmx6K+D9AXg jpmctSu27vGlZzXSB+FJZZoZfhFpGCiwg6MLqXZaRPCJEdsiyun7rTRbb/vfSPkMVFku 92Rg== X-Gm-Message-State: AJcUukdubXVIiA/ptmlv0p07KYpN+PxOgfcEIJ0+pliBuJCqUD9HN8k/ g223kh9RJOU7e8suIPFnoP2B8Km8jhI= X-Google-Smtp-Source: ALg8bN5iycftViHdCSFBahWtEZ5/+yIwum76nIj5sem96qh+/wOuLBs6ohiQ1hmk1qOfpxkWh0mlBg== X-Received: by 2002:a24:390a:: with SMTP id l10mr2406186ita.0.1548270970876; Wed, 23 Jan 2019 11:16:10 -0800 (PST) Received: from dragon.local ([76.25.3.152]) by smtp.gmail.com with ESMTPSA id 125sm10121761itk.28.2019.01.23.11.16.09 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 23 Jan 2019 11:16:10 -0800 (PST) To: Daniel Stenberg , Paul Hoffman Cc: DoH WG References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> From: Peter Saint-Andre Openpgp: preference=signencrypt Autocrypt: addr=stpeter@mozilla.com; prefer-encrypt=mutual; keydata= mQINBFonEf4BEADvZ+RGsJoOyZaw2rKedB9pBb2nNXVGgymNS9+FAL/9SsfcrKaGYSiWEz7P Lvc97hWH3LACFAHvnzoktv+4IWHjItvhdi9kUQ3Gcbahe55OcdZuSXXH3w5cHF0rKz9aYRpN jENqXM5dA8x4zIymJraqYvHlFsuuPB8rcRIV9SKsvcy14w9iRqu770NjXfE/aIsyRwwmTPiU FQ0fOSDPA/x2DLjed/GYHem90C5vF4Er9InMqH5KAMLnjIYZ9DbPx5c5EME4zW/d648HOvPB bm+roZs4JTHBhjlrTtzDDpMcxHq1e8YPvSdDLPvgFXDcTD4+ztkdO5rvDkbc61QFcLlidU8H 3KBiOVMA/5Rgl4lcWZzGfJBnwvSrKVPsxzpuCYDg01Y/7TH4AuVkv5Na6jKymJegjxEuJUNw CBzAhxOb0H9dXROkvxnRdYS9f0slcNDBrq/9h9dIBOqLhoIvhu+Bhz6L/NP5VunQWsEleGaO 3gxGh9PP/LMyjweDjPz74+7pbyOW0b5VnIDFcvCTJKP0sBJjRU/uqmQ25ckozuYrml0kqVGp EfxhSKVqCFoAS4Q7ux99yT4re2X1kmlHh3xntzmOaRpcZsS8mJEnVyhJZBMOhqE280m80ZbS CYghd2K0EIuRbexd+lfdjZ+t8ROMMdW5L51CJVigF0anyYTcAwARAQABtCdQZXRlciBTYWlu dC1BbmRyZSA8c3RwZXRlckBtb3ppbGxhLmNvbT6JAlQEEwEIAD4WIQQ1VSPTuPTvyWCdvvRl YYwYf2gUqQUCWicR/gIbIwUJCWYBgAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBlYYwY f2gUqdaREAChG8qU1853mP0sv2Mersns8TLG1ztgoKHvMXFlMUpNz6Oi6CjjaMNFhP7eUY4T D43+yQs7f4qCkOAPWuuqO8FbNWQ+yUoVkqF8NUrrVkZUlZ1VZBMQHNlaEwwu1CGoHsLoRohP SiZ0hpmGTWB3V6cDDK4KN6nl610WJbzE9LeKY1AxtePdJi2KM281U0Fz8ntij1jWu0gF2xU4 Sez46JDogHLWKgd0srauhcCVzZjAhiWrXp1+ryzSWYaZO8Kh8SnF1f4o6jtYikMqkxUaI5nX wvD3kNX4AMSkCAZfG7Jcfj/SLDojTcREgO87g7B9bcOOsHN4lj3lHoFV0aXpgPmjfIvAjJHu fHkXZAQAH8w0u9bgJqRn703+A4NPfLopnjegyhlNi7fQ3cMQV1H7Oj7WrB/pCcprx+1u/6Uq oTtDwWh1U5uVthVAI0QojpNWR08zABDX19TlGtVoeygaQV3CAEolxTiYQtCfVavUzUplCZ/t 3v4YiRov+NylflJd+1akyOs1IAgARf444BnoH1fotkpfXNOpp9wUXXwsQcFRdP7vpMkSCkc0 sxPNTVX3ei0QImp4NsrFdaep7LV3zEb3wkAp6KE5Qno4hVVEypULbvB0G6twNZbeRfcs2Rjp jnPb2fofvg2WhAKB20dnRfIfK8OKTD/P+JDcauJANjmekLkCDQRaJxH+ARAApPwkbOTChAQu jMvteb/xcwuL5JZElmLxIqvJhqybV7JknM+3ATyN0CTYQFvPTgIrhpk4zSn0A6pEePdK8mKK 5/aHyd7pr7rLEi1sI/X3UE8ld/E83MExksKrYbs0UX1wSQwYXU6g64KicnuP2Abqg+8wrQ18 1nPcZci9jJI75XVPnTdUpZD5aaQWGp7IJ06NTbiOk30I50ORfulgKoe4m3UfsMALFxIx3pJk oy76xC2tjxYGf+4Uq1M0iK3Wy655GrcwXq/5ieODNUcAZzvK5hsUVRodBq0Lq3g1ivQF4ba7 RQayDzlW6XgoeU49xnCr9XdZYnTnj4iaPmr2NtY6AacBwRz+bJsyugeSyGgHsnVGyUSMk8YN wZHvUykMjH21LLzIUX5NFlcumLUXDOECELCJwewui4W81sI5Sq/WDJet+iJwwylUX22TSulG VwDS+j66TLZpk1hEwPanGLwFBSosafqSNBMDVWegKWvZZVyoNHIaaQbrTIoAwuAGvdVncSQz ttC6KkaFlAtlZt3+eUFWlMUOQ9jxQKTWymyliWKrx+S6O1cr4hwVRbg7RQkpfA8E2Loa13oO vRSQy/M2YBRZzRecTKY6nslJo6FWTftpGO7cNcvbmQ6I++5cBG1B1eNy2RFGJUzGh1vlYo51 pdfSg0U1oPHBPCHNvPYCJ7UAEQEAAYkCPAQYAQgAJhYhBDVVI9O49O/JYJ2+9GVhjBh/aBSp BQJaJxH+AhsMBQkJZgGAAAoJEGVhjBh/aBSpAw0P/1tEcEaZUO1uLenNtqysi3mQ6qAHYALR Df3p2z/RBKRVx0DJlzDfDvJ2R/GRwoo+vyCviecuG2RNKmJbf1vSm/QTtbQMUjwut9mx6KCY CyKwniqdhaMBmjCfV2DB2MxxZLYMtDfx/2mY7vzAci7AkjC+RkSUByMEOkyscUydKC/ETdf9 tvI8GhTY/8Q7JSylS3lQA5pMUHiIf+KpSmqKZeBPkGc7nSKM1w1UKUvFAsyyVsiG6A/hWrTr 7tTQAl7YfjtOGE8n4IKGktvrT99bbh9wdWKZ5FdHUN9hx2Q8VP8+0lR1CH2laVFbEwCOv1vM W4cgQDLxwwpo1iOTdHBVtQDxlQ9hPMKVlB1KP9KjchxuiLc24wLmCjP3pDMml4LQxOYB34Eq cgPZ3uHvJZG309sb2wTMTWaXobWNI++ZrsRD5GTmuzF3kkx3krtrq6HI5NSaemxK6MTDTjDN Rj/OwTl0yU35eJXuuryB20GFOSUsxiw00I2hMGQ1Cy9L/+IW6Dvotd8O3LmKh2tFArzXaKLx /rZyGNurS/Go5YjHp8wdJOs7Ka2p1U31js24PMWO6hf6hIiY2WRUsnE6xZNhvBTgKOY6u0KT V6hTevFqEw7OAZDCWUoE2Ob2/oHGZCCMW5SLAMgp7eihF0kGf2S2CmpIFYXGb61hAD8SqSY7 Fn7V Message-ID: <6b6fc4ea-08b6-e116-830f-9092b703e581@mozilla.com> Date: Wed, 23 Jan 2019 12:16:09 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.4.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Jan 2019 19:16:15 -0000 On 1/23/19 12:25 AM, Daniel Stenberg wrote: > On Wed, 16 Jan 2019, Paul Hoffman wrote: > >> So, does this WG want to adopt this as a work item? > > Disclaimer: I used to work for a browser company but I no longer do. I > never spoke for them anyway. > > For me, one of the key elements and features with DoH is that I as a > user have picked a DNS provider I decide to trust. You are in a small minority. :-) Very few users will ever change their settings. > Be it a global CDN > provider or my own cloud instance. Any other way, with the ISP or my > local network admins telling me what server to use, is a major setback > in my view. The local network admins in your enterprise might want to have more control, which seems OK to me because, depending on your company's policies, they might own or have effective control over your device (however, your user agent might want to override the suggestions it receives). > All forms of opportunistic DoH will make it no better than opportunistic > DoT, which ultimately will fail to protect my privacy. > > At the same time I of course appreciate that there's a problem/challenge > here with figuring out what DoH server to use and how to even find out > that there is one offered. If I don't know any servers, getting one or a > few suggestions might help. For this, this spec offers ways and I'm for > the working group adopting this. +1 to adoption. Peter From nobody Mon Jan 28 00:05:18 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 62C48130FAF for ; Mon, 28 Jan 2019 00:05:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gMMrmaWJtYAV for ; Mon, 28 Jan 2019 00:05:15 -0800 (PST) Received: from giant.haxx.se (www.haxx.se [IPv6:2a00:1a28:1200:9::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BCCEC130FC5 for ; Mon, 28 Jan 2019 00:05:14 -0800 (PST) Received: from giant.haxx.se (mail [127.0.0.1]) by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTPS id x0S857pS011180 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 28 Jan 2019 09:05:07 +0100 Received: from localhost (dast@localhost) by giant.haxx.se (8.15.2/8.15.2/Submit) with ESMTP id x0S8579U011173; Mon, 28 Jan 2019 09:05:07 +0100 X-Authentication-Warning: giant.haxx.se: dast owned process doing -bs Date: Mon, 28 Jan 2019 09:05:07 +0100 (CET) From: Daniel Stenberg X-X-Sender: dast@giant.haxx.se To: Vittorio Bertola cc: DoH WG In-Reply-To: <2112742428.56808.1548254385497@appsuite.open-xchange.com> Message-ID: References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> <2112742428.56808.1548254385497@appsuite.open-xchange.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) X-fromdanielhimself: yes MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset=US-ASCII Archived-At: Subject: Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Jan 2019 08:05:17 -0000 On Wed, 23 Jan 2019, Vittorio Bertola wrote: > This could be true for you and me, but average users have no idea of what > the DNS is - they only make one choice, they pick an *ISP* that they decide > to trust. I don't know a single ordinary person who selected their ISP based on their privacy stance for DNS queries. The people I know pick ISP primarily based on availability, price, bandwidth and technology. I actually think rather few people trust their ISP, and I think history would give them right since so many ISPs have violated their users' privacy and data through the years. -- / daniel.haxx.se From nobody Mon Jan 28 01:58:25 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 76C07130FF9 for ; Mon, 28 Jan 2019 01:58:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.553 X-Spam-Level: X-Spam-Status: No, score=-6.553 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-4.553, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sky.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xD5Jr9shbjw3 for ; Mon, 28 Jan 2019 01:58:21 -0800 (PST) Received: from EUR02-VE1-obe.outbound.protection.outlook.com (mail-ve1eur02on0616.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe06::616]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C6146129508 for ; Mon, 28 Jan 2019 01:58:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sky.uk; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=CZtcGwplZBIKvxj6q62xLwdul65uqfpYaMRxsNG6BAI=; b=MNZeR++2T6VphAvuNb3fkayAqxb2z+QOGwNO0QEeOnDyPLJVzpStw+GoSIJAea0GA3lBNV5YXiOl6ihELni8J03j7t3IVT+YC3t5O9eWZdmMRsTUFikw1Zbo4hpVEYce6cWIS9brIGniEZH7MRyY+U8ZXQKeFf8eK44Y/34SBnw= Received: from AM4PR0601MB2180.eurprd06.prod.outlook.com (10.167.132.7) by AM4PR0601MB2178.eurprd06.prod.outlook.com (10.167.123.155) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1558.18; Mon, 28 Jan 2019 09:58:18 +0000 Received: from AM4PR0601MB2180.eurprd06.prod.outlook.com ([fe80::148d:a08a:46fa:294]) by AM4PR0601MB2180.eurprd06.prod.outlook.com ([fe80::148d:a08a:46fa:294%10]) with mapi id 15.20.1558.023; Mon, 28 Jan 2019 09:58:17 +0000 From: "Winfield, Alister" To: DoH WG Thread-Topic: [EXTERNAL] Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh Thread-Index: AQHUsuzVoWEZWxkEakamBfJ6NkBIVaW87R2AgAdtZoCAAB+dAA== Date: Mon, 28 Jan 2019 09:58:17 +0000 Message-ID: References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> <2112742428.56808.1548254385497@appsuite.open-xchange.com> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.15.0.190115 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Alister.Winfield@sky.uk; x-originating-ip: [90.216.150.239] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; AM4PR0601MB2178; 6:jTeP3YBc4Aa0EHggUJS4zybm+4oA7MtxGKHC9Q8zvlfVU44OhuvFKSjQVITHrikNoYCJ098GFXzYZ+r9oo9CVg0FMte8mk76rfRZhS7dyUeO8XOVmZacFsc/NJZnTLf26gA5dkqOmFCeFF8ZJtCZDs6Al2VE1CzsEzXpHkVb1El4enMYsVny4YXRqvgZGh16n0hbdQyW8YrntKcSJqPYR5K4nSbpB0UsGD7Grrakad/lhSiXdax+eVRu3M/JmTQ24RTNSmfN5ppCiwrchLBPg3vwS/y5CPrFCZwMKHrvCbEfR6i6w98HBE/WlaIvegl3fZ7Rt8n7rdttN91BkYbT0Rf9Jc308xCHaJP1IEybptfX4ZMcuYfxKq9ADqo8f243CPiA6ue//ZWfQ+H/0Y+rJ/wSMCt561efNWzW7RsOgn6eydgB1I4fTrlwj4CTpIKBrfB+0sj2hAbT/P/nCCi1oQ==; 5:/TGNk6lMldJUKL6k9WitKtFgKinEWhkJIQDt7mpTBD8QkbSgXrqLm1C/4Fz6TdryGfqWTOoqlDCRtmRclaYyv3W7JX1UuB/9FLAP2pMNgwjI67mFXML8at/WXG1vwjxotPeQvAK5qRUe9yhj2HudatuuPzrZ0lHlRslr07GJih38LA9IvFbnAWnLF1sAncp8RLR6mvUflIw41OarvzGpQA==; 7:Hih2wOWFD9RjPevh2SxM7fGYgLU25Asbv/+rr8w5/gkkaDj8mqFrTlPNHU01B95muX4H7plVR2aoWpjd3iD/LOyZTu1mqEX8bTplAXCEBKV25+F7aHL0n0xx8I7gqE5ah6LnqePpX07vOJoMYBo+rw== x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: a22a88a7-84db-4708-679f-08d6850720a4 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600110)(711020)(4605077)(2017052603328)(7153060)(7193020); SRVR:AM4PR0601MB2178; x-ms-traffictypediagnostic: AM4PR0601MB2178: x-microsoft-antispam-prvs: x-forefront-prvs: 0931CB1479 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(346002)(376002)(396003)(136003)(366004)(199004)(189003)(6486002)(486006)(476003)(8676002)(8936002)(83716004)(71200400001)(82746002)(256004)(14444005)(5024004)(6916009)(74482002)(6512007)(2906002)(316002)(72206003)(81156014)(7736002)(81166006)(33656002)(71190400001)(6306002)(2616005)(86362001)(305945005)(3846002)(106356001)(58126008)(66066001)(25786009)(6506007)(6436002)(186003)(14454004)(76176011)(33896004)(105586002)(6116002)(66574012)(99286004)(229853002)(26005)(446003)(68736007)(966005)(11346002)(36756003)(93886005)(97736004)(6246003)(478600001)(53936002)(102836004); DIR:OUT; SFP:1101; SCL:1; SRVR:AM4PR0601MB2178; H:AM4PR0601MB2180.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:0; MX:1; received-spf: None (protection.outlook.com: sky.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: BIkMk6VxhjBf9gPaqescl5ClZIqHM9KvAyd99Yb6lsWLuBbCgAO9MAl/aoi+wjqKG83fJ5KPx/VCQckPIK94VympKMuUussCtn4SUcu0vfhce4I7wLLih8kT5LzgJ6FukRPszHf1ayyjcXelC03gnPk14ARdWbrZ9nafhgOHxxj/V2S64N1yZoHHxsJWHJQOq4nS6GpQHCrllDYQS7GS51n+WKqE4ElYZNHvs0nGojXlYQY+g7Ta3j5P3eEbCy35orE0vx2JHhDtPyZqa9bwcd6Ahtk1U8yIwtMN4dJNkBpgVucLUPf631k9iORrk0nrpvnl2o5O7mo265dl3qG9OhR3jF8zFq3b1sWIfDNBYerVzxZ/U1Aha42XDwqxN6mH7b5wSctdY1tQ5T7dMXpcqiVJ7kU27lQJXrnciHEK9TA= Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: sky.uk X-MS-Exchange-CrossTenant-Network-Message-Id: a22a88a7-84db-4708-679f-08d6850720a4 X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Jan 2019 09:58:17.7503 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 68b865d5-cf18-4b2b-82a4-a4eddb9c5237 X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM4PR0601MB2178 Archived-At: Subject: Re: [Doh] [EXTERNAL] Re: Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Jan 2019 09:58:24 -0000 SSBoYXBwZW4gdG8gZmluZCBpdCBoYXJkZXIgdG8gdHJ1c3QgYSBjb21wYW55IHdoZXJlIHRoZXJl IGlzIG5vIGNvbnRyYWN0IGFuZCB0aGUgY29tcGFueSBpcyBub3Qgb3BlcmF0aW5nIHVuZGVyIGxv Y2FsIGxhd3MgdGhhdCBJIGtub3cgYW5kIHVuZGVyc3RhbmQuIE90aGVycyB3aXRoIGxlc3MgdHJ1 c3Qgb2YgbG9jYWwgbGF3cywgcmVndWxhdGlvbnMgYW5kIGdvdmVybm1lbnRzIHdvdWxkIGZlZWwg cmF0aGVyIGRpZmZlcmVudGx5LiBBdCB3b3JrIEknbGwgdGFrZSB0aGUgbG9jYWwgcmVzb2x2ZXJz IG92ZXIgZXZlcnl0aGluZyBlbHNlIGJlY2F1c2UgSSBrbm93IHRoZXkgd2lsbCBkbyB3aGF0IHRo ZXkgY2FuIHRvIGF2b2lkIG1hbHdhcmUgaW5zaWRlIHRoZSBuZXR3b3JrIChlZyBibG9ja2luZyBD JkMgZG9tYWlucykuDQoNClNvIGNhbiB3ZSBiZSBtb3JlIG51YW5jZWQgaW4gdGhlIG1lYW5pbmcg b2YgdHJ1c3RlZCBhbmQgYWNjZXB0IGJvdGggdmlld3BvaW50cy4NCg0KVGhpcyBleGNoYW5nZSBp cyB3aHkgSSB0aGluayB0aGUgd2hvbGUgYXJlYSBpcyBtaXNzaW5nIGNvbmNlcHRzOg0KDQphKSBE ZWZpbmluZyB0cnVzdCBhbmQgcHJpdmFjeSBpbiBnZW5lcmFsIHRlcm1zLiBUaGUgQkNQIGRyYWZ0 IGhhcyBzb21lIG9mIHRoaXMgYnV0IGl0J3MgbGlrZWx5IHRoYXQgdGhlcmUgaXMgbW9yZSB0byBk byB0byBjb3ZlciBldmVyeSBhbmdsZS4NCmIpIFNvbWVob3cgc2VjdXJlbHkgYWR2ZXJ0aXNpbmcg d2hhdCB0eXBlcyBvZiB0cnVzdCBhbmQgcHJpdmFjeSB5b3VyIHJlc29sdmVyIGlzIGJ1aWx0IHRv IHByb3ZpZGUuIEhlcmUgd2UgYXJlIHZlcnkgbGlnaHQgYW5kIGl0IGNvdWxkIGJlIGJ1aWx0IGlu dG8gdGhlIGRpc2NvdmVyeSBtZWNoYW5pc20gb3IgcGVyaGFwcyBub3QgPw0KYykgQXVkaXRpbmcg YW5kIGl0cyByZWxhdGVkIGFjdGlvbnMgb24gZmFpbHVyZSB0byB1cGhvbGQgcHJvbWlzZXMgbWFk ZSBpbiAoYikuIEhlcmUgYmUgZHJhZ29ucywgdGhlIHByb2JsZW0gaXMgYXZvaWRpbmcgYSBjZW50 cmFsIGF1dGhvcml0eSB0aGF0IGNoYXJnZXMgYW5kIGFsbG93aW5nIGFueW9uZSB0byBzZXR1cCBh IEROUyBUUlIgcGVyaGFwcyBha2luIHRvIHNlbGYtc2lnbmVkIGNlcnRzIGluIHRoZSB3YXkgdGhh dCB0aGUgY2xpZW50IGNhbiBoYW5kbGUgJ3RydXN0Jy4gUGVyaGFwcyBhIG5vdGFyeSBzb2x1dGlv biBpcyBiZXR0ZXIgaW4gdGhhdCBpdCBhbGxvd3MgYSB1c2VyIHRvIGRlZmluZSB3aG8gdGhleSB0 cnVzdCBhbmQgdGhhdCB0cnVzdGVkIGVudGl0eSBjYW4gdGhlbiBhY2NlcHQgb3IgZGVueSByZXNv bHZlcnMuDQoNClJlbWVtYmVyLCB0aGUgYXV0b2RldGVjdGlvbiBjb25jZXB0IGlzIGZvciB0aG9z ZSB3aGVyZSB1c2luZyBsb2NhbCBETlMgaXMgYSBub24taXNzdWUgb3IgaXMgcmVxdWlyZWQuIFll cyBmb3IgdGhvc2Ugd2hvIGFyZSBtb3JlIGZvY3VzZWQgb24gdGhlIHRyYW5zcG9ydCBzZWN1cml0 eSB0aGUgd2F5IHlvdSBnZXQgdGhhdCBETlMgcmVzb2x2ZXIgSVAgaXMgc3VzcGVjdCBidXQgdGhh dCBpcyBhbiBpbnRlcmVzdGluZyBjaGFsbGVuZ2UgZm9yIHRoZSBwcm90b2NvbHMgaW52b2x2ZWQg KERIQ1AsIFBQUG9FIGV0YykuDQoNCi0tDQpBbGlzdGVyIFdpbmZpZWxkLg0KDQoNCg0K77u/T24g MjgvMDEvMjAxOSwgMDg6MDUsICJEb2ggb24gYmVoYWxmIG9mIERhbmllbCBTdGVuYmVyZyIgPGRv aC1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBvZiBkYW5pZWxAaGF4eC5zZT4gd3JvdGU6DQoN CiAgICBPbiBXZWQsIDIzIEphbiAyMDE5LCBWaXR0b3JpbyBCZXJ0b2xhIHdyb3RlOg0KDQogICAg PiBUaGlzIGNvdWxkIGJlIHRydWUgZm9yIHlvdSBhbmQgbWUsIGJ1dCBhdmVyYWdlIHVzZXJzIGhh dmUgbm8gaWRlYSBvZiB3aGF0DQogICAgPiB0aGUgRE5TIGlzIC0gdGhleSBvbmx5IG1ha2Ugb25l IGNob2ljZSwgdGhleSBwaWNrIGFuICpJU1AqIHRoYXQgdGhleSBkZWNpZGUNCiAgICA+IHRvIHRy dXN0Lg0KDQogICAgSSBkb24ndCBrbm93IGEgc2luZ2xlIG9yZGluYXJ5IHBlcnNvbiB3aG8gc2Vs ZWN0ZWQgdGhlaXIgSVNQIGJhc2VkIG9uIHRoZWlyDQogICAgcHJpdmFjeSBzdGFuY2UgZm9yIERO UyBxdWVyaWVzLiBUaGUgcGVvcGxlIEkga25vdyBwaWNrIElTUCBwcmltYXJpbHkgYmFzZWQgb24N CiAgICBhdmFpbGFiaWxpdHksIHByaWNlLCBiYW5kd2lkdGggYW5kIHRlY2hub2xvZ3kuDQoNCiAg ICBJIGFjdHVhbGx5IHRoaW5rIHJhdGhlciBmZXcgcGVvcGxlIHRydXN0IHRoZWlyIElTUCwgYW5k IEkgdGhpbmsgaGlzdG9yeSB3b3VsZA0KICAgIGdpdmUgdGhlbSByaWdodCBzaW5jZSBzbyBtYW55 IElTUHMgaGF2ZSB2aW9sYXRlZCB0aGVpciB1c2VycycgcHJpdmFjeSBhbmQgZGF0YQ0KICAgIHRo cm91Z2ggdGhlIHllYXJzLg0KDQogICAgLS0NCg0KICAgICAgLyBkYW5pZWwuaGF4eC5zZQ0KDQog ICAgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCiAgICBE b2ggbWFpbGluZyBsaXN0DQogICAgRG9oQGlldGYub3JnDQogICAgaHR0cHM6Ly93d3cuaWV0Zi5v cmcvbWFpbG1hbi9saXN0aW5mby9kb2gNCiAgICAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KICAgIFRoaXMgZW1haWwg aXMgZnJvbSBhbiBleHRlcm5hbCBzb3VyY2UuIFBsZWFzZSBkbyBub3Qgb3BlbiBhdHRhY2htZW50 cyBvciBjbGljayBsaW5rcyBmcm9tIGFuIHVua25vd24gb3Igc3VzcGljaW91cyBvcmlnaW4uIFBo aXNoaW5nIGF0dGVtcHRzIGNhbiBiZSByZXBvcnRlZCBieSBzZW5kaW5nIHRoZW0gdG8gcGhpc2hp bmdAc2t5LnVrIGFzIGF0dGFjaG1lbnRzLiBUaGFuayB5b3UNCiAgICAtLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KDQoN Cg0KSW5mb3JtYXRpb24gaW4gdGhpcyBlbWFpbCBpbmNsdWRpbmcgYW55IGF0dGFjaG1lbnRzIG1h eSBiZSBwcml2aWxlZ2VkLCBjb25maWRlbnRpYWwgYW5kIGlzIGludGVuZGVkIGV4Y2x1c2l2ZWx5 IGZvciB0aGUgYWRkcmVzc2VlLiBUaGUgdmlld3MgZXhwcmVzc2VkIG1heSBub3QgYmUgb2ZmaWNp YWwgcG9saWN5LCBidXQgdGhlIHBlcnNvbmFsIHZpZXdzIG9mIHRoZSBvcmlnaW5hdG9yLiBJZiB5 b3UgaGF2ZSByZWNlaXZlZCBpdCBpbiBlcnJvciwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGJ5 IHJldHVybiBlLW1haWwgYW5kIGRlbGV0ZSBpdCBmcm9tIHlvdXIgc3lzdGVtLiBZb3Ugc2hvdWxk IG5vdCByZXByb2R1Y2UsIGRpc3RyaWJ1dGUsIHN0b3JlLCByZXRyYW5zbWl0LCB1c2Ugb3IgZGlz Y2xvc2UgaXRzIGNvbnRlbnRzIHRvIGFueW9uZS4gUGxlYXNlIG5vdGUgd2UgcmVzZXJ2ZSB0aGUg cmlnaHQgdG8gbW9uaXRvciBhbGwgZS1tYWlsIGNvbW11bmljYXRpb24gdGhyb3VnaCBvdXIgaW50 ZXJuYWwgYW5kIGV4dGVybmFsIG5ldHdvcmtzLiBTS1kgYW5kIHRoZSBTS1kgbWFya3MgYXJlIHRy YWRlbWFya3Mgb2YgU2t5IExpbWl0ZWQgYW5kIFNreSBJbnRlcm5hdGlvbmFsIEFHIGFuZCBhcmUg dXNlZCB1bmRlciBsaWNlbmNlLg0KDQpTa3kgVUsgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAy OTA2OTkxKSwgU2t5LUluLUhvbWUgU2VydmljZSBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDIw NjcwNzUpLCBTa3kgU3Vic2NyaWJlcnMgU2VydmljZXMgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5v LiAyMzQwMTUwKSBhbmQgU2t5IENQIExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gOTUxMzI1OSkg YXJlIGRpcmVjdCBvciBpbmRpcmVjdCBzdWJzaWRpYXJpZXMgb2YgU2t5IExpbWl0ZWQgKFJlZ2lz dHJhdGlvbiBOby4gMjI0NzczNSkuIEFsbCBvZiB0aGUgY29tcGFuaWVzIG1lbnRpb25lZCBpbiB0 aGlzIHBhcmFncmFwaCBhcmUgaW5jb3Jwb3JhdGVkIGluIEVuZ2xhbmQgYW5kIFdhbGVzIGFuZCBz aGFyZSB0aGUgc2FtZSByZWdpc3RlcmVkIG9mZmljZSBhdCBHcmFudCBXYXksIElzbGV3b3J0aCwg TWlkZGxlc2V4IFRXNyA1UUQNCg== From nobody Mon Jan 28 02:03:10 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 64EDE128D0C for ; Mon, 28 Jan 2019 02:03:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7ZWZ8CSUt89I for ; Mon, 28 Jan 2019 02:03:05 -0800 (PST) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 939D21295D8 for ; Mon, 28 Jan 2019 02:03:05 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id CA7AFBE2E; Mon, 28 Jan 2019 10:03:03 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dVq4kwZOvQso; Mon, 28 Jan 2019 10:03:01 +0000 (GMT) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 54B46BE2C; Mon, 28 Jan 2019 10:03:01 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1548669781; bh=PjjsS1ZrjXKigO4k5ks4HYMjuAcp67QtwBrS4ZfhyQc=; h=To:Cc:References:From:Subject:Date:In-Reply-To:From; b=VrNMkRCJd42EttwturSycNh/01HbJC31kDBMhmHVS/myGsUGAfZlQChzY3tb9lkPQ rQFNMoExhiVNe1xvKfF0brcirPuhFus92HI+eyI6TUMKjjrC6DypG6TVuniHh+3xQq uUvb5bd7xpQtKPMXsf6KBFMfACdLEDxKz72viw30= To: Daniel Stenberg , Vittorio Bertola Cc: DoH WG References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> <2112742428.56808.1548254385497@appsuite.open-xchange.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <9133209b-ecdf-f900-d669-acbf6b3bd3a1@cs.tcd.ie> Date: Mon, 28 Jan 2019 10:03:00 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.4.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="n3YA76how2D1RJ7HRUI2LFZNnVKTjD2hx" Archived-At: Subject: Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Jan 2019 10:03:08 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --n3YA76how2D1RJ7HRUI2LFZNnVKTjD2hx Content-Type: multipart/mixed; boundary="4mQLStM9mORGLlL6YCYKC4RaTw6oqGvRN"; protected-headers="v1" From: Stephen Farrell To: Daniel Stenberg , Vittorio Bertola Cc: DoH WG Message-ID: <9133209b-ecdf-f900-d669-acbf6b3bd3a1@cs.tcd.ie> Subject: Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> <2112742428.56808.1548254385497@appsuite.open-xchange.com> In-Reply-To: --4mQLStM9mORGLlL6YCYKC4RaTw6oqGvRN Content-Type: multipart/mixed; boundary="------------3B8B35B693D7F86A0313F72A" Content-Language: en-GB This is a multi-part message in MIME format. --------------3B8B35B693D7F86A0313F72A Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On adopting the draft - I think it makes sense that it be adopted somewhere but share concerns mentioned before that it'd be better to take a more holistic view of DNS server discovery so am not sure if the DoH WG is the right venue. Even if DoT discovery by probing port 853 is possible, in some networks 853 is blocked, so some DoT servers are on 443 and hence need to be discovered. Later on, I'd not be surprised if someone wants a way to do and discover DNS over QUIC. So while the RAD RR proposed here may be the right answer, I think that should emerge for a discussion that's broader than just DoH. (Apologies if that happened and was completed at the driu discussion, but even if so, re-doing that discussion more formally/openly would seem to be needed.) Meanwhile, I got tempted into the discussion by the exchange below... Cheers, S. On 28/01/2019 08:05, Daniel Stenberg wrote: > On Wed, 23 Jan 2019, Vittorio Bertola wrote: >=20 >> This could be true for you and me, but average users have no idea of >> what the DNS is - they only make one choice, they pick an *ISP* that >> they decide to trust. >=20 > I don't know a single ordinary person who selected their ISP based on > their privacy stance for DNS queries. The people I know pick ISP > primarily based on availability, price, bandwidth and technology. I do know a handful of people who select their ISP based on their perception of the overall tech/privacy attitude of the ISP. But yes, that's v. rare afaik. A similar thing is true wrt browser selection though - I know a few people who pick and choose for various reasons, but IIUC most do not, they just take what their OS provides. > I actually think rather few people trust their ISP, and I think history= > would give them right since so many ISPs have violated their users' > privacy and data through the years. >=20 I suspect that differs from place to place in the world to some extent. I think it's true that people where I'm from (.ie) used to have a fairly high level of confidence that the then-encumbent telco wasn't going to try abuse their data for profit. (There were other downsides to dealing with a govt-owned badly-run telco, but that wasn't one of them;-) That hasn't entirely gone despite a number of ownership changes, but it does seem fair to say that that confidence has been eroded quite a bit here - that company is now just one among a bunch of similar entities, mostly picked for price etc as you note above. My conclusion is that people do not select their DNS recursive in any meaningful sense. Cheers, S. --------------3B8B35B693D7F86A0313F72A Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5tDJTdGVwaGVuIEZhcnJlbGwgKDIwMTcp IDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJCZQmAAUL CQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1yw aps8HGUNhLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG +48od+Xn7qg6LT7GrHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXk kTFaSGYJj3yIP4R6IgwBYGMzDXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRr pZtXB1XQc23ZZmrlTkl2HaThL6w3YKdiTi1NbuMeOxZqtXcUshII45sANm4HuWNT iRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS3MmGgVS4ZoX8+VaPGpXdQVFy BMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml3OEuIQiP2ehRt/HV LMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi2/Jrsz6M zh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6 TzKjGjruq8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxIkBHAQQAQgABgUCWj1SoAAK CRAvPIc2gF+NovMcCACVZPo1cQa3D+vWaIo0ZyinO/MgtD2gHysoj1T0Qvq05//L ZXmhh578bJANvdl2g/HFhhwl/5HKIfWcyipQhmJklp/dsleKcNnn4B18T75RHY0G +po3ILq7evbiOjUH+xqApti1aCxi1GocsPghaLfsxmtXKMG4Xu7XhDTv66GOrqZf Y7+0ekJjD9Dza1t5NE/JR/VZA4B8PWR8Glb0+8C9rkjD0VZ5ekJdHPDGcJmFh8Z+ q25LDoI8Fgt1uKSowvoVnsQO5MFv/y6bXArtj1uB4hAL4JiOFgHlFdrW0MlFpvYm ziW4K9JHTD8KAfDbrb3e2W97ZDpROuYfE/lTbYOWiQI9BBMBCAAnBQJaPVAyAhsD BQkJlCYABQsJCAcCBhUICQoLAgQWAgMBAh4BAheAAAoJEFqy+vF7Fyvq0mkP/ius gsf6Z4/Tu+vHzBbl5i6oKI8ZieH8JfEgXx4ut9t7l3hBGC2r7DpR5A8zLMpEhGIK gFcHagksFkfLEE/FmWDfd1MysQafxBYrHaI27P2tkxfI5JYV6247TV39pQ93kGds tsjIrmh/zEJCVczoofxtz72BDt51H2Z8tN28F/YVHnbaGDwFEEzWKYpze87y/f36 ogcdGO6LDEEEIA6Ee0dGxleuKlLS4UDTt0zjo6L8TyiyPHp9C3+UfnP8837Zp3Fh KstIBd+vWgPdHFg2G5aDIYUvrj9UJBvVgaN/RnkwE+dab2OBSg5jkr141JLQvzdZ 4mOUXn5D9Y6AH6tvj0+ubYMV6j35L1/ZXncuXPVYiylcmDp/6f2WYcT3gx9CPUYA cLMjQV4vX2W8z4uEPyMlIJuGsLf7KhvLL8BQ6zlncT6eONfUUX9UJUCzqI5rqL5c b5jWGHeKvbLWRyQnlq5PXQxJTwYRm71rJTgzejc33LE6Nqg/Q25Dgwwsv+f+7i73 gB5loc80Fef+FV9VFGalFe0Yq8m0UASmkYRh7MH5ssoibpeWk+SGfBjOV4tnsAwR yjYLpAzxA8HeDcmlLeypGEDmsQ/iUvXoGaKOYX4Ieg8T/PCAplsqnJUOq8hbkgOC 98gLZfiltkNG8YhQpoZIHj6SxmBRSc3K99CvanuOiQIzBBABCAAdFiEEfhcKBFyE z0YOK3mgEO952f2DUxIFAlu3JJsACgkQEO952f2DUxJ4qRAAmbjiO3WTAeBCB4ME p2N2+XQCMTTFURDGuJnqU/+X//fhhPRq4V/OxgisKFKlBcAS2hsECvg6HDVSz4Fl 74fk/y+botG4/CjMLdKPB9fgh5zz72i3q0hWDixt50NKBv8IIVWOyYgZxDU/vcks lMEnqbFgJX+CfdALpvAM4WjuQP0UMcKNE3xd+EdDhD1xjK3Tq4XfWob9q6aBZgL2 B4IaADCIeDDE1hv0agnSJmMJE7Bti8tNxCCxVRbZtOaxVHXdRUoOx2XTaxFXupxV hbpHRrdFrwq51f6e3bkfkNEZ3fzYpnlbynJ2zL++JO8P3Pq/S6UKEFjEB50i8YgK WuFvGUsQ+YiDgiZU4saqxSBWbfYn3lY6MSSTg8RnXbFIMG3CFImqYk1uhaV+bDjc p0htjzM2F98g7c3o7sWx0bGarId4uhOmpj7JJVQ+lu7Jby6Ocj8n//7qF1Nn11Cw QlCVaeAq5Y5DmZrnww9I3zzOWWyqFkAVCM3GqeRLMvplD6/+O+5FF7XoHzQB47nk OyZtawy/9gssPWZKLv4qHLYS0wGGCiNbCsYy90s3pfeafM0kSxxjIvEz21KT6LJI /awu2ErQFWCkDMFJ1p/97MjPrQ/6d4cPO140V/wyfuWaBiTVqa9mgnb2zn6fYfDH JEvl1UzIx3JCae25tty1+qtnS0i0LlN0ZXBoZW4gRmFycmVsbCA8c3RlcGhlbkB0 b2xlcmFudG5ldHdvcmtzLmNvbT6JAj0EEwEIACcFAlo9UVoCGwMFCQmUJgAFCwkI BwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+o7HBAAxHAdFkBGZ9gJK8w7 NUYS9C6enGYtAYoKH5G3Bn3YScjErNfQtHYb53KwBQpVSOv1HcN8hbQ8mLTgn9lt zNwNSuv0XxIswi807HRSIZ4vYDiS5VKV1YkLYK5bLY5O4alVdzqM+AZQqkuHBu63 6n+C0ED6UwLhVBFfSNvBQVAdoq6gvr+IE8rCIKTMNGwNcgVPbF+YxP7UZM6p7s2a 5MIqGw7URSfaqfuztibXGOBLFbSwLGqHSSnOXBfEeDrwdZ+ur8cXIIPRIeCTVmeO 8bGgpgBqNQXG9oyGN+TrYAC+4Ahi0UjCk7QGj8tf3xICKoQpYyfceNBZJ/969gV9 tVgvRxUjxUwc9kZbi0c8XYMTq5GCvBIh1D6BOW9QBM2SsNgG3l36+e3+c2LDdyKn 20C1IzGLVDdcCtz42/onQ/e9sMlzFrfLjs5SO2/TnLvp2JtsIQXyb/T5qd0GE5j8 /iwfZR+uVTVVEsUl1a+Yllzt6sdR7RIhhKpKaKzEAk4d0+VHdz7zEkQRRSjbPVoS fy8c/kld9Fi8Buna+ZkKpcwIW+D4XP83pGcl0XUv6AyqwS1LnEt+jv/+PSXskYtU Lzn8Z35iKkSAH/5Nz6GCZk6ORPNv/6+UI92BpUbu/G2tBwK8bPgAg+gJxBx3G7MK W7VRCmM5UrtAK9A3O70VjPyMkHSJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLC LAf/X/9vRTZWtwSXxiBCA54a6hg9IvW0mvPUqgXfvrhtOk0IFucLKrTXK8J/NcmU 6ulxOovVbQ+Bin6gtHeCmSa/W523g/NXCOuFTnS/MyVibNL4+RCFwqGysl++Cm+L nj1MmasE9kO+CNdervx8APfxV7D6OYrG4eGag+LdFR6VpJn6tRT0/WvyT8l+Oqiq gdhXHv+0MvkkD9TX5LlJW4VB/yRvWkkmL5N5c5zYh+NcfTPhQ5S9dOorVzrm65d6 Itn0937Ennau7s7fiFdA0BHjWqEAFLsBIXQfCFjjKjdsKA4xlSiX7X7ElmPYpWa5 wwTQ66dL0anMd9y1DJCMOHe4gYkCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9 g1MSBQJbtyScAAoJEBDvedn9g1MSY7sP+gKR0rFU1g+GtB+hSdtwPRbacvml2eL2 Jc5Eq37J9hAqxHyt5V0If7s8IyVA2GXgdfwULBWbXGDUDiUkh20OPQRUS8G9Sf8A WRuG25q5C8ZzWygykL88RKXJZDFtA49CeqO5Bq5syBhq4QfiSTffQHIp3h0boPGU hSBEUQpooMXYQClNARQ+z/uRzR5bUi9wxdXNnxTn9ia4ASlaBPvUYTGY1jW2HrRR SwpI12+UaWsvc3jJtQ8X0kxgJ7jsFF1uqquIZ5eflQv+PHHg2RJSy37u0UFGb+OK ZEkzlmbPokKCYhzBR5PcD6sgdlaJNcidmto9u1oV6yZT8J2W4CTuUclgxt6f3lZq ZeVLnNnbHyKUdeypwLlqYISulfnMhZ3A6Bgpf2BtjL6KJbFtPBYmYdxI+HZyY49u U2ZHhRu+CSQ1y7zGKSX0gRp5hE7+A4XJtsT6lTLhbi9aiZTG1S6zKNhl3qNNzszc r27PrvFiyGhpuYQuzdQl2PMGbOI6Ojif3sab53NO3RLsLOM09wIlr95yKLlkXkUr WcvUJGrw6HKm8j5opXHTwmJOAbDpc6cMDu+ITRu4spdCnQJcE8RkO8tKyaLuh2Gt U5kYSBK97yr5VviX1FK6rY14LLmnE16OPiK2tiVBKy9nGM0DKtY+K9WcoRZ7s/d7 O0bMfzcNPtGLuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiez GPuBHmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9Wf pHTD8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC 6T5MsK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2 D/zE4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFe A7PbTuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ /Vf3vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbpt PEcmoazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKr em5r+oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96 Z22fQ0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYgh x8b7Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQ oqj1gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P /1tF6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8 Wpfdn3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJ gx252HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5 SLjNJIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2 oKjwrIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtA ZAGsokRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIA ypqYo3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoM eDQkd0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS /qmUyXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZ IMhkvMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XO KVc3YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DJ121 -----END PGP PUBLIC KEY BLOCK----- --------------3B8B35B693D7F86A0313F72A-- --4mQLStM9mORGLlL6YCYKC4RaTw6oqGvRN-- --n3YA76how2D1RJ7HRUI2LFZNnVKTjD2hx Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlxO01QACgkQWrL68XsX K+r55BAApBGAlmNfdLsIIkBh9UylcJXABkIbzCVFgtC0IavQOoyVWY06dlXmoRJb wS3F58gna4sL7FDEujuXZpwPQxQ1LGNdO+e86tgYPdRWbC2KUyjZqncWd39gwrBx 8HqvcpjuCw+1kZLkFBZsRxPJhJXfbJ45Mo9WldC2WOA9wN4T5oMzJNOSl5HqPbjw 5sRcDqaWMTsXe5jtDHMhlUVRDBD4l//t9my/XBZ2Rnw/JKCKur3R9JetMHvVZ352 c/74ihQQYSMnf8q/OQ6yFvFbdQUSKWmV7XhVBgG2xucTxeZrBQXz7tnnD8BmpyIN GWj1b0sXR/aShXMw/fOH8sOQjLdvSJ+GrWIJGhoGl2tfd+r81WyZuwUlO9eBid4+ gKWLa0kKagJ0+eUB1YtLRenAkHfKV79u/eTSKAZK1inPFM42aioL1U2sCjFcL5zh Lg/HdKxRck8UZrhQEzUJpzO7Fl6LI9lbSVL9hDeTC9OSPlwfbDSFssjH38KXB/ny fdKV/cDASjnkvkcBe7c02wSA/fAC80MLnP1NH7NG95liYiBkfZFAeQXrWSSfeCEZ 47iKlbTTyGnJ+6VylB0I2k218UDObQ84RRATzmxtJNFX9otqYSWj1DCEC3T3yoDB VIYu9NIkaBwBfni01tUD023XWfHyJKe2BoQtQbpl1R97JSFRlpI= =xSR6 -----END PGP SIGNATURE----- --n3YA76how2D1RJ7HRUI2LFZNnVKTjD2hx-- From nobody Mon Jan 28 02:18:47 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 27351130FFA for ; Mon, 28 Jan 2019 02:18:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=sinodun.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qPod_4EF-0PC for ; Mon, 28 Jan 2019 02:18:44 -0800 (PST) Received: from balrog.mythic-beasts.com (balrog.mythic-beasts.com [IPv6:2a00:1098:0:82:1000:0:2:1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 152611295D8 for ; Mon, 28 Jan 2019 02:18:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sinodun.com ; s=balrog-2018; h=Date:Subject:To:From; bh=OoJRS5c+n9c0rYZsRe0s81lsWb6sdJzWSQ4fWHkXp1w=; b=YmWWQ/+p65h3w4nbFFk2dzFZEH nsq04qL4aKOVbjM5M+mGJU2uL14bNECHkKzJ9zy7xi8NaMCVSG6xOyAe9dWFxEB5s4AwRkwieJar5 sd7Uy91HmCxbbRtZZ3OLNxEjT13SUW92ZPpiuDqnSnFFWJcrA8Z/Fuv/WSXbmulisSS+1X6Viaggq VMb2CP5WvCEAhNlQEh8bcsIwWGInnsfKqGf+NpoRU/JDcE5W0PqgYDtHmyhnsMSwDsynJjBiN8FuU 7fR7bd2/c0CkESyDpuFcUFi8D368C7r/v0jDk2WbAkGfUxY2sCL0SxBJ+WbbNHrrb1KN+0R2sRcZ0 YRRdJsUw==; Received: from [2001:b98:204:102:fff1::f145] (port=55607 helo=[192.168.12.13]) by balrog.mythic-beasts.com with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1go3zy-0006cD-GD for doh@ietf.org; Mon, 28 Jan 2019 10:18:42 +0000 From: "John Dickinson" To: "DoH WG" Date: Mon, 28 Jan 2019 10:18:36 +0000 X-Mailer: MailMate (1.12.4r5594) Message-ID: In-Reply-To: References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> <2112742428.56808.1548254385497@appsuite.open-xchange.com> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_0758387D-0E31-4836-B016-747C82871A67_="; micalg=pgp-sha512; protocol="application/pgp-signature" X-BlackCat-Spam-Score: -21 Archived-At: Subject: Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Jan 2019 10:18:46 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_0758387D-0E31-4836-B016-747C82871A67_= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 28 Jan 2019, at 8:05, Daniel Stenberg wrote: > On Wed, 23 Jan 2019, Vittorio Bertola wrote: > >> This could be true for you and me, but average users have no idea of w= hat the DNS is - they only make one choice, they pick an *ISP* that they = decide to trust. > > I don't know a single ordinary person who selected their ISP based on t= heir privacy stance for DNS queries. The people I know pick ISP primarily= based on availability, price, bandwidth and technology. I imagine that the =E2=80=9Cordinary person=E2=80=9D might well be influe= nced by consumer advice services and reviews in computing literature. The= se groups might well suggest ISPs with good privacy policies. > > I actually think rather few people trust their ISP, and I think history= would give them right since so many ISPs have violated their users' priv= acy and data through the years. I think this depends on where in the world you are. regards John > > -- = > > / daniel.haxx.se > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh John Dickinson https://sinodun.com Sinodun Internet Technologies Ltd. Magdalen Centre Oxford Science Park Robert Robinson Avenue Oxford OX4 4GA U.K. --=_MailMate_0758387D-0E31-4836-B016-747C82871A67_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQJEBAEBCgAuFiEEkBPk5F7sVwWxxZAfLcYUQj0n4iwFAlxO1vwQHGphZEBzaW5v ZHVuLmNvbQAKCRAtxhRCPSfiLPiuEAClnWtBy96kp0+qiofhPQeJtyT038GnfV5r ZZ8O6AEo7I/naayUNQyBa0itksfLs33QFVpeepsCKLpoqE3X8IwH4219PBOT/kxO 4yy3QZmAFhCgHo/14uFwObO4NFfh89q7LCpF6jBnaJLm+VjWlBVgJ5LZYg0TB/vu R9eBtvaxyOoDPjdC4qrYn0Ee4KTzZEr7bVHr6p70OjrvSV9Sf3HwHGEVRhTvPJQL 10VBBdpeJlgk3x1jai+q8cT7YlIWnWQnalmxHLjrKSEBZO0ARDehRVCeYMk9C0AR TYlig5v22MgKiYvcTbjAsoupUVwAL2gp3oyiAlEWX8PAQiY+r+TTkYg+HClfxXnc RqiZpKZv6THvIiHpCZCZwE5pxdekP/T1QJwNj3cXHbl2OM1ax6AnqAxVC86xIUn1 k91jl8vRYukTW0rYrzotuvLQ7c61LrvuawPKadPIpp2UUzxCs0DSNSq2bPPNy6G7 R86spWvwbLejy1Fc8JYkyOzT9jZKvpixEEH+KoA3Kj8jkTBDoG4EL/tUiXHa66Xy 5SmCsK1w4zzIf+iK1zGe7ev0yMDEnUpTZtWLzsozbQeeGsO5r/lzGjUrR66pnfaw 7YtBYRQsm9/+NMUggo6TYHHuxNYCMNRCl0luAupL6f8lXXlF09/wdesfj4PD6OM8 QCj9XmT0tw== =yZer -----END PGP SIGNATURE----- --=_MailMate_0758387D-0E31-4836-B016-747C82871A67_=-- From nobody Tue Jan 29 06:48:56 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E9AB212F295 for ; Tue, 29 Jan 2019 06:48:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.901 X-Spam-Level: X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9oC-YUSt2TCh for ; Tue, 29 Jan 2019 06:48:52 -0800 (PST) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0483312F1AC for ; Tue, 29 Jan 2019 06:48:52 -0800 (PST) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 3A25A2801AD; Tue, 29 Jan 2019 15:48:50 +0100 (CET) Received: by mx4.nic.fr (Postfix, from userid 500) id 341AC2802DF; Tue, 29 Jan 2019 15:48:50 +0100 (CET) Received: from relay01.prive.nic.fr (relay01.prive.nic.fr [IPv6:2001:67c:2218:15::11]) by mx4.nic.fr (Postfix) with ESMTP id 2C8F22801AD; Tue, 29 Jan 2019 15:48:50 +0100 (CET) Received: from b12.nic.fr (b12.users.prive.nic.fr [10.10.86.133]) by relay01.prive.nic.fr (Postfix) with ESMTP id 28952642A7A1; Tue, 29 Jan 2019 15:48:50 +0100 (CET) Received: by b12.nic.fr (Postfix, from userid 1000) id 18F9E4021E; Tue, 29 Jan 2019 15:48:50 +0100 (CET) Date: Tue, 29 Jan 2019 15:48:50 +0100 From: Stephane Bortzmeyer To: Paul Hoffman Cc: DoH WG Message-ID: <20190129144850.rfqb56qp4irggbhz@nic.fr> References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> X-Operating-System: Debian GNU/Linux 9.6 X-Kernel: Linux 4.9.0-8-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: NeoMutt/20170113 (1.7.2) X-Bogosity: No, tests=bogofilter, spamicity=0.000000, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.1.29.142716 Archived-At: Subject: Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Jan 2019 14:48:55 -0000 On Wed, Jan 16, 2019 at 12:25:55AM +0000, Paul Hoffman wrote a message of 121 lines which said: > I did a short presentation on "Associating a DoH Server with a > Resolver" > (https://datatracker.ietf.org/doc/draft-hoffman-resolver-associated-doh/) > at the DNSOP WG. The presentation ended with the question of whether > the draft should be taken up in a WG, and if so, where. I tend to say Yes, because it is an interesting and useful subject. However, I also tend to agree with Stephen Farrell that a general "DNS resolver discovery solution", not limited to DoH, would be a good idea. In the current draft, I have a big concern about the idea of an application (for instance the Web browser) having a specific DNS resolver (section 5 of draft -07), different from the rest of the applications on the same machine. It will be a nightmare to debug DNS issues with such a setup. We cannot prevent people for doing bad choices like this one but we should not condone it in a RFC. IMHO, the correct setup is a shared DoH client, running on the local machine (stubby, systemd-resolve, etc) or on the CPE. [This is a purely technical issue, different for the more political one raised by Bert Hubert.] From nobody Tue Jan 29 06:55:13 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9E1B812D4F0 for ; Tue, 29 Jan 2019 06:55:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.901 X-Spam-Level: X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Agn-3srh9_Sl for ; Tue, 29 Jan 2019 06:55:09 -0800 (PST) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F710126F72 for ; Tue, 29 Jan 2019 06:55:09 -0800 (PST) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id EFA7D2801AD; Tue, 29 Jan 2019 15:55:07 +0100 (CET) Received: by mx4.nic.fr (Postfix, from userid 500) id E9C082802CE; Tue, 29 Jan 2019 15:55:07 +0100 (CET) Received: from relay01.prive.nic.fr (relay01.prive.nic.fr [IPv6:2001:67c:2218:15::11]) by mx4.nic.fr (Postfix) with ESMTP id E24182801AD; Tue, 29 Jan 2019 15:55:07 +0100 (CET) Received: from b12.nic.fr (b12.users.prive.nic.fr [10.10.86.133]) by relay01.prive.nic.fr (Postfix) with ESMTP id DE85B642A7A1; Tue, 29 Jan 2019 15:55:07 +0100 (CET) Received: by b12.nic.fr (Postfix, from userid 1000) id D622F4021E; Tue, 29 Jan 2019 15:55:07 +0100 (CET) Date: Tue, 29 Jan 2019 15:55:07 +0100 From: Stephane Bortzmeyer To: "A. Schulze" Cc: doh@ietf.org Message-ID: <20190129145507.fzwyi6nofywywh6f@nic.fr> References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> <6f2860bd-2a7f-01b5-2ec9-9667d71e3f38@andreasschulze.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <6f2860bd-2a7f-01b5-2ec9-9667d71e3f38@andreasschulze.de> X-Operating-System: Debian GNU/Linux 9.6 X-Kernel: Linux 4.9.0-8-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: NeoMutt/20170113 (1.7.2) X-Bogosity: No, tests=bogofilter, spamicity=0.000000, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.1.29.144816 Archived-At: Subject: Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Jan 2019 14:55:11 -0000 On Wed, Jan 16, 2019 at 07:16:14PM +0100, A. Schulze wrote a message of 45 lines which said: > * https://[2001:db8::53]/ -> Address in [] > * Certificate SAN Entry -> Address without [] > can this work with IPv6? I simply never tried that... works for me (Firefox 60.4.0) and the certificate includes SANs: DNS Name: cloudflare-dns.com DNS Name: *.cloudflare-dns.com DNS Name: one.one.one.one IP Address: 1.1.1.1 IP Address: 1.0.0.1 IP Address: 162.159.132.53 IP Address: 2606:4700:4700::1111 IP Address: 2606:4700:4700::1001 From nobody Tue Jan 29 07:00:25 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 38D5312D84D for ; Tue, 29 Jan 2019 07:00:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ko9hvVKjfpNa for ; Tue, 29 Jan 2019 07:00:20 -0800 (PST) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 899CF126F72 for ; Tue, 29 Jan 2019 07:00:20 -0800 (PST) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-2.pexch112.icann.org (64.78.40.23) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Tue, 29 Jan 2019 07:00:18 -0800 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1367.000; Tue, 29 Jan 2019 07:00:18 -0800 From: Paul Hoffman To: Stephane Bortzmeyer CC: DoH WG Thread-Topic: [Ext] Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh Thread-Index: AQHUt+HBURczai/z9E2ZPYsO01pXOqXG3QmA Date: Tue, 29 Jan 2019 15:00:17 +0000 Message-ID: <2EECA6A4-F6B2-47A7-B247-0461483AB82D@icann.org> References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> <20190129144850.rfqb56qp4irggbhz@nic.fr> In-Reply-To: <20190129144850.rfqb56qp4irggbhz@nic.fr> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: text/plain; charset="us-ascii" Content-ID: <0838F895296C3746A1D67C34C6772ACE@pexch112.icann.org> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Doh] [Ext] Re: Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Jan 2019 15:00:23 -0000 On Jan 29, 2019, at 6:48 AM, Stephane Bortzmeyer wrote: > In the current draft, I have a big concern about the idea of an > application (for instance the Web browser) having a specific DNS > resolver (section 5 of draft -07), different from the rest of the > applications on the same machine. If you have this concern, you need to bring it up with the browser vendors,= not with this WG. I have been informally told that both Firefox and Chrome= have them (but I have not checked). > It will be a nightmare to debug DNS > issues with such a setup. We cannot prevent people for doing bad > choices like this one but we should not condone it in a RFC. You first have to have the discussion of whether or not this is a bad choic= e. There will likely be differing opinions. That is, I suspect that the bro= wser vendors didn't spend the time and effort to put them in just for fun: = they felt a need. I totally understand that this will cause debugging to be= more difficult, but that is true for a lot of things added in modern brows= ers. > IMHO, the > correct setup is a shared DoH client, running on the local machine > (stubby, systemd-resolve, etc) or on the CPE. ...and yet there is no indication that such a thing exists today, nor is pl= anned by any of the OS vendors. (Side note: given how crappy CPE software is consistently shown to be, I am= horrified that you suggest to put anything there in the same message where= you talk about "nightmare to debug".) > [This is a purely technical issue, different for the more political > one raised by Bert Hubert.] It has the same effect, however. If a user is smart enough to have an opini= on like "I trust my {browser|OS} vendor more than my {OS|browser} vendor", = some will pick one and some will pick the other. --Paul Hoffman= From nobody Tue Jan 29 07:06:46 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8697012D84D for ; Tue, 29 Jan 2019 07:06:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.901 X-Spam-Level: X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G87cm_9u3Rgp for ; Tue, 29 Jan 2019 07:06:42 -0800 (PST) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 65B03124C04 for ; Tue, 29 Jan 2019 07:06:42 -0800 (PST) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id E6B5C2801AD; Tue, 29 Jan 2019 16:06:40 +0100 (CET) Received: by mx4.nic.fr (Postfix, from userid 500) id E03D22802CE; Tue, 29 Jan 2019 16:06:40 +0100 (CET) Received: from relay01.prive.nic.fr (relay01.prive.nic.fr [IPv6:2001:67c:2218:15::11]) by mx4.nic.fr (Postfix) with ESMTP id D81D42801AD; Tue, 29 Jan 2019 16:06:40 +0100 (CET) Received: from b12.nic.fr (b12.tech.ipv6.nic.fr [IPv6:2001:67c:1348:7::86:133]) by relay01.prive.nic.fr (Postfix) with ESMTP id D496E642A7A1; Tue, 29 Jan 2019 16:06:40 +0100 (CET) Received: by b12.nic.fr (Postfix, from userid 1000) id CD03C4021E; Tue, 29 Jan 2019 16:06:40 +0100 (CET) Date: Tue, 29 Jan 2019 16:06:40 +0100 From: Stephane Bortzmeyer To: Vittorio Bertola Cc: Daniel Stenberg , DoH WG Message-ID: <20190129150640.aybtqbnndcu5obrq@nic.fr> References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> <2112742428.56808.1548254385497@appsuite.open-xchange.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <2112742428.56808.1548254385497@appsuite.open-xchange.com> X-Operating-System: Debian GNU/Linux 9.6 X-Kernel: Linux 4.9.0-8-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: NeoMutt/20170113 (1.7.2) X-Bogosity: No, tests=bogofilter, spamicity=0.219956, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.1.29.145116 Archived-At: Subject: Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Jan 2019 15:06:44 -0000 On Wed, Jan 23, 2019 at 03:39:45PM +0100, Vittorio Bertola wrote a message of 22 lines which said: > they only make one choice, they pick an *ISP* that they decide to > trust. They pay to get "Internet access" from that company and > expect that company to provide all it takes for "the Internet to > work", including DNS resolution, without them having to do anything; > this has been the default situation for the last 20 years at least. This is not how the Internet works. 20 years ago, may be this was true but, today, users "trust" (not an informed trust) a lot of intermediaries. For instance, if they use Android, a lot of choices are made by Google, not by the ISP. Which means that changes like DoH could be carried by other actors than the user or the ISP. If people buy CPEs with a pre-configured DoH client, they could use DoH even without a specific concern for privacy. > So it's fine if smarter users make changes to this default and pick > a DNS provider different from their connectivity provider, and it's > fine to empower them to do so, but it's not fine to break the way > the Internet normally works for most people, which includes an > automated and effortless mechanism to get the DNS resolution service > from the ISP when connecting to the network. I don't understand this objection. Nobody suggested to deprecate DHCP and its DNS resolver option. From nobody Tue Jan 29 07:07:26 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 95793124C04 for ; Tue, 29 Jan 2019 07:07:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.901 X-Spam-Level: X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UMG0B9mu_PqF for ; Tue, 29 Jan 2019 07:07:23 -0800 (PST) Received: from mx4.nic.fr (mx4.nic.fr [192.134.4.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C500E126F72 for ; Tue, 29 Jan 2019 07:07:22 -0800 (PST) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id E44E72801AD; Tue, 29 Jan 2019 16:07:20 +0100 (CET) Received: by mx4.nic.fr (Postfix, from userid 500) id DDC6E2802CE; Tue, 29 Jan 2019 16:07:20 +0100 (CET) Received: from relay01.prive.nic.fr (relay01.prive.nic.fr [IPv6:2001:67c:2218:15::11]) by mx4.nic.fr (Postfix) with ESMTP id D628A2801AD; Tue, 29 Jan 2019 16:07:20 +0100 (CET) Received: from b12.nic.fr (b12.tech.ipv6.nic.fr [IPv6:2001:67c:1348:7::86:133]) by relay01.prive.nic.fr (Postfix) with ESMTP id D2D05642A7A1; Tue, 29 Jan 2019 16:07:20 +0100 (CET) Received: by b12.nic.fr (Postfix, from userid 1000) id CDA104021E; Tue, 29 Jan 2019 16:07:20 +0100 (CET) Date: Tue, 29 Jan 2019 16:07:20 +0100 From: Stephane Bortzmeyer To: Daniel Stenberg Cc: Vittorio Bertola , DoH WG Message-ID: <20190129150720.pnzhil2kakj5g4fk@nic.fr> References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> <2112742428.56808.1548254385497@appsuite.open-xchange.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Operating-System: Debian GNU/Linux 9.6 X-Kernel: Linux 4.9.0-8-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: NeoMutt/20170113 (1.7.2) X-Bogosity: No, tests=bogofilter, spamicity=0.001674, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.1.29.145716 Archived-At: Subject: Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Jan 2019 15:07:25 -0000 On Mon, Jan 28, 2019 at 09:05:07AM +0100, Daniel Stenberg wrote a message of 22 lines which said: > I actually think rather few people trust their ISP, and I think > history would give them right since so many ISPs have violated their > users' privacy and data through the years. +1 And this is one of the main goals of DoH, after all. From nobody Tue Jan 29 07:13:43 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A687A12426E for ; Tue, 29 Jan 2019 07:13:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.901 X-Spam-Level: X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ASXSkyQ6S2Ek for ; Tue, 29 Jan 2019 07:13:40 -0800 (PST) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CD70F12426A for ; Tue, 29 Jan 2019 07:13:39 -0800 (PST) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 585882801B1; Tue, 29 Jan 2019 16:13:38 +0100 (CET) Received: from relay01.prive.nic.fr (pa-th3.interco.nic.fr [192.134.4.74]) by mx4.nic.fr (Postfix) with ESMTP id 526772801AD; Tue, 29 Jan 2019 16:13:38 +0100 (CET) Received: from b12.nic.fr (b12.tech.ipv6.nic.fr [IPv6:2001:67c:1348:7::86:133]) by relay01.prive.nic.fr (Postfix) with ESMTP id 4E1B8642A7A1; Tue, 29 Jan 2019 16:13:38 +0100 (CET) Received: by b12.nic.fr (Postfix, from userid 1000) id 44FC14021E; Tue, 29 Jan 2019 16:13:38 +0100 (CET) Date: Tue, 29 Jan 2019 16:13:38 +0100 From: Stephane Bortzmeyer To: Paul Hoffman Cc: Stephane Bortzmeyer , DoH WG Message-ID: <20190129151338.o6ge663d7i22674b@nic.fr> References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> <20190129144850.rfqb56qp4irggbhz@nic.fr> <2EECA6A4-F6B2-47A7-B247-0461483AB82D@icann.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <2EECA6A4-F6B2-47A7-B247-0461483AB82D@icann.org> X-Operating-System: Debian GNU/Linux 9.6 X-Kernel: Linux 4.9.0-8-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: NeoMutt/20170113 (1.7.2) Archived-At: Subject: Re: [Doh] [Ext] Re: Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Jan 2019 15:13:42 -0000 On Tue, Jan 29, 2019 at 03:00:17PM +0000, Paul Hoffman wrote a message of 40 lines which said: > > In the current draft, I have a big concern about the idea of an > > application (for instance the Web browser) having a specific DNS > > resolver (section 5 of draft -07), different from the rest of the > > applications on the same machine. > > If you have this concern, you need to bring it up with the browser > vendors, not with this WG. I bring the concern here because the first paragraph of section 5 appears to approve this strategy. > > IMHO, the correct setup is a shared DoH client, running on the > > local machine (stubby, systemd-resolve, etc) or on the CPE. > > ...and yet there is no indication that such a thing exists today, > nor is planned by any of the OS vendors. systemd-resolve seems to be used by several OS (I don't like systemd but this is another issue: the point is that it can be done). > (Side note: given how crappy CPE software is consistently shown to > be, I am horrified that you suggest to put anything there in the > same message where you talk about "nightmare to debug".) Not all CPEs I use a Turris Omnia at home and this is exactly the sort of CPE I had in mind. From nobody Tue Jan 29 07:51:15 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E4F20124B0C for ; Tue, 29 Jan 2019 07:51:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SPyvyOxGbhIZ for ; Tue, 29 Jan 2019 07:51:11 -0800 (PST) Received: from giant.haxx.se (www.haxx.se [IPv6:2a00:1a28:1200:9::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AE9FA128BCC for ; Tue, 29 Jan 2019 07:51:10 -0800 (PST) Received: from giant.haxx.se (mail [127.0.0.1]) by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTPS id x0TFogWv016804 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 29 Jan 2019 16:50:42 +0100 Received: from localhost (dast@localhost) by giant.haxx.se (8.15.2/8.15.2/Submit) with ESMTP id x0TFof0H016760; Tue, 29 Jan 2019 16:50:41 +0100 X-Authentication-Warning: giant.haxx.se: dast owned process doing -bs Date: Tue, 29 Jan 2019 16:50:41 +0100 (CET) From: Daniel Stenberg X-X-Sender: dast@giant.haxx.se To: Stephane Bortzmeyer cc: Paul Hoffman , DoH WG In-Reply-To: <20190129144850.rfqb56qp4irggbhz@nic.fr> Message-ID: References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org> <20190129144850.rfqb56qp4irggbhz@nic.fr> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) X-fromdanielhimself: yes MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset=US-ASCII Archived-At: Subject: Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Jan 2019 15:51:13 -0000 On Tue, 29 Jan 2019, Stephane Bortzmeyer wrote: > I have a big concern about the idea of an application (for instance the Web > browser) having a specific DNS resolver (section 5 of draft -07), different > from the rest of the applications on the same machine. *That* development has been going on since many years already, totally independent of secure DNS, partly due to the lack of proper standard asynch/non-blocking APIs. (I maintain one such library.) A more positive way to look at such independent code is that it allows for better innovation and freedom for applications as they're not held back by (from their point of view) limited system implementations. I don't think we, or anyone else, can stop that trend and I don't think we should try. I think we should be agnostic to where the implementations lie. -- / daniel.haxx.se From nobody Wed Jan 30 07:20:48 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CFC1A130E46 for ; Wed, 30 Jan 2019 07:20:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.641 X-Spam-Level: X-Spam-Status: No, score=-17.641 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.142, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XVnz72r9InME for ; Wed, 30 Jan 2019 07:20:44 -0800 (PST) Received: from mail-yb1-xb31.google.com (mail-yb1-xb31.google.com [IPv6:2607:f8b0:4864:20::b31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F1A41130E11 for ; Wed, 30 Jan 2019 07:20:43 -0800 (PST) Received: by mail-yb1-xb31.google.com with SMTP id x9so9742695ybj.5 for ; Wed, 30 Jan 2019 07:20:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=TgMNNF+lIY24C4P50+DdbaBjrZB8+bx+A4YrcsPfjq0=; b=IVElGnpId+1UveG6ERNaAfi8guuylg4Sha7eDj05fM8l5WXuZwSr1fNfh2pqUQVSIW m5C0vYmc9g/Q6X7C21ep77zOSsF/ZZgKoyrWNo1rTDYiY2kVlJiYCB8CeTIuo6gp/QEY HQ1od2C19fGvPvMbOeSP7Rbo0fKrAJ9F/fDivvrxpYZqNkZhn2XYbw1dRPDaCnZc+Ehj ayVU42/Zt/dshcnH56zyjOFmciXNdtSH3ZBjWp9BIR9xXI6T1oVIIRCnqirqAn4A0hDv KD0YSkdvzKw0V9I71UnuGWBC2NtTaNVEWSoHqdmJ8bdSC2eb2ef+akW/Ree8MLyNHJpw cLag== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=TgMNNF+lIY24C4P50+DdbaBjrZB8+bx+A4YrcsPfjq0=; b=TS5LmXygI+/X4z/8OSrRFUPMcxDrcdtj4+L8eyz98/jmGtVAgpGC67akxAQ35gdIZE pSs0Bzxl5yqHLMOsKV1dZHZWYPINlAFmJm9GrcSkL0znHjg2bS9yr9EMnzxRuPa5m9gH iN/65kHoi+ScPW2hO7xW8/r4Do8uZhKrOAV67hvLly8QmkAKZjIAczf0Dp+G4b8ULq47 jwm0gvpEEyRVwb7SxO07dbyAPnrRI6jy31qGOAhvq3GL50dlMWh1EXbebM72h2rWg6L5 NQR4dJ/Ed/z9mzn2zBhtGIaqfRH8n8DEY+Bpy8yPJPSdlj8QMKDCThTAdncnzDEPlqd7 yo9A== X-Gm-Message-State: AHQUAuYtcJTrmuJexflVhR1wmyr6zyr//h7tR6GoXNCpiYMKJrJFigBN xXIzcuU8fN106MPFbz4oc19rg00h818c9CH8BiIj7HDjmAM= X-Google-Smtp-Source: AHgI3Ia73HhhVhcZy0oa/Ku1R83zjMKXFwCRJjyr/oHw9nMo16QFf0qYVlPK17kqgc5a4e59Fe3cnXUw4NPM62oBruM= X-Received: by 2002:a25:9808:: with SMTP id a8mr4051878ybo.59.1548861642474; Wed, 30 Jan 2019 07:20:42 -0800 (PST) MIME-Version: 1.0 From: Alexander Dupuy Date: Wed, 30 Jan 2019 10:20:31 -0500 Message-ID: To: doh@ietf.org Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="0000000000000d843a0580ae7445" Archived-At: Subject: [Doh] Comments on draft-hoffman-resolver-associated-doh-07 X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Jan 2019 15:20:47 -0000 --0000000000000d843a0580ae7445 Content-Type: multipart/alternative; boundary="0000000000000214080580ae742e" --0000000000000214080580ae742e Content-Type: text/plain; charset="UTF-8" Not to derail the current thread on whether browsers or other applications should use non-system resolvers, but as somebody working on a large public resolver with experimental support for DoH, I have some comments on the draft that a colleague encouraged me to share. In particular, I'm concerned that the two Special Use Domain Names (resolver-associated-doh.arpa and resolver-addresses.arpa) in draft-07 (henceforth just "draft-07 SUDNs") will get SERVFAIL when a forwarding DNS resolver is performing DNSSEC validation, but does not support DoH or the draft-07 SUDNs, even though the DNS resolver that it is forwarding to *does* support DoH and the draft-07 SUDNs. Attempts to resolve the draft-07 SUDNs in this scenario will get SERVFAIL because the IANA Considerations section of draft-07 specifies that IANA MUST NOT delegate the draft-07 SUDNs, and as a result, there will be no proof of insecure delegation for those domains, nor any DNSSEC signatures that would validate any answer other than the provable NXDOMAIN (using NSEC records from the .ARPA zone). In this situation, somewhat like the discarded approach of a special root domain record type, a DNSSEC validating resolver will fail validation of any non-NXDOMAIN response. If the forwarding resolver implements RFC 8198 (Aggressive Use of DNSSEC-Validated Cache), it might well never forward queries for these names at all, instead synthesizing an NXDOMAIN response from those cached .ARPA NSEC records. Perhaps this is intentional, but if so, it is inconsistent, since a non-DNSSEC-validating forwarding DNS resolver in this scenario would pass through queries and responses for the draft-07 SUDNs without any problems. The scenario where a forwarding resolver is performing its own DNSSEC validation is not common, but I know that it exists for some of our clients, and it seems undesirable that they would see a different outcome simply because they are being diligent about DNSSEC validation. If this is not intentional (and the expectation is that any forwarding resolver that wants to control DoH discovery in any way must do so by handling the SUDNs used for this discovery), then another approach is needed, one that doesn't depend on updates to intermediate DNSSEC-validating resolvers. Mandating insecure delegations in the .ARPA zone for those names (or better yet, modifying the SUDNs so that they both would fall under a single insecure delegation from .ARPA) would allow resolvers to create their own responses that would not fail DNSSEC-validation. If there are political reasons (reated to ICANN or IANA) that this can't be mandated for a new subdomain of .ARPA, use of some other TLD might be an option, although it's less desirable. The insecure delegation NS records for the zone with the TXT and A/AAAA records for the local resolver could either point to an AS112 RFC 7534 resolver name like blackhole-[12].iana.org or perhaps better, blackhole.as112.arpa (which could serve a copy of the existing empty.as112.arpa zone file for a new resolver-doh.arpa zone). On the other hand, if it is explicitly desired that DoH discovery should *not* pass through forwarding resolvers, then another approach that will also fail even without DNSSEC validation by the forwarding resolver should be used. I'm not sure what would be best in that case,. Historically, use of queries with CHAOS class that will not transit a resolver is common, and more recently EDNS options seem to be preferred, but neither approach would permit identifying the resolver IP address in use when an application is limited to using gethostbyname() library calls. Using a subdomain of an existing SUDN like localhost might do the trick although there would likely be a lot of variability in how that might or might not work (like the draft-07 SUDNs, it would fail DNSSEC validation, but it would probably still transit some resolvers that only special-case localhost and not resolver-addresses.localhost or similar names). In the end, it might be best to explicitly allow the resolver-addresses to transit (to an insecurely delegated .ARPA domain), but use CHAOS or EDNS to get the resolver's DoH information. -- Alexander Dupuy | Software Engineer | alexdupuy@google.com | +1 646-462-3568 --0000000000000214080580ae742e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Not to derail the current thread on whether browsers or ot= her applications should use non-system resolvers, but as somebody working o= n a large public resolver with experimental support for DoH, I have some co= mments on the draft that a colleague encouraged me to share.

=
In particular, I'm concerned that the two Special Use Domain Names= (resolver-associated-doh.arpa and resolver-addresses.arpa) in draft-07 (he= nceforth just "draft-07 SUDNs") will get SERVFAIL when a forwardi= ng DNS resolver is performing DNSSEC validation, but does not support DoH o= r the draft-07 SUDNs, even though the DNS resolver that it is forwarding to= does support DoH and the draft-07 SUDNs.

A= ttempts to resolve the draft-07 SUDNs in this scenario will get SERVFAIL be= cause the=C2=A0IANA Considerations section of draft-07 specifies that IANA = MUST NOT delegate the draft-07 SUDNs, and as a result, there will be no pro= of of insecure delegation for those domains, nor any DNSSEC signatures that= would validate any answer other than the provable NXDOMAIN (using NSEC rec= ords from the .ARPA zone). In this situation, somewhat like the discarded a= pproach of a special root domain record type, a DNSSEC validating resolver = will fail validation of any non-NXDOMAIN response. If the forwarding resolv= er implements RFC 8198 (Aggressive Use of DNSSEC-Validated Cache), it might= well never forward queries for these names at all, instead synthesizing an= NXDOMAIN response from those cached .ARPA NSEC records.

Perhaps this is intentional, but if so, it is inconsistent, since a = non-DNSSEC-validating forwarding DNS resolver in this scenario would pass t= hrough queries and responses for the draft-07 SUDNs without any problems. T= he scenario where a forwarding resolver is performing its own DNSSEC valida= tion is not common, but I know that it exists for some of our clients, and = it seems undesirable that they would see a different outcome simply because= they are being diligent about DNSSEC validation.

= If this is not intentional (and the expectation is that any forwarding reso= lver that wants to control DoH discovery in any way must do so by handling = the SUDNs used for this discovery), then another approach is needed, one th= at doesn't depend on updates to intermediate DNSSEC-validating resolver= s.

Mandating insecure delegations in the .ARPA zon= e for those names (or better yet, modifying the SUDNs so that they both wou= ld fall under a single insecure delegation from .ARPA) would allow resolver= s to create their own responses that would not fail DNSSEC-validation. If t= here are political reasons (reated to ICANN or IANA) that this can't be= mandated for a new subdomain of .ARPA, use of some other TLD might be an o= ption, although it's less desirable.

The insecure delegation NS records for the zone with the TXT and A/AAAA re= cords for the local resolver could either point to an AS112 RFC 7534 resolv= er name like blackhole-[12].iana.org or per= haps better, blackhole.as112.arpa (which could serve a copy of the existing= empty.as112.arpa zone file for a new resolver-doh.arpa zone).
<= div>
On the other hand, if it is explicitly desired that DoH = discovery should not pass through forwarding resolvers, then another= approach that will also fail even without DNSSEC validation by the forward= ing resolver should be used. I'm not sure what would be best in that ca= se,. Historically, use of queries with CHAOS class that will not transit a = resolver is common, and more recently EDNS options seem to be preferred, bu= t neither approach would permit identifying the resolver IP address in use = when an application is limited to using gethostbyname() library calls. Usin= g a subdomain of an existing SUDN like localhost might do the trick althoug= h there would likely be a lot of variability in how that might or might not= work (like the draft-07 SUDNs, it would fail DNSSEC validation, but it wou= ld probably still transit some resolvers that only special-case localhost a= nd not resolver-addresses.localhost or similar names). In the end, it might= be best to explicitly allow the resolver-addresses to transit (to an insec= urely delegated .ARPA domain), but use CHAOS or EDNS to get the resolver= 9;s DoH information.

--
--0000000000000214080580ae742e-- --0000000000000d843a0580ae7445 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS7QYJKoZIhvcNAQcCoIIS3jCCEtoCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBTMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEajCCA1KgAwIBAgIMBqfxxwevzv6Y5MswMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE4MTEwNDE2NDgzNFoXDTE5MDUw MzE2NDgzNFowJTEjMCEGCSqGSIb3DQEJAQwUYWxleGR1cHV5QGdvb2dsZS5jb20wggEiMA0GCSqG SIb3DQEBAQUAA4IBDwAwggEKAoIBAQC88sh1jeqxLFd5PAjYIckqPhK0QqizHS5N+OVIfcQZPPlO a3r7lpAG43j0+CoD0wPNE6QnKaT1aLosXypxp3iEB7yRM6SgqSe7Xdq1zo9i7f0j1GqmY4HM8ElR YaF1l0NlcYTv2mw5T/z6P4zvsRE6bDaIIQCPCgXkPmsFVD+Ui3ak4wdChU2B1vq9K6zETgIaJ+/a sygS9o9s794RYLXmJbs68kI30f+gGmSfEGBxYpCNlGOBJI9Pb9iXEVVAYI0HYAhlsOuTIeuMNdKM JYSMbL9bEyeParmkhZ+fiugd2LjU+7qHadvNRPVaApj3mGUHgNAMgEsS7ExVIvnFkcxRAgMBAAGj ggFxMIIBbTAfBgNVHREEGDAWgRRhbGV4ZHVwdXlAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIw QAYIKwYBBQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWlt ZWNhMS5jcnQwHQYDVR0OBBYEFIS4VLuBNX/yiD5GRiWlxlDC40PNMB8GA1UdIwQYMBaAFMs4ErDH mcB4koyzIZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0 dHBzOi8vd3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0 dHA6Ly9jcmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAw HQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQCEXNu4KSw8 fZ/jco9Bp5qnEQdUfh+TFB1P8mJqR5wvbT0iEMe3azi6Xp0RzBpeoYSJzEJ1+41I94qDQTw4X2O3 +LgaF++hdXySQxHJIwTA/J4Cuj1vwIXZod95/jVpeWtPBb0AyXhyPqsRSawMCtPsOhujx4DLb1F1 xtVbD17KcOht9DK5xVV1RHLedGjbyDd2KXHrKo+j93jQQZpciwKTC7nBsnidVZtslEdD4TQ+7VeB Yy0YByi3FvMN6Kt7vcZxvAS0bQuehAjbI8A6Ay/Nx9wg+a17wd506BoI9XzlNBRiWjVkNJoGopo2 BdxRBqrd2LpYj50utSP7CtQMHD07MYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UE ChMQR2xvYmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIM Bqfxxwevzv6Y5MswMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCC4xuUSp+0/oW7q fL2JMcrhC9c00NokEairnXU9pCGvyTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3 DQEJBTEPFw0xOTAxMzAxNTIwNDNaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCG SAFlAwQBFjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEB BzALBglghkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAMREqBUIoOt2DJgJbF6R5TS1HjNLK/jjm ZUtIMjz6rRl2gBO3GWnBlnRIXNhyRC5Rt2ZBIrHnikNYvc4lYzN0dGM0pzpsgnzETriHY0VKWBOZ 86D4QeNet1txs93PTTiqxGUamzgxMEVZMiGtr4O74L2RxDRvf0/wofz3YHsINobfLSTKLzTo7I77 XX+AkbJN+ubKN6tToz+VoE8vAL/xJh9SFOXNeeixJsItQQt7eAFPJIHR9w+hcMQlXMwSMEBj+1EZ brqqWfcuYf1WNpQei677FjgzXzn9fVJL0O3zQgvrOLhn47cTpR0v7VUQJiOnCckHzdjrXsPCNUEN OZhciQ== --0000000000000d843a0580ae7445-- From nobody Thu Jan 31 21:12:46 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CFD32131004 for ; Thu, 31 Jan 2019 21:12:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pJMOs8cwh3JK for ; Thu, 31 Jan 2019 21:12:42 -0800 (PST) Received: from gro.dd.org (host2.dlawren-3-gw.cust.sover.net [207.136.201.30]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E213D130DF1 for ; Thu, 31 Jan 2019 21:12:41 -0800 (PST) Received: by gro.dd.org (Postfix, from userid 102) id 1CE578E44C; Fri, 1 Feb 2019 00:12:40 -0500 (EST) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <23635.54600.93966.625783@gro.dd.org> Date: Fri, 1 Feb 2019 00:12:40 -0500 From: Dave Lawrence To: DoH WG Archived-At: Subject: [Doh] Formal Call for Adoption: draft-hoffman-resolver-associated-doh X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 01 Feb 2019 05:12:44 -0000 We've seen significant support for adopting draft-hoffman-resolver-associated-doh as a working group item over the past two weeks. This milestone would standardize a method for learning a DNS-over-HTTPS URI template associated with a recursive resolver, including (1) a description of common situations in which this method is helpful or unhelpful and (2) documentation of the intended interaction with other existing and future DNS transport protocols. If anyone has additional support or objections to raise, please do so in the next week. The chairs plan to evaluate consensus to adopt on February 8th. We plan to interpret adoption of this draft as consensus to add a corresponding milestone to the working group charter. --tale & Ben From nobody Thu Jan 31 21:16:23 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 44A351310D5 for ; Thu, 31 Jan 2019 21:16:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WQGmYrq_N6bk for ; Thu, 31 Jan 2019 21:16:21 -0800 (PST) Received: from gro.dd.org (host2.dlawren-3-gw.cust.sover.net [207.136.201.30]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2CD5A130DF1 for ; Thu, 31 Jan 2019 21:16:21 -0800 (PST) Received: by gro.dd.org (Postfix, from userid 102) id 4D4198E454; Fri, 1 Feb 2019 00:16:20 -0500 (EST) Message-ID: <23635.54820.299668.438155@gro.dd.org> Date: Fri, 1 Feb 2019 00:16:20 -0500 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit From: Dave Lawrence To: DoH WG Archived-At: Subject: [Doh] Working Group Meeting at IETF 104, Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 01 Feb 2019 05:16:22 -0000 We will be asking for a one hour meeting at IETF 104 in Prague to discuss DoH server discovery. Please contact the chairs if you have any other topics that may be of interest for the meeting. The preliminary agenda will be published on 22 February, and the final agenda on 1 March. Be aware, the IETF 104 draft submission cutoff is 23:59 UTC, 11 March. --tale & Ben
Alexa= nder Dupuy=C2=A0|=C2=A0Software Engineer=C2=A0|=C2=A0alexdupuy@google.com= =C2=A0|=C2=A0+1 646-462-3568