From nobody Mon Jul 8 11:37:24 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF0FC1206B5 for ; Mon, 8 Jul 2019 11:37:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4-vVSWCJExxi for ; Mon, 8 Jul 2019 11:37:12 -0700 (PDT) Received: from pigeon.buunabet.com (pigeon.groveronline.com [198.145.19.6]) by ietfa.amsl.com (Postfix) with ESMTP id D257012067F for ; Mon, 8 Jul 2019 11:37:11 -0700 (PDT) Received: by pigeon.buunabet.com (Postfix, from userid 501) id 5DE2160788; Mon, 8 Jul 2019 11:37:11 -0700 (PDT) Received: from [10.248.37.184] (guest-nat.fw1.untrust.pdx1.mozilla.net [63.245.220.200]) (using TLSv1.2 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by pigeon.buunabet.com (Postfix) with ESMTPSA id BD2635FD6F for ; Mon, 8 Jul 2019 11:37:10 -0700 (PDT) References: <65f155e9-81c7-daac-8e77-e366d0f924fb@pmtu.dev> To: doh@ietf.org From: Andy Grover Openpgp: preference=signencrypt Autocrypt: addr=andy@pmtu.dev; keydata= mQENBFz6mPMBCAClDMGqYBeCSE0Q+rU7v0JibtGh+nSZoNTSdXOHUkk3rN7rmJwdjlWsL0aT 2BGsSYBQjuqlculeJAQq6GG8dj7gjkDX8zVvjNPVqZxNd0bRh9DFE5AZrz3TiTIUwNauKWE9 XvVCMn/ZfzEJhehLa7SUs5vgZ6NHaScq4KZByfNsmiu/n+mPRhJOjgIN7fql5u+ElnNHxOP3 Z9vsoQc5pS9YAMKtEvyWgljm4fbZMs6VBDUGJGaLRmALF5VrJ5AJKzbZWZmaXYNqoxdtakT5 PhJuXkqdnrijZw8TJCglQ/z2wiq2HCU2pzq6/l+19yV0m9iegEuPgtAuwqkh4ecsPAbbABEB AAG0IUFuZHkgR3JvdmVyIDxhZ3JvdmVyQG1vemlsbGEuY29tPokBVAQTAQgAPhYhBKVh7hV4 1gY7lZbAkBVqKb2tr6NBBQJc+pjzAhsDBQkDwmcABQsJCAcCBhUKCQgLAgQWAgMBAh4BAheA AAoJEBVqKb2tr6NB7uwH/RIEtXUCpRGCbVO5LyXmlzTCue9djrb8YrvOOyeVzUxA5kIskguB 5DH7X7RuVa1PlsfsG2F40/5/bPS/fjYIUOGxTQdyiXGeVPotDvg4vaC/3zV16gs8YxOgzKgb P7QhFLHkZoITe6gOv4R0QH1qvRkbg9cyyPr5FoIPaLoXDnw4DWxaNBUSsN+fPRI87yUjPO1v kL+OWBOnBsHxNGaHjd/s9WsIUp8RbLbfMEI+xlM8lM+r5ccECkMS/l9NFX+mCMUlRXqTkd49 mWYJWY5zNnLyqbAZcaRGCrFlX/gjDn8p+pXQEdvtbbqy3KMofxrmf73ECSStM0WnOEgWtSFG ycW5AQ0EXPqY8wEIAMY7xc/W7mIt2nyAe9K/5RiuyGaDItuaEbFzfRmxFvISJm3s5LiyyrGA 82o0HQWqoMjPyLd+pGSSxHL5aWCUsj5vt/rV0FCPvC8W3a0bWxHa+sbb0VeAHna18Ozav1Cx RFLW437tqaD8yF5yh1c0aGolCqv2LjMHetm+UmFoQVbSfcJoxpXepJFVDwvrqqlL+5BoQM15 MzCwux/D8RCgNlTXTnlfm6bRvlD5ttgDoyzN7qYwm+RjA9Izhyps39fKzdk8xkgeu/A55C94 KcPuSs4U9ti7WeU+CubDaLB3bxp7KCyjWpX3oS2CxHFnQsBAbzGx8UeH3dXbdni1AjE71wkA EQEAAYkBPAQYAQgAJhYhBKVh7hV41gY7lZbAkBVqKb2tr6NBBQJc+pjzAhsMBQkDwmcAAAoJ EBVqKb2tr6NBP2MH/0g/e3idsu/ajGzRx6CaRd/ZNxG0/p0aYT4iQWUEt0KZVyHKf17OQK2z u3QSGjSR2V1H419U0m5V3HSMQmy5XrGi3ks4f01Cgq2HiYizhwVwqNVfZERY+WavEIr35w/L eJqEI2Cm4PySxbOOuFig6R7GAknL76iKQBlMH8uX7yV9p0JnrI6tn0lm2n4UjW76CJ3Fk6gD wqoDYDQXfIxYtyMD6QUfiSDZ+8KZoCMDYQQsEcDBz0hRI2mHwL1jHkGNMcVOhBZPtUHinFTc EiQKDXQKkBvschbpbcfJI5g82v6Bl5M995ob7wsXy8VN5+usot+bKqQHGYMsBMbqJf+Ci1I= X-Forwarded-Message-Id: <65f155e9-81c7-daac-8e77-e366d0f924fb@pmtu.dev> Message-ID: Date: Mon, 8 Jul 2019 11:37:09 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.2 MIME-Version: 1.0 In-Reply-To: <65f155e9-81c7-daac-8e77-e366d0f924fb@pmtu.dev> Content-Type: text/plain; charset=windows-1252 Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: [Doh] Fwd: [Add] new draft: draft-grover-add-policy-detection-00 X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Jul 2019 18:37:22 -0000 Hi all, FYI from the ADD list, please post there or to the authors with feedback. -------- Forwarded Message -------- Subject: [Add] new draft: draft-grover-add-policy-detection-00 Date: Mon, 8 Jul 2019 11:29:02 -0700 From: Andy Grover To: add@ietf.org Hello all, We've posted an initial draft of draft-grover-add-policy-detection, which proposes a method of identifying if content filtering or other policy is implemented on the local resolver, so applications doing DNS resolution can adjust their behavior. Thanks -- Regards -- Andy -------- Forwarded Message -------- Subject: New Version Notification for draft-grover-add-policy-detection-00.txt Date: Mon, 08 Jul 2019 10:46:45 -0700 From: internet-drafts@ietf.org To: Andy Grover , Peter Saint-Andre A new version of I-D, draft-grover-add-policy-detection-00.txt has been successfully submitted by Peter Saint-Andre and posted to the IETF repository. Name: draft-grover-add-policy-detection Revision: 00 Title: DNS Resolver-Based Policy Detection Domain Document date: 2019-07-08 Group: Individual Submission Pages: 6 URL: https://www.ietf.org/internet-drafts/draft-grover-add-policy-detection-00.txt Status: https://datatracker.ietf.org/doc/draft-grover-add-policy-detection/ Htmlized: https://tools.ietf.org/html/draft-grover-add-policy-detection-00 Htmlized: https://datatracker.ietf.org/doc/html/draft-grover-add-policy-detection Abstract: This document specifies the behavior that is expected from the Domain Name System with regard to DNS queries for the special-use domain name 'TBD.arpa' and designates this domain as a special-use domain name. -- Add mailing list Add@ietf.org https://www.ietf.org/mailman/listinfo/add From nobody Thu Jul 11 07:41:08 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1F29112003F for ; Thu, 11 Jul 2019 07:41:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=wordtothewise.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l0O4UmwbzQFm for ; Thu, 11 Jul 2019 07:41:04 -0700 (PDT) Received: from mail.wordtothewise.com (mail.wordtothewise.com [104.225.223.158]) by ietfa.amsl.com (Postfix) with ESMTP id 48164120026 for ; Thu, 11 Jul 2019 07:41:04 -0700 (PDT) Received: from [192.168.0.88] (unknown [37.228.251.105]) by mail.wordtothewise.com (Postfix) with ESMTPSA id EDB4F9F146 for ; Thu, 11 Jul 2019 07:41:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=wordtothewise.com; s=aardvark; t=1562856063; bh=bqJwYLMaS0tGgKexY1j0xnCaHs6IMYALGuHDq8x6eXw=; h=From:Subject:Date:To:From; b=ccYvxnqnomLFEwr3ei/17l3ZfXaJIBWqXjGfbSuiGGglN+up62ATXYnI0J9cmMvM9 UJkfqUW2z7DbQ/ri+m/mgS7xebhoQXz5alxF3m4zZNkapyHNC4NlUD0MyKMzOKgwY1 T9QZf2IlVfLH6jPUcy++Kv5O+1fVS9W1lNcnFS+8= From: Steve Atkins Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Message-Id: <2AE11373-CB6C-472A-B0FB-62E90FDCC027@wordtothewise.com> Date: Thu, 11 Jul 2019 15:41:00 +0100 To: doh@ietf.org X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: [Doh] ad-hoc DoH / DoT client X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 11 Jul 2019 14:41:07 -0000 I didn't find a particularly convenient way of doing ad-hoc = DNS-over-not-UDP queries, at least not in a way that's user-friendly = enough to give to an end user to help them understand what service = they're seeing. Local proxies and stub resolvers are fine for using a = particular DoX resolver, but not so good as a dig replacement for = sending a query to a resolver and seeing what happens. So https://github.com/wttw/dox is a proof of concept GUI query tool. = It'll build on at least macOS, Windows and various Linuxes and gives an = easy way for an end user to select a resolver, send a query and see the = response. It also has basic support for measuring web content fetch times using = different resolvers, to give some idea of what performance a user might = see - from their location, for the websites they're interested in - if = they choose to use a particular resolver. Share and enjoy. Send feedback, suggestions and/or patches to = steve@wordtothewise.com (or via github issues, if you prefer). Cheers, Steve From nobody Thu Jul 11 08:19:48 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AF84712004E for ; Thu, 11 Jul 2019 08:19:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vL1vBUeCZl_z for ; Thu, 11 Jul 2019 08:19:44 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A73A11200E6 for ; Thu, 11 Jul 2019 08:19:44 -0700 (PDT) Received: from pps.filterd (m0050095.ppops.net [127.0.0.1]) by m0050095.ppops.net-00190b01. (8.16.0.27/8.16.0.27) with SMTP id x6BFCC0S024501 for ; Thu, 11 Jul 2019 16:19:44 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : subject : date : message-id : content-type : mime-version; s=jan2016.eng; bh=f2M8G2qlMlSM1Z3IsPNyXHzn//+Gi64n7Ck8m94T17k=; b=mGm4oq2BjUdmPfvdX2Pth2JpVvDKZDngvD9e6NopcZGMpG8WkW0LgfdnFXeP4hlg06pT zC6u4kgH93xnSvepZ1Aq+WlF4zsuTDpAECyG8sUGAdGE0AXtbxihqZpnm5g8bKBXcTZk 55Tp1q1vcAfwNE2Ke4wvmiSY1qvWvevXh8h0nC/sLgL5+/TcXshtNXisuvkM/XICkUrM BHSxlLrAoSQMxp9nYztu5pnx0VypDncd/A3pYeBnfjlonpu2OPMxAxmow8Jg3wlNvr10 U7g52ldbtyYMWM6QwlrYqGLGcwMrsqKH6nvdNajCOwBI2P+lhAxpa148/iOGoONZ39GL EQ== Received: from prod-mail-ppoint3 (prod-mail-ppoint3.akamai.com [96.6.114.86] (may be forged)) by m0050095.ppops.net-00190b01. with ESMTP id 2tnd5v7v0s-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 11 Jul 2019 16:19:44 +0100 Received: from pps.filterd (prod-mail-ppoint3.akamai.com [127.0.0.1]) by prod-mail-ppoint3.akamai.com (8.16.0.27/8.16.0.27) with SMTP id x6BFHfSV027139 for ; Thu, 11 Jul 2019 11:19:43 -0400 Received: from email.msg.corp.akamai.com ([172.27.27.25]) by prod-mail-ppoint3.akamai.com with ESMTP id 2tnxrrnp8s-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT) for ; Thu, 11 Jul 2019 11:19:42 -0400 Received: from USTX2EX-DAG1MB3.msg.corp.akamai.com (172.27.27.103) by ustx2ex-dag1mb6.msg.corp.akamai.com (172.27.27.107) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Thu, 11 Jul 2019 08:19:42 -0700 Received: from USTX2EX-DAG1MB3.msg.corp.akamai.com ([172.27.27.103]) by ustx2ex-dag1mb3.msg.corp.akamai.com ([172.27.27.103]) with mapi id 15.00.1473.004; Thu, 11 Jul 2019 10:19:42 -0500 From: "Hewitt, Rory" To: "doh@ietf.org" Thread-Topic: Authoritative DNS-over-TLS Operational Considerations Thread-Index: AdU3/ACyE6mH9SFQRL261ujfMhxYrw== Date: Thu, 11 Jul 2019 15:19:41 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.112.121] Content-Type: multipart/alternative; boundary="_000_cff114f2d9cf4d46a4014c3a44d72060ustx2exdag1mb3msgcorpak_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-11_03:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=612 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1907110172 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-11_03:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=659 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1907110172 Archived-At: Subject: [Doh] Authoritative DNS-over-TLS Operational Considerations X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 11 Jul 2019 15:19:47 -0000 --_000_cff114f2d9cf4d46a4014c3a44d72060ustx2exdag1mb3msgcorpak_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Does the DoH WG have any input on whether 'we' should be looking into DoH f= or resolver->authority requests - similar to https://datatracker.ietf.org/d= oc/draft-hal-adot-operational-considerations/? Or does it not really apply,= since we're only interested in client->resolver? Rory --_000_cff114f2d9cf4d46a4014c3a44d72060ustx2exdag1mb3msgcorpak_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Does the DoH WG have any input on whet= her 'we' should be looking into DoH for resolver->authority requests - s= imilar to https://datatracker.ietf.org/doc/draft-hal-adot-operati= onal-considerations/? Or does it not really apply, since we're only int= erested in client->resolver?

 

Rory

 

--_000_cff114f2d9cf4d46a4014c3a44d72060ustx2exdag1mb3msgcorpak_-- From nobody Thu Jul 11 09:20:00 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6424B1203C1 for ; Thu, 11 Jul 2019 09:19:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.979 X-Spam-Level: X-Spam-Status: No, score=-1.979 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Oz16K47x85Fx for ; Thu, 11 Jul 2019 09:19:57 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4C3B2120461 for ; Thu, 11 Jul 2019 09:19:43 -0700 (PDT) Received: from MacBook-Pro.roach.at (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x6BGJaaw080063 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Thu, 11 Jul 2019 11:19:41 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1562861982; bh=PBos5TeGJg4n5tPk9caKdxt31ciFxI0s4ftqCEJnnX0=; h=Subject:To:References:From:Date:In-Reply-To; b=q5Ha/jbk7oJq6UN71kxdfycMY7knSKBZKjXsPjrQFX7jCSINXCjbcKkVgR90UFmlF YI92IxiLs6kbDOccCmzPQYhx/644E+4yiYLil4ULFZ1YQAoqbUxsJEESo1m0lvhKfr bvPrICYFBh1jPtN+cL8epZeajHBquMq70nuRn/xE= X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be MacBook-Pro.roach.at To: Steve Atkins , doh@ietf.org References: <2AE11373-CB6C-472A-B0FB-62E90FDCC027@wordtothewise.com> From: Adam Roach Message-ID: Date: Thu, 11 Jul 2019 11:19:31 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.7.2 MIME-Version: 1.0 In-Reply-To: <2AE11373-CB6C-472A-B0FB-62E90FDCC027@wordtothewise.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US Archived-At: Subject: Re: [Doh] ad-hoc DoH / DoT client X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 11 Jul 2019 16:19:59 -0000 Cool work! Thanks for sharing. On a related note, I believe PowerDNS's "sdig" tool allows you to perform DoH queries from the commandline: https://doc.powerdns.com/authoritative/manpages/sdig.1.html /a On 7/11/19 9:41 AM, Steve Atkins wrote: > I didn't find a particularly convenient way of doing ad-hoc DNS-over-not-UDP queries, at least not in a way that's user-friendly enough to give to an end user to help them understand what service they're seeing. Local proxies and stub resolvers are fine for using a particular DoX resolver, but not so good as a dig replacement for sending a query to a resolver and seeing what happens. > > So https://github.com/wttw/dox is a proof of concept GUI query tool. It'll build on at least macOS, Windows and various Linuxes and gives an easy way for an end user to select a resolver, send a query and see the response. > > It also has basic support for measuring web content fetch times using different resolvers, to give some idea of what performance a user might see - from their location, for the websites they're interested in - if they choose to use a particular resolver. > > Share and enjoy. Send feedback, suggestions and/or patches to steve@wordtothewise.com (or via github issues, if you prefer). > > Cheers, > Steve > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh From nobody Thu Jul 11 09:24:35 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1605A120271 for ; Thu, 11 Jul 2019 09:24:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -16.204 X-Spam-Level: X-Spam-Status: No, score=-16.204 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, PDS_NO_HELO_DNS=1.295, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v2NcRSsYi7FZ for ; Thu, 11 Jul 2019 09:24:32 -0700 (PDT) Received: from mail-io1-xd33.google.com (mail-io1-xd33.google.com [IPv6:2607:f8b0:4864:20::d33]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 525AD120172 for ; Thu, 11 Jul 2019 09:24:32 -0700 (PDT) Received: by mail-io1-xd33.google.com with SMTP id u19so13787318ior.9 for ; Thu, 11 Jul 2019 09:24:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=4NSbDGImgHZfS47awkHo6ykfRNwtaWEgzxvtGOcmgaM=; b=VrQi0DhxdZns0nobBBZYzH/yTIsegWMOjPYXflAjmocEy9vKuGzr2W9Xq+5Z8JktAP SkNYucmK7awPs3yFWs0vWKx9/V/UwRgo+2u1rZNWQ6k5v3SA4mSQKJ/MSCt2V+gLZvPs bKtW1itsoxjYGFBKY3lFsYD6hOTMQczUP8qE6ArzPDiqvYjNyYp0bGCtnayDGvGK9Ea4 9l00241Z0RbEz3p/xCOOFz5xhvoPx735XIM4LO0qC2sNN7Bq6icv8DtYGoxQwvICejwG xk2S9KdjYHDwrd/IEhHPtAB7fgb/ShkNO/jtvhsBeTdut+h4NjSLQhHwF+NjHNcioHDI olDw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=4NSbDGImgHZfS47awkHo6ykfRNwtaWEgzxvtGOcmgaM=; b=dV9BR8n9msAHrIvh1i1y/KrQ4/39gp606Z5UOsKpHYx3t6b71c5at5haN/sqykDXpz r5kmLByrxZinD5zBzIQzrPoG8gBud3DFVydAFuq7IS7a7fJV/czOBk9i1ertUWKsjHdo 1ZvkwpTBERyPlSO+v58L9xxbMWKl7oleY5pl9YEHWBSRTxd7gCF2+8XK7sY3VYHXYSmX I0szaAZsKwQswwV+q0N/y13AMXW5jSWyewvicgn8LKSSiFewwu+cQ6vf7iVK+6Iv7m2z c8+6PQCtFFRbM7WCtrEcP30RdVNmb4PwYRFH6c4x+6Tz0/bcRyIJCWy24iSgmUI7QoPd vfrA== X-Gm-Message-State: APjAAAX7mgzK+pN9HUHVeo+sEyrspZDI5Jwycrc2IcJ3xeOQ4Vz75qep MOrulAxdgESLaBv2CtCE520Omz2Ac9V6i6iXv/lEdQ== X-Google-Smtp-Source: APXvYqzrQGjT7cL5A+3725k6SWE1KAm6QIdctjn+kk4HRmng6D178CiMSoDup7LPacaobRxirZJXd0Ecahn1Q+KPzu4= X-Received: by 2002:a02:ca19:: with SMTP id i25mr5786029jak.6.1562862271389; Thu, 11 Jul 2019 09:24:31 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Ben Schwartz Date: Thu, 11 Jul 2019 12:24:19 -0400 Message-ID: To: "Hewitt, Rory" Cc: "doh@ietf.org" Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="0000000000008b4b5a058d6a3a05" Archived-At: Subject: Re: [Doh] Authoritative DNS-over-TLS Operational Considerations X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 11 Jul 2019 16:24:34 -0000 --0000000000008b4b5a058d6a3a05 Content-Type: multipart/alternative; boundary="000000000000853add058d6a3a0a" --000000000000853add058d6a3a0a Content-Type: text/plain; charset="UTF-8" The DOH charter says: The primary focus of this working group is to develop a mechanism that > provides confidentiality and connectivity between DNS clients (e.g., > operating > system stub resolvers) and recursive resolvers. Thus, while recursive->authoritative connections are not specifically excluded from our discussion, they are not a "primary focus". The DPRIVE working group is (re)chartered to improve privacy between recursive and authoritative servers. If you're interested in discussing DoH in that context, I recommend starting in DPRIVE, and only moving to DOH if there is positive interest and significant required work that is specific to DoH. On Thu, Jul 11, 2019 at 11:19 AM Hewitt, Rory wrote: > Does the DoH WG have any input on whether 'we' should be looking into DoH > for resolver->authority requests - similar to > https://datatracker.ietf.org/doc/draft-hal-adot-operational-considerations/? > Or does it not really apply, since we're only interested in > client->resolver? > > > > Rory > > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --000000000000853add058d6a3a0a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
The DOH charter says:

The primary focus of this working group is to d= evelop a mechanism that
provides confidentiality and connectivity betwee= n DNS clients (e.g., operating
system stub resolvers) and recursive reso= lvers.

Thus, while recursive->authoritat= ive connections are not specifically excluded from our discussion, they are= not a "primary focus".

The DPRIVE worki= ng group is (re)chartered to improve privacy between recursive and authorit= ative servers.=C2=A0 If you're interested in discussing DoH in that con= text, I recommend starting in DPRIVE, and only moving to DOH if there is po= sitive interest and significant required work that is specific to DoH.


On Thu, Jul 11, 2019 at 11:19 AM Hewitt, Rory <rhewitt@akamai.com> wrote:
<= blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-l= eft:1px solid rgb(204,204,204);padding-left:1ex">

Does the DoH WG have any input on whether '= we' should be looking into DoH for resolver->authority requests - si= milar to https://datatracker.ietf.org/doc/draf= t-hal-adot-operational-considerations/? Or does it not really apply, si= nce we're only interested in client->resolver?

=C2=A0

Rory

=C2=A0

_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
--000000000000853add058d6a3a0a-- --0000000000008b4b5a058d6a3a05 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMB/CJK1MgpV83jiIZMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDMxMzA4MjIxOVoXDTE5MDkw OTA4MjIxOVowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCsphkGEsCh0fF4+6Wsi1u40JxI6W6Izew+dLGK4b93LCRAuJ8y g9wSnwGAtk9/23VmtKwBrMaJD5j9SVZpscvLAjrWwADl/THU22uTW0MsUE2fPOPv2s4hE+vMgRmK P2E+xpI6n0gFvn8qrUHO1dm6PJaP5SWa+zdB/Ja1LgMJTpevQqjK4LKjWmHFPR6CplS4RImjGk7U 0I6invTyQnL5p583t5PI7FcM5UyjAqxGEETdAuc7N4IqjNETvPwL0wLIzxPDA5PMqcWPSzg7sBAB LVUQRYNIAJPlVpUdg1IeAjil5BaaWBjEeCLBSGDFX3WaWfMNzQvRZr4i6oJxzV+1AgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFFSy8ovdLNSQc8aqxOgKS7sBOm/UMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQCbQ++Znz6xh85ZlZEN Y/vAF0vn111O0c2houe4LlLQkoQ1QS4fH5EYcBx/393FTq5n08ezWYVtmeQ6W15e34CqjYNop1Vh mihZ+3J6+LL/6YNi91cp5yMFgxOP9aI/Y8IaIWZJAY2e8yHbYSq0z8kka0H6S4VvFjwtRogkWW95 0SStEwo/8viJ02BwpmVj4YIA6Fva1ZbeN2TnUMCAHJAlKWOGlpHxpcdcWckED0XbSY9w6bllMw1T tsbiUwQxDeO++Y8NfS8rieZgfv3RlobKihE8xbIVGRHIq1gup4nXv6XDwHDYyGhafIfUD4Ix00Wk gnODGb+jPwoQlDX0X64qMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMB/CJK1Mg pV83jiIZMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCCyEapQckgQ7jFN9cyyo00G 4DUFk1Qecydz8vxZK7tLejAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTA3MTExNjI0MzFaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAE56iAxNx92pjbISJEY9W8KA1/diqGBQm1vwTMRsj Ofjf9c/TOnR9orOH4mM/vYYiFXSWvXIDLpwvPwhS0BxPhj/gvUlAJufuFvia2trSNjNK+mgUuJM5 mK129EOdVpZfNXb5Qcw0p7oODM76ThXD6tP9qZgxEaPms9IpvnHGW28nnwy2KWn5QWlxBaY/5IVP 15dX+uGEZccLk/9kcGFZ6NHLxoB3ShvpM7PgKFv7TrOJC3H4OU/XeJxdlMO/272Haw0q//dQ4HdE 50oLh56KIuB33jLiL33PY/ujWZqBO6fKRPIHMuKEsJCHyfa+55q2zJCbYnXu5nV15kf4EE35mA== --0000000000008b4b5a058d6a3a05-- From nobody Thu Jul 11 12:47:05 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 781A812008B for ; Thu, 11 Jul 2019 12:47:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ncartron.org header.b=szN2QPzL; dkim=pass (1024-bit key) header.d=ncartron.org header.b=qJAvDiPS Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yAVL2eceMVPT for ; Thu, 11 Jul 2019 12:47:01 -0700 (PDT) Received: from mx1.ncartron.org (mx1.ncartron.org [37.187.16.32]) by ietfa.amsl.com (Postfix) with ESMTP id 1D49812006B for ; Thu, 11 Jul 2019 12:47:00 -0700 (PDT) Received: from localhost (localhost.localdomain [127.0.0.1]) by mx1.ncartron.org (Postfix) with ESMTP id 59E0F426AE; Thu, 11 Jul 2019 21:51:16 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ncartron.org; s=mail; t=1562874676; bh=ROx2g7DbnfbvkikM1HlUhsLG8vCXjnTFOqUtOCyhBZ4=; h=Subject:From:In-Reply-To:Date:Cc:References:To:From; b=szN2QPzL+ghDUMOfOpV9B3kqj1hEbhfOIhok45sFBqtqgVUbQdVE8sXx2GPz7SdDi vRlc+SuoEkmo2FAUz8/7IJpMBCHPRfwc9zMbEao0oR6B3zSt+B5aZNwrW23ZjHwj+s W4oMZdNYgOCHz44VZJbArtdn7BR5PRP3lVvJHVls= X-Virus-Scanned: Debian amavisd-new at mx2.ncartron.org Received: from mx1.ncartron.org ([127.0.0.1]) by localhost (ks.ncartron.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iheL5KLcuJ64; Thu, 11 Jul 2019 21:51:14 +0200 (CEST) Received: from [192.168.42.110] (soucelles.home.ncartron.org [78.200.136.210]) by mx1.ncartron.org (Postfix) with ESMTPSA id 12612425C2; Thu, 11 Jul 2019 21:51:14 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ncartron.org; s=mail; t=1562874674; bh=ROx2g7DbnfbvkikM1HlUhsLG8vCXjnTFOqUtOCyhBZ4=; h=Subject:From:In-Reply-To:Date:Cc:References:To:From; b=qJAvDiPSh7/sc3gO5IMVoFSRL+2SvsfzYJLd9R3m02rErbLHbVval5JGLPSJ6osvq X0A9HdSLlsER7qlKi18Y/shrqOnJQ7dg2im7P/gQseENzOx2tJNtOhDlTwx0cR3AF0 tzZAKlngTSBKIl9sIiyROmL2i/9vO5oHAhRigpB4= Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: Nico Cartron X-Mailer: iPhone Mail (16F203) In-Reply-To: Date: Thu, 11 Jul 2019 21:46:56 +0200 Cc: Steve Atkins , doh@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <229DFB55-C030-463B-A76C-4AB2A43F0F62@ncartron.org> References: <2AE11373-CB6C-472A-B0FB-62E90FDCC027@wordtothewise.com> To: Adam Roach Archived-At: Subject: Re: [Doh] ad-hoc DoH / DoT client X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 11 Jul 2019 19:47:03 -0000 Hi, > On 11 Jul 2019, at 18:19, Adam Roach wrote: >=20 > Cool work! Thanks for sharing. On a related note, I believe PowerDNS's "sd= ig" tool allows you to perform DoH queries from the commandline: https://doc= .powerdns.com/authoritative/manpages/sdig.1.html Yes it does.=20 And CZ.NIC's kdig supports querying over DoT.=20 --=20 Nico= From nobody Fri Jul 12 21:57:42 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD06F12001E for ; Fri, 12 Jul 2019 21:57:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.453 X-Spam-Level: X-Spam-Status: No, score=-0.453 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, PDS_NO_HELO_DNS=1.295, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Wit-_yYA7N5o for ; Fri, 12 Jul 2019 21:57:38 -0700 (PDT) Received: from mail-lf1-x141.google.com (mail-lf1-x141.google.com [IPv6:2a00:1450:4864:20::141]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 874F7120019 for ; Fri, 12 Jul 2019 21:57:38 -0700 (PDT) Received: by mail-lf1-x141.google.com with SMTP id 62so2874958lfa.8 for ; Fri, 12 Jul 2019 21:57:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=RMnyy4rE1L2anJW1zUZ/Aq2UUI5dvU/T+az3kme2t+E=; b=sOaU3BMtkwcq/FgOPSjMAxzyDShbAwnxPlrrZ8+0xa+HQe0cUhW7qL1C0l7ixYetnE cPDFF9dkHdSqXm/qjFufTeTmQYETnjtA9MTv0fsUTQtaBw1mK1vrKPl980nqVPqpg+// Rp5oC+J6gd74CGRZh2P7NRwcdh5E7SVPbti5x0DxQ2Qe5SH0eX4O0HmEc5jhnwRVozuF NviCSVKCPpx2LJLArTpiqx5poW5zIvwoUYDQKmzzI6aqwcjdQ8tTBmOBIy7P/9aACLpo 6nORgeU4A7ZYSd3X8TOiZV7+p7/iPATHBZo7AKu9hvb9dYVMsXVuyDH/htAUOaTF2u1b gQSw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=RMnyy4rE1L2anJW1zUZ/Aq2UUI5dvU/T+az3kme2t+E=; b=pgEea5t9kdvY6YlsDpzn9KntjpgIKPvPGIk0uKE1Fx8E8YI6oJ+W5ayJcF8f7TZlS0 ++JiHPDsFZ7z800D2JbWa4cLxMuBNx1v8WNLFbp6H8q5FO5++Eg3wO3Oy+NfSgXcE9w1 5r0/SW6wGGBPF1NE6Yi2Z4wqXOrfjvxPbh6l7hIASIGeuRA7zMnw5d0C5RzVxBqncqn+ tovVnhD+/dElITBPIhjXQ/S939eK05PRxpwzAFV6NmnfD1pWImyL8UNCXmxrtU4cOcFI DrjK6wiJB+SEhKcxjf93AY9W8lwuwNlu02yvcr1J6HStd/p1335sKxxFShXVEoRvR7iG mTFw== X-Gm-Message-State: APjAAAXbWMWpMO1nTx7ozTzw/PSPg5QxFwF5zABoto2BQNSAZnaSPTxB taNnTbT4DGE3WFnGOK9m3+LRQqifUfJ8P4tORjR3og== X-Google-Smtp-Source: APXvYqx09cumyVPQZYO1cG9tfa6FztYnc6ICK8tU+fwEWHuJv63i4lwTroMziGtGfWpwh8f8BqlTtL3z/HTY2YIhhP8= X-Received: by 2002:ac2:4351:: with SMTP id o17mr6412583lfl.100.1562993855905; Fri, 12 Jul 2019 21:57:35 -0700 (PDT) MIME-Version: 1.0 From: Sebastiaan Deckers Date: Sat, 13 Jul 2019 12:57:24 +0800 Message-ID: To: doh@ietf.org Content-Type: multipart/alternative; boundary="000000000000914471058d88ddff" Archived-At: Subject: [Doh] DoH (& Do53) latency, load testing tool X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 13 Jul 2019 04:57:41 -0000 --000000000000914471058d88ddff Content-Type: text/plain; charset="UTF-8" Nice to see new DoH tools shared on this list. I recently made Bulldohzer, a little CLI tool to do latency measurements & load testing against multiple DoH & Do53 servers at once. It's written for Node.js and I like to launch it with npx or docker, but local installs also work fine. $ npx bulldohzer --help $ docker run commonshost/bulldohzer --help Code: https://github.com/commonshost/bulldohzer RTFM: https://help.commons.host/bulldohzer/cli/#usage Blog: https://dev.to/commonshost/bulldohzer--dns--doh-performance-testing-50fm Suggestions welcome. -Seb --000000000000914471058d88ddff Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Nice to see new DoH= tools shared on this list. I recently made Bulldohzer, a little CLI tool t= o do latency measurements & load testing against multiple DoH & Do5= 3 servers at once. It's written for Node.js and I like to launch it wit= h npx or docker, but local installs also work fine.
<= div>
$ npx bulldohzer --help

$ docke= r run commonshost/bulldohzer --help

Code:
h= ttps://github.com/commonshost/bulldohzer

RTFM:=

Blog:

Suggestions welcome.

-Seb
--000000000000914471058d88ddff-- From nobody Fri Jul 12 22:51:22 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A587612008F for ; Fri, 12 Jul 2019 22:51:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.704 X-Spam-Level: X-Spam-Status: No, score=-0.704 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, PDS_NO_HELO_DNS=1.295, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=technitium.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pSNyarmYEMYI for ; Fri, 12 Jul 2019 22:51:18 -0700 (PDT) Received: from mail-wm1-x333.google.com (mail-wm1-x333.google.com [IPv6:2a00:1450:4864:20::333]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A9FB4120019 for ; Fri, 12 Jul 2019 22:51:16 -0700 (PDT) Received: by mail-wm1-x333.google.com with SMTP id s3so10612466wms.2 for ; Fri, 12 Jul 2019 22:51:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=technitium.com; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=uEHPKoO8VrDCBifNMdRHJ27DYEj15wKHBhKnsZZB+vM=; b=K7vb5IjFJ66vMsEfuFDlE1tdDZdKgaTaxtz8ef5DwQ7NfTCcGXJZLHTFje0UbB6cPa 2GTWyopbHERoB7XD1XAvfIXAsQTjZTtIr9s96Z4BuUP8jX4/OHsGFCjk8f4rNJ9oPxy1 Y7Dc6vT5ZB1RulyTf6wMTk2L5eRIOywWyhPZo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=uEHPKoO8VrDCBifNMdRHJ27DYEj15wKHBhKnsZZB+vM=; b=fudOBa+8PFQC2rNgHw+nn3CIK8BpAgKyee4nnu4mIUs1+aWNRGXRhoNFluElxAfm0Y C/AZ20719Nu2CAzHXloGWeWMZLeD6fjTX8a8fyMLhVUeYCp4A/I5oz7R3o8k21HfLj/k gy+WcZh/UCnFFei36wz+8TEGCmvs9GKxO7t5JQP546ZaY3FAzXTJZiSeyV2Wj+ybQxmY oAsuh3x8nihnwJXbzc0mXrAcMvQSaKKRbXFijzM55nN7T5nxIVMzR5mgpzHOep1qEGHx E42348lG3ishvwKGWIQZfayFQSgih1xbsI6SWvfLwxHaGDmoy01ZWF/Oln2LzuyIlQkC F8FQ== X-Gm-Message-State: APjAAAW9oyHVeRCuMYv2mb11ABDZyvxSNhUd7LWXWoMEDZu6owTjFUmL /ff8AgLNMZ2nnb6+kPsPsqQVhIIceXEfTYJ1JkJCfNli X-Google-Smtp-Source: APXvYqy24kpLmMV7g7ANYvWoc/1RaKIZp5LWAXT4liti8WYLGo+VPbs9e+vm30MiIadxxaHqN081hLZnXe5mCFpAibo= X-Received: by 2002:a05:600c:240e:: with SMTP id 14mr12609705wmp.30.1562997075268; Fri, 12 Jul 2019 22:51:15 -0700 (PDT) MIME-Version: 1.0 References: <2AE11373-CB6C-472A-B0FB-62E90FDCC027@wordtothewise.com> In-Reply-To: <2AE11373-CB6C-472A-B0FB-62E90FDCC027@wordtothewise.com> From: Shreyas Zare Date: Sat, 13 Jul 2019 11:21:03 +0530 Message-ID: To: Steve Atkins Cc: doh@ietf.org Content-Type: multipart/alternative; boundary="00000000000074e985058d899d5b" Archived-At: Subject: Re: [Doh] ad-hoc DoH / DoT client X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 13 Jul 2019 05:51:20 -0000 --00000000000074e985058d899d5b Content-Type: text/plain; charset="UTF-8" Here is another open source cross platform locally hostable web app[1] for anyone who is interested that supports all DNS transport protocols including DoT & DoH (both wire and json) with IPv6 support and a built in recursive resolver. [1] https://github.com/TechnitiumSoftware/net.dnsclient *Shreyas Zare* Technitium --00000000000074e985058d899d5b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Here is another open source cross platform locally ho= stable web app[1] for anyone who is interested that supports all DNS transp= ort protocols including DoT & DoH (both wire and json) with IPv6 suppor= t and a built in recursive resolver.

[1] https://github.com/TechnitiumSoftware/net.dnsclient

Shreyas Zare
Technitium
--00000000000074e985058d899d5b-- From nobody Thu Jul 18 21:27:02 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E56F1120043 for ; Thu, 18 Jul 2019 21:26:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=iseclab.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xbNbAzxHyERE for ; Thu, 18 Jul 2019 21:26:47 -0700 (PDT) Received: from mail-pf1-x42b.google.com (mail-pf1-x42b.google.com [IPv6:2607:f8b0:4864:20::42b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1AA701200FB for ; Thu, 18 Jul 2019 21:26:45 -0700 (PDT) Received: by mail-pf1-x42b.google.com with SMTP id i189so13588202pfg.10 for ; Thu, 18 Jul 2019 21:26:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iseclab.org; s=mail; h=content-transfer-encoding:from:mime-version:subject:message-id:date :to:cc; bh=ScT9VsQbnaqDjxsE7l363Hj6HEtOvfUL5w4Oq9JNXsk=; b=OhjD20I+mf5gx87Z5f/PbAvJ/z3GQvabOkZsPpcgVR/2/ThvjUHI2xjiMIlwNl79Oq TW5R+oFLtLhspNR5f0I9RiYVQHW4FXi3ESHNJlo0zA0BpiFWfJML3+BO9vpb7rTSmj0m v5S0eKBzW+i7qtbgkcvVomZF/arByuskXMKCX4y2I0uzAUtZ7NU8nGb1pfhfa1jv+Btq 8nnHsVmNqoZ2xmZlpBc+Ke4BiHcxHmRh5h7qaT+i5HUbmMpxsfwv6sCDF1T00pchanou 5pa6gks92nk+w9YmQ47kwmeF6+RnScbTb+T6yA7DDYMcG4d2TGJnzbMJdEvwO+MZEbEv Cp3Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:content-transfer-encoding:from:mime-version :subject:message-id:date:to:cc; bh=ScT9VsQbnaqDjxsE7l363Hj6HEtOvfUL5w4Oq9JNXsk=; b=iOS8gfJxs1aq7/iXZXrMeLE6VfnQw31nXZs/Ihpnj6gBeLYLhXaXUUfmun8uzTweXA FLaIv8qgtubFYCVxVPpJ3dEVMMBFOYd3A9/hF0oRaHRcy2GEShmPByV4dnLN3rcK7Mfj cJCetKu7N5ZhDQTxKdwQZW9xP3hZ6lhAh6Xjl8OfsSOqu7q5WvwMZzF847eFc6lz6TbB Ep8mZuUx8/ymJ6bTX6mD7KR4pg6e+xBSGJL4L0zSsa6bC7Sd2EFEwzB6TbVQ0XWgtyIh 9twPGPmEhGjDY+wiaFSCj7A7SB0PNiPfbF8ara/4sD9RBQ0D/7nGR/ue0EU9qKgNce6z RxzA== X-Gm-Message-State: APjAAAVVXFS5az80BiYRWM/gOWhDATCi/yz2l4JhMWaEhUT1YFY8f75d KbqFAkGiGfekPFweET0Bqdn2og== X-Google-Smtp-Source: APXvYqxTBaCz80lDt8Z/rdGjc8G5U9SJUgrIMc6rSzb7LQjAuY32NG/Z0c5Ef/HFaCbxT2hnsS6VpA== X-Received: by 2002:a17:90a:9488:: with SMTP id s8mr56686761pjo.2.1563510404305; Thu, 18 Jul 2019 21:26:44 -0700 (PDT) Received: from [192.168.201.137] ([103.23.203.130]) by smtp.gmail.com with ESMTPSA id g8sm14941328pgk.1.2019.07.18.21.26.42 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 18 Jul 2019 21:26:43 -0700 (PDT) Content-Transfer-Encoding: 7bit Content-Type: multipart/alternative; boundary=Apple-Mail-3C754381-F640-4A14-A8C3-6A4C1CC9341B From: Kevin Borgolte Mime-Version: 1.0 (1.0) Message-Id: <402781F4-33D8-4FD4-8087-FDCEFFF2D549@iseclab.org> Date: Fri, 19 Jul 2019 12:26:40 +0800 To: add@ietf.org, doh@ietf.org, dnsop@ietf.org, dprive@ietf.org Cc: feamster@uchicago.edu, pschmitt@cs.princeton.edu, jordanah@princeton.edu, ahounsel@cs.princeton.edu X-Mailer: iPad Mail (16F203) Archived-At: Subject: [Doh] Do53 vs DoT vs DoH Page Load Performance Study at ANRW X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Jul 2019 04:26:49 -0000 --Apple-Mail-3C754381-F640-4A14-A8C3-6A4C1CC9341B Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi all, we recently did a study on Do53/DoT/DoH performance on webpage load times in= Firefox, which we wanted to share with you. Austin Hounsel will give a talk= about our work at ANRW on Monday. Paul Schmitt and I will also be around (m= yself only Monday afternoon and Tuesday) if you=E2=80=99d like to chat about= it in person. The extended pre-print of our paper is available here: https:= //arxiv.org/abs/1907.08089 We looked at the effect of Do53/DoT/DoH on page load times because we figure= d they will be a more interesting measure than simple DNS resolution times. W= e also looked at simulated mobile connections (4G, lossy 4G, and 3G). We fou= nd that DoH is on par with Do53/DoT if your Internet connection is good, and= worse if it is not. The potential for DoH seems to be largely push. ADD can= also make sense, or at least an extended/updated OS API would. We think there are two opportunities to improve Do53 and DoT: better wire fo= rmat caching and partial responses combined with multiple questions. Part of= the improvements and issues we discovered we later found out (by talking to= some of you) were mentioned in early working group drafts, but they never m= ade it into published RFCs or mailing list posts (which is where we looked i= nitially). We hope you can help and explain the thoughts that went into thes= e decisions 15 to 20 years ago. Maybe it even makes sense to revisit the ide= as from back then combined with our ideas, considering how the Internet has e= volved? We=E2=80=98d appreciate any feedback on our work. Please also feel free to r= each out to us directly (in person or by email) if you have any insight or f= eedback you=E2=80=99d prefer not to post to the list. Best, Kevin P.S. Please excuse the posting to multiple lists, but all seem relevant. --Apple-Mail-3C754381-F640-4A14-A8C3-6A4C1CC9341B Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Hi all,

we recently did a study on Do53/DoT/DoH= performance on webpage load times in Firefox, which we wanted to share with= you. Austin Houns= el will give a talk about our work at ANRW on Monday. Paul Schmitt and I wil= l also be around (myself only Monday afternoon and Tuesday) if you=E2=80=99d= like to chat about it in person. The extended pre-print of our paper i= s available here: https://= arxiv.org/abs/1907.08089

We looked at th= e effect of Do53/DoT/DoH on page load times because we figured they will be a= more interesting measure than simple DNS resolution times. We also looked a= t simulated mobile connections (4G, lossy 4G, and 3G). We found that DoH is o= n par with Do53/DoT if your Internet connection is good, and worse if it is n= ot. The potential for DoH seems to be largely push. ADD can also make sense,= or at least an extended/updated OS API would.

We t= hink there are two opportunities to improve Do53 and DoT: better wire format= caching and partial responses combined with multiple questions. Part of the= improvements and issues we discovered we later found out (by talking to som= e of you) were mentioned in early working group drafts, but they never made i= t into published RFCs or mailing list posts (which is where we looked initia= lly). We hope you can help and explain the thoughts that went into these dec= isions 15 to 20 years ago. Maybe it even makes sense to revisit the ideas fr= om back then combined with our ideas, considering how the Internet has evolv= ed?

We=E2=80=98d appreciate any feedback on ou= r work. Please also feel free to reach out to us directly (in person or by e= mail) if you have any insight or feedback you=E2=80=99d prefer not to post t= o the list.

Best,
Kevin
<= div>
P.S. Please excuse the posting to multiple lists, but all= seem relevant.
= --Apple-Mail-3C754381-F640-4A14-A8C3-6A4C1CC9341B-- From nobody Thu Jul 18 22:11:03 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C527F1200FB; Thu, 18 Jul 2019 22:10:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ezbShB4T79Vh; Thu, 18 Jul 2019 22:10:47 -0700 (PDT) Received: from mail-io1-xd41.google.com (mail-io1-xd41.google.com [IPv6:2607:f8b0:4864:20::d41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 04C2D1200D7; Thu, 18 Jul 2019 22:10:47 -0700 (PDT) Received: by mail-io1-xd41.google.com with SMTP id e20so25514136iob.9; Thu, 18 Jul 2019 22:10:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=CSY1YQBkkq6H5Mqa4MdnQ7Usv0j4t0JcuYg7CEHMiJQ=; b=shEXJgfu8WkCQigzFfhrafHLgUhQzS/HJ92343a/jv6UTYEl72cFa/+vOrs2LLq+yE fO446MoCQukeRW8Jb0G3D38FiqnGV+y5Ep4sRle4GbqOlNv69YZLBV2f/D2aU64AvZS5 YzZS5sI9T7RUrr49nvM8iHnOXENCeQDnr02T35zTFbIgLuADMmH8lLQBOtQFcK5W3H4o UA0OBWHpUj+YGvFutax8VDcujLQZbKEQT9x+g/Ed3oo1nLDVJjWuxYwDN9JX+0ulvuHK 7HUTgX2RXyIN5V57NnJeVS0FnVTC7RB9bXn3j9vsAgCoHNVgbsb7Sh8FMIt3qEjFYnIR eg0Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=CSY1YQBkkq6H5Mqa4MdnQ7Usv0j4t0JcuYg7CEHMiJQ=; b=R7Gu0Z3CIAQq/N0fxP99nAY5ASXkoI21jbcOeK1VVKSa+senTX8zAGViwq+iOk2Wdx d3cblcgTb6OreBhOMIbTkNCKPYM1fHZffQ1RARe1I9ZVxYO8WFLDPEQxnOXxgBoFq++g q3wRdNbTBFMcjiPZSnZfr409jglRq9jDVwyNNqKHzA0wf7NjcyLDFdqFLzk61ogiy6wG axTyee99G0vknV8gPaCDE9NontDit0E/5Un0Hu7Xu2yqeTUGQvu0wpJ27xyF2rxQbRQr l114gB2XAxrMlz8x/zocklHhBAKpkgoNeBcRoXtfCeqfiBv5Ngjj/8XGzGuRm8jK0w0q JqSg== X-Gm-Message-State: APjAAAXxBjaOmpUhJc9G8x3PDhkGM48VVEVONr8zjNC09BAHgTABow1n 8w4mMUlMWGLc1znZXOziFD76gLGuJN/dPHnewqI= X-Google-Smtp-Source: APXvYqw+9R+nI8XfhWAr2ZckccS7OO4V6B+LKTVnXZDm1JuqCI4Iwx8tTXoeUd6BeYnlJ7u2zjfaNxoSxubBtpxSAaw= X-Received: by 2002:a02:1087:: with SMTP id 129mr55454362jay.131.1563513046131; Thu, 18 Jul 2019 22:10:46 -0700 (PDT) MIME-Version: 1.0 References: <402781F4-33D8-4FD4-8087-FDCEFFF2D549@iseclab.org> In-Reply-To: <402781F4-33D8-4FD4-8087-FDCEFFF2D549@iseclab.org> From: Rob Sayre Date: Thu, 18 Jul 2019 22:10:34 -0700 Message-ID: To: Kevin Borgolte Cc: add@ietf.org, doh@ietf.org, dnsop WG , dprive@ietf.org, jordanah@princeton.edu, pschmitt@cs.princeton.edu, ahounsel@cs.princeton.edu, feamster@uchicago.edu Content-Type: multipart/alternative; boundary="000000000000b76903058e01bf50" Archived-At: Subject: Re: [Doh] [DNSOP] Do53 vs DoT vs DoH Page Load Performance Study at ANRW X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Jul 2019 05:10:49 -0000 --000000000000b76903058e01bf50 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Jul 18, 2019 at 9:27 PM Kevin Borgolte wrote: > We=E2=80=98d appreciate any feedback on our work. Please also feel free t= o reach > out to us directly (in person or by email) if you have any insight or > feedback you=E2=80=99d prefer not to post to the list. > This paper looks interesting. Is the software used in the paper published? Or, at least, is the test page set published? I haven't read the whole thing yet, but it seems like the page set would be relevant if the paper tests page load time. thanks, Rob --000000000000b76903058e01bf50 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Thu, Jul 18, 2019 at 9:27 PM Kevin Bor= golte <kevin@iseclab.org> wr= ote:
We=E2=80=98d a= ppreciate any feedback on our work. Please also feel free to reach out to u= s directly (in person or by email) if you have any insight or feedback you= =E2=80=99d prefer not to post to the list.

This paper looks interesting. Is the software used = in the paper published?

Or, at least, is the test = page set published? I haven't read the whole thing yet, but it seems li= ke the page set would be relevant if the paper tests page load time.
<= div>
thanks,
Rob
--000000000000b76903058e01bf50-- From nobody Thu Jul 18 22:42:52 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F0BF71205F5 for ; Thu, 18 Jul 2019 22:42:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.594 X-Spam-Level: * X-Spam-Status: No, score=1.594 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DRUGS_ERECTILE=1.994, GB_PHARMACY=1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URI_HEX=0.1, URI_NOVOWEL=0.5] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=iseclab.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cLCC8BymJnOx for ; Thu, 18 Jul 2019 22:42:36 -0700 (PDT) Received: from mail-pl1-x62c.google.com (mail-pl1-x62c.google.com [IPv6:2607:f8b0:4864:20::62c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5EEF712013F for ; Thu, 18 Jul 2019 22:42:31 -0700 (PDT) Received: by mail-pl1-x62c.google.com with SMTP id 4so8087276pld.10 for ; Thu, 18 Jul 2019 22:42:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iseclab.org; s=mail; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=oT1vYbJHA7eaM3O0BJjvf8OIUVUsjSlbeMghXKKbsyM=; b=hS01SjC5qeJ6dNegaphsZZxOikVc4AYjqRuvOVHB+y+aX+xiNq0vdIxQ/H/sL4HDsZ iK3rkgoPyADIBcqyKj45MGx0Q/pUJnwTyNyg69Oqishv4yKLeFQhJU2gqSzGtGeyG9Zy pDEsNU1Xz/XREVe+uxlKFPD/9VxAuSpH3l2LN7jmvwaaRJQJUu4btSt3Zy8newVLVujk D6BuZ3MUaiETBww9UBOJsgs5BZBj6uIzP5IhiRDvrboccxgjXJruuGP0QMpT8UySgwLk MC2DzbYdwRtKqqZmeQch3rw5m8WdDB1rhaRNVUctuUrHEog1cFUXDBta63bzRDy8I/PS +mGg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=oT1vYbJHA7eaM3O0BJjvf8OIUVUsjSlbeMghXKKbsyM=; b=g434d3mVKIh2GE1KVI4Gn5ERsy0ovgqzItnD/IIeKifzWEOpC3+QOoretjeGiDDXnH 9sbxEEj+3WSuppuW2Y/E0YYkHFg9n4ywwRn5jMd23fEnh6+sfEI9E69xr/hDGqVfltQo W4c3x8YDzo5l5b+WFfhUoENCUvRkq63QGwZ1w3r8Yghjgkqj56rJ3Ynnk33b2Nz9vWzo zzlZydJwfL42ISVBubmt6NnOS+NmoOiQifPN+jBpN2TX4QBYuk2LZHAVHcVAVheMOcnW TOtvFrAHLhLVn2aLMt3BUAq9FJPzLlwsy560aRU4fmOMT4G+VVp7BYoyaTY8KYCnKqTr gpVA== X-Gm-Message-State: APjAAAVWUq5PdOFiseg96PFJx8WXRMbl7b69Pp6HaM81+RfsKp8b5aQp Mi5aaE2Yo/iMx8iItcusIBf+EA== X-Google-Smtp-Source: APXvYqxDgg/7NhS4samC3BiFT+VQYMw1HCa8v+Px6N/xPcPhWUlsAkyiGrooeXoQvhlFoh1gg0aVJw== X-Received: by 2002:a17:902:4643:: with SMTP id o61mr26881481pld.101.1563514950776; Thu, 18 Jul 2019 22:42:30 -0700 (PDT) Received: from [192.168.205.139] ([103.23.203.130]) by smtp.gmail.com with ESMTPSA id m4sm56270283pff.108.2019.07.18.22.42.27 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 18 Jul 2019 22:42:30 -0700 (PDT) From: Kevin Borgolte Message-Id: <267CBE74-9DC5-40D8-A61F-7C566644A1CB@iseclab.org> Content-Type: multipart/mixed; boundary="Apple-Mail=_62BF672C-84D7-448F-BD03-FB7010D05E14" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 19 Jul 2019 13:42:26 +0800 In-Reply-To: Cc: add@ietf.org, DoH WG , dnsop WG , jordanah@princeton.edu, pschmitt@cs.princeton.edu, ahounsel@cs.princeton.edu, feamster@uchicago.edu, dns-privacy@ietf.org To: Rob Sayre References: <402781F4-33D8-4FD4-8087-FDCEFFF2D549@iseclab.org> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Doh] [DNSOP] Do53 vs DoT vs DoH Page Load Performance Study at ANRW X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Jul 2019 05:42:47 -0000 --Apple-Mail=_62BF672C-84D7-448F-BD03-FB7010D05E14 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > This paper looks interesting. Is the software used in the paper = published? Thanks! The code isn=E2=80=99t open source yet, but we will make it = public alongside the Docker setup we used for running it. Not sure when = that is going to happen exactly though. > Or, at least, is the test page set published? I haven't read the whole = thing yet, but it seems like the page set would be relevant if the paper = tests page load time. The list of websites is attached. It is extracted from the top 1,000 and = 99,000 to 100,000 of a Tranco list. Best, Kevin --Apple-Mail=_62BF672C-84D7-448F-BD03-FB7010D05E14 Content-Disposition: attachment; filename=tranco_combined.txt Content-Type: text/plain; x-unix-mode=0644; name="tranco_combined.txt" Content-Transfer-Encoding: 7bit google.com facebook.com youtube.com netflix.com microsoft.com twitter.com wikipedia.org baidu.com yahoo.com linkedin.com instagram.com amazon.com qq.com apple.com live.com msn.com pinterest.com tmall.com bing.com taobao.com reddit.com adobe.com doubleclick.net blogspot.com sohu.com yelp.com wordpress.com vk.com vimeo.com youtu.be yandex.ru weibo.com jd.com amazonaws.com sina.com.cn github.com google-analytics.com ebay.com googletagmanager.com goo.gl googleusercontent.com 360.cn t.co tumblr.com paypal.com godaddy.com nytimes.com mozilla.org bit.ly twitch.tv imgur.com dailymotion.com people.com yahoo.co.jp wordpress.org imdb.com microsoftonline.com fandom.com mail.ru dropbox.com flickr.com pornhub.com quizlet.com fbcdn.net porn555.com office.com buzzfeed.com go.com aliexpress.com skype.com soundcloud.com google.co.in nflxso.net stackexchange.com gravatar.com bbc.co.uk nih.gov stackoverflow.com cnn.com w3.org csdn.net livejasmin.com alipay.com sourceforge.net icloud.com whatsapp.com apache.org googlesyndication.com akamaiedge.net naver.com theguardian.com urbandictionary.com google.com.hk europa.eu digicert.com tribunnews.com ytimg.com amazon.co.jp bilibili.com slideshare.net weebly.com googleadservices.com msedge.net xvideos.com xinhuanet.com archive.org google.de forbes.com bbc.com office365.com medium.com google.co.jp aol.com 163.com spotify.com php.net booking.com craigslist.org xhamster.com glassdoor.com thehill.com hulu.com amazon.co.uk ok.ru nflximg.com tinyurl.com oracle.com virginmedia.com google.com.br quora.com issuu.com google.co.uk cnet.com hp.com creativecommons.org wikimedia.org google.ru gizmodo.com amazon.de google.fr bustle.com github.io akadns.net dailymail.co.uk goodreads.com cnbc.com reuters.com deviantart.com legacy.com wsj.com giphy.com washingtonpost.com wixsite.com wikia.com gnu.org espn.com wix.com softonic.com walmart.com google.it hao123.com addthis.com whitepages.com exosrv.com huffingtonpost.com researchgate.net mit.edu etsy.com amazon.in blogger.com soso.com weather.com bloomberg.com popads.net wp.com google.es sciencedirect.com ranker.com wellsfargo.com harvard.edu facebook.net gamespot.com opera.com so.com ibm.com instructure.com t-online.de windows.net medicalnewstoday.com babytree.com ggpht.com intuit.com stanford.edu zhihu.com rakuten.co.jp cloudflare.com scribd.com tripadvisor.com pixnet.net theverge.com wired.com tianya.cn telegraph.co.uk aparat.com livejournal.com usatoday.com okezone.com youku.com myspace.com force.com eventbrite.com thestartmagazine.com businessinsider.com scorecardresearch.com douban.com googlevideo.com detik.com gfycat.com chase.com alibaba.com groupon.com fc2.com xnxx.com samsung.com mysql.com nasa.gov zillow.com roblox.com slate.com twimg.com ettoday.net indeed.com hugedomains.com salesforce.com surveymonkey.com eonline.com lifehacker.com nicovideo.jp iqiyi.com macromedia.com wiley.com buzzfeednews.com google.cn cpanel.net politico.com outlook.com crashlytics.com mediafire.com free.fr googletagservices.com npr.org indiatimes.com apple-dns.net onlinesbi.com timeanddate.com adnxs.com discordapp.com vice.com google.ca debian.org google.com.mx windows.com list-manage.com cdc.gov time.com cnblogs.com gmw.cn wikihow.com youtube-nocookie.com foxnews.com w3schools.com nature.com steamcommunity.com drudgereport.com ebay.de cpanel.com duckduckgo.com amazon-adsystem.com webmd.com ebay.co.uk jimdo.com steampowered.com ask.com who.int globo.com latimes.com ted.com marriott.com springer.com bankofamerica.com statcounter.com aaplimg.com panda.tv cloudfront.net uol.com.br kickstarter.com behance.net newyorker.com cheatsheet.com avito.ru irs.gov bongacams.com techcrunch.com state.gov about.com dell.com myshopify.com daum.net mailchimp.com android.com openload.co taboola.com 1688.com ca.gov un.org variety.com themeforest.net adp.com shopify.com shutterstock.com berkeley.edu bukalapak.com independent.co.uk windowsupdate.com vox.com demdex.net digg.com zhanqi.tv google.com.tr patch.com sogou.com www.gov.uk 45eijvhgj2.com ups.com ifeng.com slack.com chaturbate.com 2mdn.net patreon.com moatads.com cbsnews.com pinimg.com nationalgeographic.com onenote.net mega.nz dolohen.com china.com.cn ikea.com akamaihd.net google.com.tw txxx.com ntp.org rubiconproject.com adsrvr.org snopes.com feedburner.com amazon.fr gmail.com squarespace.com engadget.com wattpad.com cornell.edu mashable.com zendesk.com washington.edu canva.com app-measurement.com otvfoco.com.br wetransfer.com trello.com caijing.com.cn rollingstone.com ea.com thekitchn.com intel.com cdninstagram.com bandcamp.com academia.edu cisco.com mercadolivre.com.br msftncsi.com stumbleupon.com loc.gov redd.it usps.com messenger.com typepad.com hola.org douyu.com disqus.com nginx.org addtoany.com huanqiu.com ietf.org savefrom.net twentytwowords.com rt.com google.pl pbs.org criteo.com bet9ja.com metropcs.mobi theroot.com pki.goog flipkart.com pubmatic.com sfgate.com box.com usnews.com udemy.com eastday.com sitemaps.org advertising.com airbnb.com sharepoint.com akamai.net aliyun.com zoom.us line.me amazon.it openx.net freepik.com webs.com spanishdict.com tokopedia.com 247sports.com mapquest.com spankbang.com outbrain.com playstation.com deadspin.com kotaku.com gvt2.com cambridge.org americanexpress.com ft.com washingtonexaminer.com google.com.au change.org rlcdn.com arstechnica.com thoughtcatalog.com bluekai.com casalemedia.com amzn.to talktalk.co.uk yts.am speedtest.net evernote.com launchpad.net jianshu.com jalopnik.com avclub.com symantec.com arnebrachhold.de accuweather.com akamaized.net bestbuy.com finance101.com xfinity.com thepiratebay.org dailycaller.com wiktionary.org polygon.com umich.edu radio.com snapchat.com digikala.com onlinevideoconverter.com bodelen.com photobucket.com britannica.com att.com princeton.edu mathtag.com chinadaily.com.cn nickiswift.com pixabay.com expedia.com tripod.com economist.com psychologytoday.com gamepedia.com cbs.com meetup.com noaa.gov psu.edu google.co.kr mozilla.com wunderground.com verizon.com rambler.ru amazon.ca cobalten.com theatlantic.com fidelity.com kayak.com youm7.com fb.com dropcatch.com nike.com google.co.id geocities.com cbssports.com google.com.ar everesttech.net agkn.com google.com.sa bitly.com google.co.th mercurynews.com target.com quantserve.com bidswitch.net google.com.eg guardian.co.uk doi.org elsevier.com cbc.ca rednet.cn amazon.es columbia.edu us.com ameblo.jp didna.io sun.com oath.com 49oa3o49b6.com hilton.com nbcnews.com youporn.com southwest.com okta.com healthline.com jquery.com blackboard.com city-data.com myway.com ign.com mentalfloss.com khanacademy.org worldlifestyle.com tapad.com primevideo.com abs-cbn.com nginx.com doublepimp.com fedex.com kompas.com chicagotribune.com getpocket.com usda.gov constantcontact.com lifewire.com abc.net.au ed.gov prnewswire.com zdnet.com whitehouse.gov howtogeek.com univision.com avast.com fda.gov ieee.org grammarly.com livedoor.jp prezi.com genius.com beian.gov.cn ebay-kleinanzeigen.de ndtv.com hubspot.com hotstar.com hollywoodreporter.com adsafeprotected.com spiegel.de kinopoisk.ru westernjournal.com tandfonline.com krxd.net sbnation.com eepurl.com consumerreports.org refinery29.com yale.edu nba.com breitbart.com kakaku.com gearbest.com upenn.edu amazon.cn axs.com newrelic.com zoho.com fortune.com teamviewer.com wisc.edu fiverr.com sciencemag.org marketwatch.com thechive.com elpais.com zol.com.cn altervista.org example.com thefreedictionary.com instructables.com akismet.com liputan6.com mirror.co.uk trend-chaser.com google.com.ua yy.com sindonews.com bet365.com asus.com whatsapp.net redfin.com comicbook.com ajc.com hotels.com adform.net unsplash.com yimg.com oreilly.com patria.org.ve ucla.edu allegro.pl imore.com fastcompany.com capitalone.com merriam-webster.com history.com sagepub.com epicgames.com toutiao.com 1337x.to mayoclinic.org uproxx.com redhat.com knowledgedish.com ampproject.org 9gag.com livedoor.com utexas.edu tistory.com nvidia.com fastly.net uci.edu epa.gov youdao.com foursquare.com reverso.net pixiv.net unesco.org startribune.com nypost.com umn.edu purdue.edu weather.gov vanityfair.com chegg.com nbcsports.com wordreference.com gamersky.com op.gg browsergames2018.com androidcentral.com comodoca.com rutracker.org barnesandnoble.com asos.com oup.com thesaurus.com turn.com varzesh3.com parallels.com over-blog.com t.me ladbible.com gofundme.com theonion.com jezebel.com 3dmgame.com domainmarket.com ow.ly msftconnecttest.com homedepot.com ox.ac.uk opendns.com dribbble.com nps.gov denverpost.com icepop.com webex.com howstuffworks.com news-speaker.com tmz.com blogspot.co.uk orange.fr indiegogo.com jrj.com.cn criteo.net uk.com zippyshare.com hatenablog.com news.com.au businesswire.com overstock.com goo.ne.jp sciencedaily.com autodesk.com adsymptotic.com google.org crunchyroll.com jf71qh5v14.com tomshardware.com plesk.com lenovo.com cafemom.com exelator.com k618.cn namecheap.com feedly.com worldbank.org knowyourmeme.com iso.org chron.com bbb.org cbslocal.com ning.com drugs.com redtube.com cmu.edu uptodown.com doubleverify.com namnak.com citi.com cam.ac.uk discogs.com united.com entrepreneur.com crwdcntrl.net apnews.com qz.com zend.com imrworldwide.com express.co.uk chouftv.ma bootstrapcdn.com custhelp.com icio.us getawesome1.com dictionary.com uiuc.edu python.org dmm.co.jp ubuntu.com dotomi.com washingtontimes.com uchicago.edu upwork.com hbr.org ltn.com.tw vitals.com bizjournals.com sarkariresult.com edmunds.com inc.com imageshack.us ouo.io spotxchange.com uclaut.net rxlist.com verisign.com investopedia.com momoshop.com.tw w55c.net answers.com mlb.com joomla.org nyu.edu telegram.org cdstm.cn namu.wiki arxiv.org newsweek.com ultimate-guitar.com nydailynews.com theepochtimes.com mi.com nesn.com 17ok.com newegg.com netscape.com ria.ru rfihub.com shmoop.com illinois.edu elegantthemes.com scientificamerican.com hatena.ne.jp coursera.org angelfire.com mercadolibre.com.ar nflxvideo.net baike.com leagueoflegends.com trustpilot.com thekrazycouponlady.com dkn.tv exoclick.com usc.edu 51.la thoughtco.com cricbuzz.com sex.com dw.com dmv.org userapi.com bitbucket.org audible.com rarbg.to mookie1.com smh.com.au creditkarma.com ufl.edu pcworld.com livescience.com egy.best fb.me jstor.org hexun.com costco.com boston.com google.gr 51sole.com seattletimes.com spectrum.net networkadvertising.org nextdoor.com secureserver.net ssl-images-amazon.com qualtrics.com cctv.com envato.com foodnetwork.com kissanime.ru hdfcbank.com earthlink.net www.gov.cn sakura.ne.jp atlassian.net battle.net thesun.co.uk nutaku.net sciencealert.com umd.edu huawei.com atabencot.net onet.pl ustream.tv omtrdc.net truste.com rottentomatoes.com sputniknews.com brainly.com techradar.com letsencrypt.org repubblica.it clicktripz.com flightaware.com nbc.com serving-sys.com 3lift.com humparsi.com usgs.gov norton.com hclips.com duke.edu 1rx.io media.net bmj.com superuser.com ancestry.com rediff.com house.gov streamable.com aboutads.info cars.com vkontakte.ru ebates.com siteadvisor.com mixpanel.com alexa.com ny.gov marca.com liveleak.com hupu.com java.com vmware.com kaskus.co.id lemonde.fr hgtv.com miamiherald.com si.edu nr-data.net leboncoin.fr gstatic.com about.me wish.com cnki.net 2345.com msu.edu grid.id beenverified.com macrumors.com google.nl contextweb.com myanimelist.net littlethings.com kooora.com businessinsider.de ftc.gov oecd.org bodybuilding.com clickondetroit.com statista.com investing.com pastebin.com autotrader.com olx.ua study.com indoxxi.bz unc.edu hm.com directv.com staples.com alicdn.com wpengine.com mercadolibre.com.mx pexels.com walgreens.com google.com.pk searchencrypt.com live.net last.fm kohls.com ucsd.edu manoramaonline.com usaa.com smzdm.com visualstudio.com lowes.com ensonhaber.com phys.org pandora.com pikabu.ru mailchi.mp typeform.com souq.com slashdot.org lijit.com sky.com trulia.com nexusmods.com livestream.com digitaltrends.com nist.gov vogue.com umblr.com xbox.com bobshideout.com aarp.org friv.com chinanews.com nikkei.com google.co.ve nasdaq.com allaboutcookies.org wp.pl epicurious.com setn.com phpbb.com findagrave.com gotowebinar.com hellomagazine.com mercari.com sprint.com cvs.com bonappetit.com squareup.com tutorialspoint.com sitescout.com yourtango.com taleo.net termometropolitico.it themeisle.com okdiario.com yadi.sk pandorarecovery.com fiberone.com speechanddebate.org debugin.com com-repair-windows.live 51meishu.com breakit.se carjob.com.cn mondosonoro.com leicester.gov.uk lerepairedesmotards.com outfittrends.com campus-party.org netnevesht.com bankofgreece.gr hdreporn.com cafergot.company atipt.com puporn.com ayurvedapsychologie.at fenqile.com hplusmagazine.com niederschlagsradar.de coxnewsweb.com weddingwire.ca pbsa-benin.org islamquest.net yandexlauncher.com marqueerewards.com nibis.de zgswcn.com mirohost.net stationcaster.com nextjump.com symantecstore.com viahero.com repairpartsplus.com viagragenrdf.com vansirc.net gonola.com gzt.com do303.com mimer.com myvodafone.com.au erectionjaen.com guitarsite.com trt15.jus.br mybb2.ru anderson.edu mcdlv.net rebath.com timesofmoney.com fishforums.net blackfilm.com datafactory.la wiesbadener-kurier.de forabodiesonly.com bradfordtaxinstitute.com onemorething.nl cdn-image.com theexpertta.com kidshelpphone.ca jerseys.net.in kanbilibili.com pepabo.com games-4-free.com yavideoad.ru itsecure.co.in yournextshoes.com wolflair.com clkmein.com persona.ly powerelectronics.com personalbrandingblog.com dailycampus.com iowaworkforcedevelopment.gov bna.bh smarthinking.com nylaarp.com poweredbygps.com yamap.co.jp cddbp.net iaspassion.com servedbyopenx.com seoptimer.com mycslink.org designntrend.com contorion.de manga99.com mechnet.com.cn timesheets.com edgeboss.net novamovie.net aaahq.org imgprime.com oceanofgame.org astraone.io sethlui.com universalstudiosentertainment.com usn.no sett.com surveyh.com myclassboard.com intelligencesquaredus.org obyava.ua printbar.ru fabulousfox.com genlookups.com bonprix.cz odyclub.com cuddleclones.com themeegg.com indiaenvironmentportal.org.in ollusa.edu travelopod.com kino-dom.org riyasewana.com relyonhorror.com pushservice.info oracleinfinity.io appxigo.com laimanhua.com lxzwknybfvycxr.com online-billpay.com lightingsupply.com sprinklebakes.com zip-rar.com adhslx.com southernexposure.com treato.com nikeflightbonafide.us emergency.vic.gov.au linkt.com.au 54new.com homecontract.eu sakhamusic.ir humanhairextensions4u.com builtinaustin.com mychirotouch.com stratus.com qubes-os.org npo3fm.nl alldevotion.com reservecalifornia.com ja.org fit.pl apollohospitals.com resurva.com privatecams.com autowini.com 82190555.com krogerkrazy.com servientrega.com douglas.co.us mikemann.com canadapharmacyonlinefako.com softwarefreedom.org soccer-douga.com forex-gcc.com ruskino.ru dirxion.com midgardmc.org grands-meres.net branham.org flathub.org cdn7.com mobilehomesell.com landoverbaptist.org oglethorpe.edu paperfree.cn tarfandcity.com ydf-conference.com 12380.gov.cn spmag.ru bfanetempresas.ao bigagnes.com diadora.com maannews.com lead411.com mp3car.com centerforinquiry.net ferrybuildingmarketplace.com jornalcontabil.com.br parishcouncil.net enforex.com protezionecivile.gov.it jacksonpollock.org biosagentplus.com bijog.com gaspricewatch.com webtm.ru steko.com.ua yaani.ru huhot.com spinics.net docbaza.ru yandextrafik.com.tr mobilemaya.com onrealt.ru serialnet.pl blackboardconnect.com theriver.jp christ.de cleanclothes.org talkop.com chat-assistance.com informationbuilders.com mailinblack.com redditodicittadinanza.gov.it cnbz.gov.cn nzcity.co.nz streamload.com tipsyelves.com purehempbotanicals.com meemic.com hasfit.com antlabs.com enenews.com votingdad.com netdisaster.com xn--72c7calxf3czac9hd8gra.com floraadenium.com golfmagic.com probrewer.com insidebigdata.com hedwigbroadway.com slaveryfootprint.org ups.edu.ec pintsizedbaker.com funcionpublica.gov.co nsbank.com kipris.or.kr lapatria.com secureauth.com northernandshell.co.uk lee.edu go2yd.com gnu-darwin.org zonacero.com cheapwigsstore.com hiyobi.me dyndns.dk thompsontee.com usc.co.uk actes-sud.fr dcunited.com amcrestsecurity.com kaufland.bg matiscape.eu hongkongpost.com luz-image.net cozitv.com internettrafficreport.com kramerav.com consul.io 4put.ru adn.es bitseven.com halfclub.com railwire-unifi.in football-russia.tv rockit.it dronelife.com semcs.net yamart.ru breathehr.com notable-quotes.com triumphmotorcycles.co.uk equalitynow.org katzsdelicatessen.com dqydj.com shabbyfabrics.com mashhadhost.com techdifferences.com chicksaddlery.com rwbola.com bookmooch.com appgrowing.cn centralparkresort.hu eeagrants.org njatc.org superherostuff.com heenakhan.com caanet.org.cn southernglazers.com cvm.gov.br commandlinefu.com hostingcouponscodefree.com ncwc.edu qcode.us gtp-tabs.ru mp3indirco.info streetwisereports.com ace2three.com notquitenigella.com lu.ch civitekflorida.com bolterandchainsword.com letechs.com jerryjenkins.com joy.hu bigmailer.io miumiusunglasses.com 2gayboys.com baunetz.de yandex-launcher.com myemailsignin.net seriesfree.to jdmagicbox.com trainworld.com pieology.com lapumiafilmes.com ecomexpress.in pexopower.com ofwpinoytambayan.su ibm.biz drdo.res.in mrdelivery.com xn--82c0bxcybxc2b.com lamoda.by clubcar.com wylsa.com c21.com mfiles.co.uk toyota.com.tw tianfateng.cn phonefactor.net engelschall.com casinonextyear19.com freshpatents.com nudecelebvideo.net virginmedia.ie mhlnews.com apidog.ru ttrockstars.com nacionalloteria.com hct.com.tw century21.fr entercom.com cbr.nl radiotvcalabria.it lebron13.org fh-dortmund.de eliesaab.com nnedv.org ui-patterns.com ntn24america.com larepublica.net minostech.co.kr smiletrain.org clado.plus kgcha.com wrabote.ru redtube1.pro theredlist.com zhonga.ru petel.bg imgfast.net qm-search.com aulaclic.es tribune.gr allassignmenthelp.com mathematiquesfaciles.com sexneigung.com woomintech.com askthiswhen.com ibeinvestmentng.com icmbio.gov.br convenience.org momdot.com mathsgenie.co.uk dwds.de tcbmag.com indra.com matomesakura.com robotics.org kidsdomain.com edlioadmin.com onefinestay.com blognews.am dustinhome.se psywww.com kat-pwr.com croptrust.org betweennapsontheporch.net harrywinstonjewelrys.com dinsta.com haute-garonne.fr livecareer.co.uk mojewypieki.com mbt3th.us ehealthcaresolutions.com motorhome.com zoloft.team 90l6.com piapro.jp sdin.jp mff.gov.eg prepressure.com pelco.com urbansitter.com gotvafrica.com quizalize.com oneprojectcloser.com katalogmedik.ru thenailshop.ru georgepush.com midwayfinanceira.com.br e-vanguard.com kfc.me threenow.co.nz planeandpilotmag.com armysurplusworld.com bongino.com prostagenix.com roaring.earth evilmilk.com carmudi.co.id yikeyz.com bshwat.com streamsnooper.com mothercenter.info excite.es drivelan24.com getgirltofuck.net tickets-online.com tudohd.com iceland.is autoscout24.ru labelorchestra.fr interregeurope.eu gundamplanet.com mecd.es hqtlbsglscrju.com elsoft.vn powertochoose.org xxximagetpb.org smapp.work 24hours.me voyagela.com himmera.com alertlogic.com emagazine.com usccr.gov rightmoveanalytics.co.uk tianduntech.com calciomaglie.it musthavemom.com iiba.org wnbc.com bynorth.com qr.net asser.nl sunfood.com captureone.com wotpack.ru the-natural-method.com salamatnews.com multitheftauto.com softserialkey.com lifeglobe.net kpcnews.com torinotoday.it shabiba.com withlovefromkat.com dnsalias.org hpfanficarchive.com locoso.com 5euros.com auditude.com x-reviewer.com viettimes.vn gtaxmods.com renai.us reftagger.com toribash.com konsumentverket.se semmelweis.hu apages.net downloadnow.com linux-usb.org ist-budget.ru mlsdigital.net emailondeck.com sdjs.gov.cn jbjs.org fmtv.com caixabank.cat 1cros.net nikedunksb.us 73g509fk9a.com momat.go.jp ysts8.com altharawatgroup.com postdirect.com dogvacay.com synchronybusiness.com gwo.pl lkk-zkh.ru iyingdi.cn couples.com monsterfishkeepers.com lawfirms.com kita.net itninja.com irancook.ir viralize.tv campbellsoupcompany.com filterforge.com prima.co.uk vespa-classic-club-geneve.ch mybestruns.com movie-wiki.net breakingbourbon.com 505games.com rosenfeldmedia.com behavenet.com securegive.com yandexdatafactory.com 55printing.com ambientweather.com theupcoming.co.uk univesp.br ecigarettedirect.co.uk cadastre.gouv.fr pollotropical.com yummybazaar.com ingilizceyehazirlik.com lzo.com hbook.com providr.com shentai.org thematureporn.net kidssundayschool.com videoclub.men fmglobal.com condenaststore.com landezine.com turismocity.com.ar pub2srv.com hafryat.com anizm.tv lameuse.be theswiftcodes.com morningstarjp.com acceptiva.com freedomsphoenix.com talpanetwork.com pccppc.com everything-about-rving.com kidswithfoodallergies.org bikinisaletop.com manaus.am.gov.br amathsdictionaryforkids.com gls-online-filiale.de wolfandbadger.com malagahoy.es dsl.sk wealthyretirement.com theamericangenius.com widziecwiecej.pl prospectinfo.ru seattlerefined.com elsaltodiario.com yearbookordercenter.com aghanilyrics.com my5.tv jelasmi.com loopup.com retailwire.com itexts.net tcbresistencias.com appromoters.com ahaic.gov.cn yaodaojiao.com erogazopple.com 5pornovideo.net haaretzdaily.com n-gamer.nl wukongitxueyuan.com soccerbase.com heroeshearth.com gildan.com bagilagi.com kubota.co.jp 3dortgen.com whooosreading.org vocab.com ignatianspirituality.com alltech.com fg-a.com alldigitall.ir rsstop10.com everydayshouldbesaturday.com rewardit.com iosco.org nact.jp jisusaiche.com allcrafts.net surplustown.com kolobok.ua brno.cz zooplus.it higi.com hgmsites.net mfd.ru canadagoose--outlet.ca grooves-inc.com peakonsrv.com boredbutton.com myhuckleberry.com enterbrain.co.jp tusclasesparticulares.com abc64.ru dali.gov.cn treeofsavior.com digikam.org asubtlerevelry.com falkentire.com moparonlineparts.com addicted.org iett.istanbul suzuki.com ndhealth.gov letu.edu reviewability.com astrocal.co.uk alicili.ws teknoseyir.com ewe.de nau.edu.ua rmauctions.com techblog.tips huachengrubberbelt.com mypot.jp gwinnettcourts.com abbconcise.com photoshopsupport.com xxtube.pro thisisafrica.me fidf.org motoservices.com loft-prj.co.jp shimano-eu.com sportschaplains.org prodh.org timtales.com officialauthenticchiefsstore.com kestrelgames.com bloganchoi.com tomferry.com totalrl.com humanbrainproject.eu meghantelpner.com lindafarrowsunglasses.com rhombusads.com laregion.es neatoshop.com cripo.com.ua apcdns.com alk.com hybcomics.xyz deepburner.com zync.edu.cn japan-secure.com pollinator.org peterblum.com bdoplanner.com knoxschools.org cessna.com journalducameroun.com scoresport.live blazerforum.com quanben5.com cityofchesapeake.net shoes.net.cn nicepricefavors.com kommersant.ua tocka.com.mk beanstream.com thehundredsclothing.com ameviet.com haitou.cc dorsetforyou.gov.uk ucb.com girlg.com amazona.de videosexo.blog.br xxx99porn.com dansmovies.com once.es dulux.com.au zeel.com tomboyx.com genghisgrill.com georgiasown.org casece.com rb7url.net blitzresults.com yamahapartshouse.com yemen-now.com twitterstat.us ireland-calling.com 49ersjerseyshop.us pomoho.com isptec.co.ao choies.com texansjerseys.us bookstr.com videosmile.ru vegacdn.vn gbook.ir yate.ch mardel.com thechinesezodiac.org espn.com.co verdenews.com shark-games.net tifbs.net spid.gov.it morningstarfarms.com camera.org ecigarettereviewed.com cbintouch.com jameshardenjerseys.com seriesparaassistironline.org atptennis.com book-online.com.ua themustangsource.com cipro.company filmdiscuss.com sduhsd.net embedgooglemap.net saijogeorge.com zerodayinitiative.com mathsonline.com.au adstage.io a1.hr jword.jp lezhi028.com comedonchisciotte.org impulse.de securitybank.com mlmreport.info pipaffiliates.com tecnicadellascuola.it escortdirectory.com musicsalesclassical.com course-crew.info shoplo.com psy525.cn wordtemplatesonline.net coreldrawchina.com nicolasgallagher.com zurifurniture.com cialischpbrx.com theselby.com biotrustnews.com serviceu.com ttpet.com medica.de pubmed.com stadtbranchenbuch.com bookmarkbook.org inforadio.de tehranmelody.com planetmirror.com adidas.pl ohbulan.com lataco.com cabelasclubvisa.com onlinepharmacysrba.com youtubemp4.biz imaginoproject.com 15navi.com gogosextoys.com ctypy.com mywfg.com positivesingles.com wrbl.com vancouver-webpages.com yandex-school.ru csgopositive.com cdcovers.cc uiu.edu lusana.ru quirkbooks.com alliednews.com kingbrand.com boju88.com planetaexcel.ru princegeorgecitizen.com kelpmedia.com katehorrell.com kscourts.org tridenttech.edu hitbox.com learn2serve.com warforum.cz myonlinestats.com safak-roleplay.com itao.com vk-cdn.net qamshy.kz nationallawjournal.com dentaltown.com imaios.com gjart.cn mlsend2.com hellomedian.com netscape.net worlduc.com siftery.com boulevard.com highrisecarpetcleaning.com cialisndbrx.com halls.md rsguboxyb.com chinadmoz.org testportal.com.ua ourrevolution.com revrtb.com 112gs.com idxxi.co billingjapan.co.jp fuzemeeting.com wwwmonclerjacketsuk.com.co spur.org latestmodapks.com myiuhealth.org tompool.org pingpang.info rossia.org jinbo.net isda.org rnceus.com voobly.com brainbasket.net wehuntedthemammoth.com photobiz.com xbytessolutions.com englishcentral.com dnoticias.pt yaprobki.ru criteriacorp.com got-free-ecards.com orztoon.com udaan.com spiraxsarco.com dragonagekeep.com echoforchange.com minesotatwinsjerseys.us mobilitywod.com sp-studio.de cheapwigshop.com oilru.com mdc-berlin.de atlas-sys.com solowrestling.com covalent.net carenotify.com chiens-de-france.com kaltire.com odaconline.com recmydream.com nordjyske.dk tadalafil.bio seedrah.net metrosport.gr game4v.com thenewsenterprise.com ecer.com daxshat.site newstomato.com ray-ban.me.uk nestpensions.org.uk cryptorescue.org foodora.de emediawire.com i-can.org.za simpleviewcrm.com sunwarrior.com derana.lk theuconnblog.com pixub.com tfes.org banclip.com meiyixia.com bimebazar.com karabas.com free-software.com.ua jsgwyw.org yandex-team.com fortnine.ca blendercn.org lawguru.com symagine.net macwinsofts.com coloringcrew.com airport-data.com skytorrents.to tt.cn lakemedelsverket.se pornxxxdb.com qunsee.com pizzamaking.com rcu.org playgm.cn jeffgeerling.com v1host.com myheart.net erogazo-ngo.com thk.com configserver.com adinc.kr instrumart.com jumbomail.me nadelectronics.com nestingwithgrace.com vinci-autoroutes.com paylogic.nl afterglowvp.com academybank.com vsointernational.org designtrends.com vincityleseine.com pev.pl schoolnutrition.org yts.io gmsp.org tirebusiness.com cyberctm.com spong.com newcar.com marinelayer.com most.gov.tw fragomen.net sgou.com collegeofsanmateo.edu diyideas.ru lehrer-online.de tpc.re uqpay.com lshunter.net jokeblogger.com rogersmedia.com navy.gov.au cookeatshare.com 770k.com gotimeforce2.com weather2umbrella.com bitsandpieces.us destiny.gg janome.com sporticos.com niadd.com yew.ge allergybuyersclub.com linuxbabe.com deliveroo.de pangu8.com truereligionjeans-canada.com reso.ru sohacdn.com orb.ru freshjiveclothing.com daofire.com ktr8.com cine24h.net wycliffe.org inversionesartica.com iachina.cn mhtr.be grassfedgirl.com lodders.ru novinhasdozap.com applianceparts365.com fmnation.net nikerevolution3.us cpalead.com moc.gov.tw xiugei.com bearshare.com romancealley.com bbcomcdn.com mtc.gob.pe payju.ir androidbak.net linkslot.ru qzu.edu.cn umfrageonline.com mol.gov.tw ilmugeografi.com smsd.org ddb.com google.ms weather.gr lllreptile.com sportrider.com sagolfbidder.co.za --Apple-Mail=_62BF672C-84D7-448F-BD03-FB7010D05E14-- From nobody Thu Jul 18 22:56:43 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EFBFA120157; Thu, 18 Jul 2019 22:56:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NG2tw7_0IKga; Thu, 18 Jul 2019 22:56:33 -0700 (PDT) Received: from mail-io1-xd41.google.com (mail-io1-xd41.google.com [IPv6:2607:f8b0:4864:20::d41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D98EA120025; Thu, 18 Jul 2019 22:56:32 -0700 (PDT) Received: by mail-io1-xd41.google.com with SMTP id h6so56004149iom.7; Thu, 18 Jul 2019 22:56:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=U5NEklj6YBO0mXKdughThqpRKwbiePRInGqQ2xZeAZI=; b=W7rt73uSqywcC0abL+rogDxF8XHvzsqc3tsPgb9g85q5+yrVG7M7b5SHOMwQZN3J0O 9JEAnSUIv97fEL/R5iYZ4kPve6oU1FjjSdl4I0r03u4gGIyaDC6OnPFAgjHEgi8klMqN +xpE9+J2Ct9P2i4bk0CyCGMnQDAFL5hmC53I74aYtE7cY9IbV/nWIUIgPkrjdEeGtYxG 2S63VM+RpagzeszCmmkgN3eZI5kuAVppYEHalyJqvBiFr4+LYqChgKHQV6zIyf3CSmqq Lyk/vEejBbhcTbjd4MslIzshpfHiRx1rWMAyQkjyWbplvSoJdHLlesx1WPHMZsJQmbl2 na3g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=U5NEklj6YBO0mXKdughThqpRKwbiePRInGqQ2xZeAZI=; b=g5FpOq7T52kUHLOJlhwgLgqAGoHO2BMA0ASVIiursSqU4SSSWJh2bihM5g/TrsMcty fLY/qrNaVtyFqfPqBE+GQ5nFqGuVgGoKJbhJ+NJZo6MCSyEKd5C0mDYjnvEKYvuRZ8bf mz8laM5DfuxESt91/FP9gVk3o8aGLC2wzXFiYXgyVec1h4v+MiBqjnTLXjyN8PwHtCrg 12UT0wJSBk3G8KvtHDCWtiddqIuEudNgGHzrLu8khHhDzADCBes6OUUaNkyTjR4BrGFu 3h6t2YRBZmkPU3IauxP0VPkFiFfwTPwYpy3GbWameMxq/C0Orv2JBigX7SFNq53Ml1lr SrFg== X-Gm-Message-State: APjAAAWygPrj73lafHCMiDn4bXNeIawIrEDXqIf/LQ8vi/GtP78e1UBP ex6aareKTiAe6Vc6D0Mlr0VPaNG1CZns+WmcNa4= X-Google-Smtp-Source: APXvYqzRtCN3Xq2JMrbI2vHeYBYTYUBr5YQxKT6rm28koAdBPj9bGkxlxbDAbKBhjS64UySpzvypXuogWvXj6mkQY/s= X-Received: by 2002:a5e:d618:: with SMTP id w24mr12275671iom.73.1563515791141; Thu, 18 Jul 2019 22:56:31 -0700 (PDT) MIME-Version: 1.0 References: <402781F4-33D8-4FD4-8087-FDCEFFF2D549@iseclab.org> <267CBE74-9DC5-40D8-A61F-7C566644A1CB@iseclab.org> In-Reply-To: <267CBE74-9DC5-40D8-A61F-7C566644A1CB@iseclab.org> From: Rob Sayre Date: Thu, 18 Jul 2019 22:56:19 -0700 Message-ID: To: Kevin Borgolte Cc: add@ietf.org, DoH WG , dnsop WG , jordanah@princeton.edu, pschmitt@cs.princeton.edu, ahounsel@cs.princeton.edu, feamster@uchicago.edu, dns-privacy@ietf.org Content-Type: multipart/alternative; boundary="00000000000054ef23058e026351" Archived-At: Subject: Re: [Doh] [DNSOP] Do53 vs DoT vs DoH Page Load Performance Study at ANRW X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Jul 2019 05:56:35 -0000 --00000000000054ef23058e026351 Content-Type: text/plain; charset="UTF-8" On Thu, Jul 18, 2019 at 10:42 PM Kevin Borgolte wrote: > The list of websites is attached. It is extracted from the top 1,000 and > 99,000 to 100,000 of a Tranco list. > Thanks for attaching the list. Having seen a fair a number of these, I think it looks reasonable. But, I think you should add the list and the reason for the range choice to the paper. For example, I can't tell what range you actually used from your description (although that might just be due to a hurried reply). Another issue is that, while your paper might accurately capture the network conditions on your local network, it's probably doesn't capture network variation as well as a large scale test along the lines of what Mozilla did. For example, if the university used a single router brand, this could skew the test. As one data point, I've never seen the various network-throttling apps match a real-user-metrics test very well, although they do catch really problematic situations. This test is a welcome contribution, but given the data in the paper, it would be difficult to reproduce. thanks, Rob --00000000000054ef23058e026351 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Thu, Jul 18, 2019 at 10:42 PM Kevin Bo= rgolte <kevin@iseclab.org> w= rote:
The list of websites is attached. It is extracted from the top 1,000 and 99= ,000 to 100,000 of a Tranco list.

Thank= s for attaching the list. Having seen a fair a number of these, I think it = looks reasonable.

But, I think you should add the = list and the reason for the range choice to the paper. For example, I can&#= 39;t tell what range you actually used from your description (although that= might just be due to a hurried reply).

Another is= sue is that, while your paper might accurately capture the network conditio= ns on your local network, it's probably doesn't capture network var= iation as well as a large scale test along the lines of what Mozilla did. F= or example, if the university used a single router brand, this could skew t= he test. As one data point, I've never seen the various network-throttl= ing apps match a real-user-metrics test very well, although they do catch r= eally problematic situations.

This test is a welco= me contribution, but given the data in the paper, it would be difficult to = reproduce.

thanks,
Rob
--00000000000054ef23058e026351-- From nobody Fri Jul 19 03:11:01 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4A006120154 for ; Fri, 19 Jul 2019 03:10:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=iseclab.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AnAdYh6uFoV7 for ; Fri, 19 Jul 2019 03:10:44 -0700 (PDT) Received: from mail-pf1-x431.google.com (mail-pf1-x431.google.com [IPv6:2607:f8b0:4864:20::431]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DE22F12016D for ; Fri, 19 Jul 2019 03:10:43 -0700 (PDT) Received: by mail-pf1-x431.google.com with SMTP id g2so13982501pfq.0 for ; Fri, 19 Jul 2019 03:10:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iseclab.org; s=mail; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=25ZikMlVCzGtP+Vdf15vRrgcowGxHo6pilCrPOI0FMQ=; b=gRnqM3nlLan5Hw+Q+BnFcJ1At/KV1mFjlzdsKrsduwEDpJL4Q+JBVn7kkbZPr87viG zNAcbcCvIY4cDLh3tBsN8TdkJFXPnlJcDNe7bmc7OCSV2g2Cw50jNGjwxc6V4xccvqQR yaD5TiUFf0798+bykwbULH0EKFQN2fhPjl0Po7ho1HvT//aXPSKnRszExV/ag9keW+nI E3xlsZqm9qTShu8ErfESyY9XHENEu/Pzu+5zmXNIIW+Gn9suXyCbEqpHjKBH1IM4w/9o ZfEyBwbt/ogeyx6NOnuTUiqvgpdWJvF9ThV89hcArMmobEPlEf3QPFHLlGSCEcv9uFbl +A/A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=25ZikMlVCzGtP+Vdf15vRrgcowGxHo6pilCrPOI0FMQ=; b=YmoCxEvKBL2oKiflJDwrBdDkhav0kOjM7V/ml283p9izcmvK09A3tb4m1efNkPalnz 7dz74LB2ZzTaz1aXtVOu5CwfplHRpo5zqjtjIv1Cp3DX/mA79dd1OUmYY8IeUyW8aR2N fcDbs0DUYapBU7VvMEBKnzSBp/K7zvVXRum/tRs3j/kbjqcjj29vvIZlP/Umzzb2bMne o7NtFrIsS5qV9e6ph/MFK3wEu3TfwcsZUMy0uIM1xfTJBuhGABQO/JGQmw1ga7xsOTNl D/Fk5v5dq/D+WkTC9V5evXHVdEQBFtTHjJ77xJA2yBj6KA+O0ypv6Z0eqDd7De9oMIlz 08PQ== X-Gm-Message-State: APjAAAWRP72sVgdg7oteL3MNQ4DVP4BoU9tTrJ1ME+a6x8eWgP8nVox8 oMnRJCqDcw/oUdeB2rOTkSvBhQ== X-Google-Smtp-Source: APXvYqxvYxO7O3hl0HGaP/T/O0ba69u0aEXFNJuIasAOqVIK6iD4/mUNrwLmqu0qibPqJiCeVbFMLA== X-Received: by 2002:a63:9e54:: with SMTP id r20mr17748095pgo.64.1563531038479; Fri, 19 Jul 2019 03:10:38 -0700 (PDT) Received: from [192.168.205.139] ([103.23.203.130]) by smtp.gmail.com with ESMTPSA id q69sm44210052pjb.0.2019.07.19.03.10.35 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 19 Jul 2019 03:10:38 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) From: Kevin Borgolte In-Reply-To: Date: Fri, 19 Jul 2019 18:10:34 +0800 Cc: add@ietf.org, DoH WG , dnsop WG , jordanah@princeton.edu, pschmitt@cs.princeton.edu, ahounsel@cs.princeton.edu, feamster@uchicago.edu, dns-privacy@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <8B59D2ED-5B57-4C14-8442-102EEBE5A281@iseclab.org> References: <402781F4-33D8-4FD4-8087-FDCEFFF2D549@iseclab.org> <267CBE74-9DC5-40D8-A61F-7C566644A1CB@iseclab.org> To: Rob Sayre X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Doh] [DNSOP] Do53 vs DoT vs DoH Page Load Performance Study at ANRW X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Jul 2019 10:10:45 -0000 > But, I think you should add the list and the reason for the range = choice to the paper. For example, I can't tell what range you actually = used from your description (although that might just be due to a hurried = reply). Section 3.2.4 talks about the selection of websites: We collect HARs (and resulting DNS lookups) for the top 1,000 websites = on the Tranco top-list to understand browser performance for the average = user visiting popular sites. Furthermore, we measure the bottom 1,000 of = the top 100,000 websites (ranked 99,000 to 100,000) to understand = browser performance for websites that are less popular. We chose to = measure the tail of the top 100,000 instead of the tail of the top 1 = million because we found through experimentation that many of the = websites in the tail of the top 1 million were offline at the time of = our measurements. Furthermore, there is significant churn in the tail of = top 1 million, which means that we would not be accurately measuring = browser performance for the tail across the duration of our experiment. We didn't include the full list in the paper itself for space reasons = and because extracting the list from the paper would be cumbersome. It = will be part of our future open source release though. > Another issue is that, while your paper might accurately capture the = network conditions on your local network, it's probably doesn't capture = network variation as well as a large scale test along the lines of what = Mozilla did. For example, if the university used a single router brand, = this could skew the test. As one data point, I've never seen the various = network-throttling apps match a real-user-metrics test very well, = although they do catch really problematic situations. It is true that the an experiment from more diverse vantage points could = be more useful to capture network variations, however, we already see = that the protocols perform differently to the degree that a human could = notice (that is, we already show that selecting your DNS protocol based = on your network characteristics can have a non-negligible impact). = Running a large scale test for page load times like Mozilla did for = resolution times is also quite difficult: Simple telemetry data won't = answer the questions we want to ask, as websites need to be fetched = multiple times (per protocol/recursor combination), and browser caches = need to be flushed. These are not things you want to do with your users. = Using existing measurement platforms also was not an option, as they are = limited in what you can access or do not support the necessary = protocols. Meaning, you would need to set up your own measurement = clients, which brings questions like "How do you select the vantage = points?" (you can't use hosting/cloud providers, as this would lead to = little network variation). If you have an idea on how to easily run this = on a larger scale, we'd love to look into it. We set link capacity and latency based on best case values from = real-world measurements (Section 3.2.3) from OpenSignal, and we use = iproute2 for traffic control (tc), which we verified to be accurate = through latency (Table 1) and multiple "speedtest" (via Ookla). By = tuning the network setup in this way (instead of using a 4G/3G modem for = connectivity), we eliminated potential differences in routing that could = have otherwise influenced our results and impact comparability. -- Kevin= From nobody Fri Jul 19 14:14:34 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 83BDF120A44; Fri, 19 Jul 2019 14:14:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gJAXu6ADdvPm; Fri, 19 Jul 2019 14:14:11 -0700 (PDT) Received: from mail-io1-xd44.google.com (mail-io1-xd44.google.com [IPv6:2607:f8b0:4864:20::d44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6A4871207E2; Fri, 19 Jul 2019 14:14:11 -0700 (PDT) Received: by mail-io1-xd44.google.com with SMTP id e20so30932813iob.9; Fri, 19 Jul 2019 14:14:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=r1oPtaiul8VDnunpzcU36ny4SjTGcEvQhylLSkf+GAE=; b=Wr6xLoZnN8/TQt4GHC7vig4lMIZNYieNv1SQRmTGOem5jPphBh5CcKyR18Os2vDsJw KYO7r/yr2PJ2aRHLBdyZek1jDsz/QJN0fbX2yL5TlK+5LU5dCR13UqAm8gcQoqmLQJss TLWRWprLWrudt0W4NXUNh2fpW9vU13n3eZvLz0QyGgQ55BwH9nkbWwTalCRin8wX6qqK Gjh8xWd27WF2ZCxe74O4NqvtYLDTeYVCDV3imsdjDLIsi1Xbgk+ix8Zdz7qfmlZbciAK B/AfOCEBgDC3Dbs/PNdXyBpLdp22JFCEb3p+dcc/3sd3OvwLeBeq9pKmbnOoF17JcaF4 +6sw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=r1oPtaiul8VDnunpzcU36ny4SjTGcEvQhylLSkf+GAE=; b=IlCmWrqJwgQw6jTZkUaBq2L8XJ6DHLeqqqBBGnuZisOpNYVIGUCGHcZqKnTDf96h6W 1M7htUHwZrAUr3Ot+dPdS3KubIylG0bJl6D1/Eo/M7L2eApLPOQ/JEXL5qvaJaFqZXp6 zqwrOC9YCAO2RP66xW+8/enagb9h4jnfbAb9aicwh3fk53df8c0I4aBOhgiI01KEQ8xj Yi/K2evzU2EcPj/+BpzrMJ+cvYYLYbNI3ctJZO/QYPm4ogrP+6UHnAlQ2URli0Vj8Xck MuhL9pGSHn1ifiB24w1aUdfzq8xiLRuSiTXnv5jMikm337+i5xkjDXO56mWTCeDiApFz Z0vQ== X-Gm-Message-State: APjAAAV45XZVQivLBy4IlEFS3SnpWWJb2fKp2obKLULcsXvImAFFnhLV OJC+X+MEBJelnNKQL1z7iRs77qLNi/uwOO/80lQ= X-Google-Smtp-Source: APXvYqyAMWk8HJ2W0QNKNq3G771gq6mmfg2GQql+DkgofJ3hheKMR8NSOCmpyUrVJ+XZ73NU4FLSKO18p5uq3oQyzd4= X-Received: by 2002:a6b:bc42:: with SMTP id m63mr37462272iof.189.1563570850573; Fri, 19 Jul 2019 14:14:10 -0700 (PDT) MIME-Version: 1.0 References: <402781F4-33D8-4FD4-8087-FDCEFFF2D549@iseclab.org> <267CBE74-9DC5-40D8-A61F-7C566644A1CB@iseclab.org> <8B59D2ED-5B57-4C14-8442-102EEBE5A281@iseclab.org> In-Reply-To: <8B59D2ED-5B57-4C14-8442-102EEBE5A281@iseclab.org> From: Rob Sayre Date: Fri, 19 Jul 2019 14:13:59 -0700 Message-ID: To: Kevin Borgolte Cc: add@ietf.org, DoH WG , dnsop WG , jordanah@princeton.edu, pschmitt@cs.princeton.edu, ahounsel@cs.princeton.edu, feamster@uchicago.edu, dns-privacy@ietf.org Content-Type: multipart/alternative; boundary="0000000000002131bb058e0f354c" Archived-At: Subject: Re: [Doh] [DNSOP] Do53 vs DoT vs DoH Page Load Performance Study at ANRW X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Jul 2019 21:14:14 -0000 --0000000000002131bb058e0f354c Content-Type: text/plain; charset="UTF-8" On Fri, Jul 19, 2019 at 3:10 AM Kevin Borgolte wrote: > > > But, I think you should add the list and the reason for the range choice > to the paper. For example, I can't tell what range you actually used from > your description (although that might just be due to a hurried reply). > > Section 3.2.4 talks about the selection of websites: > > We collect HARs (and resulting DNS lookups) for the top 1,000 websites on > the Tranco top-list to understand browser performance for the average user > visiting popular sites. Furthermore, we measure the bottom 1,000 of the top > 100,000 websites (ranked 99,000 to 100,000) to understand browser > performance for websites that are less popular. > I see, that makes sense. I'm still having trouble interpreting the measurements, given that pageload can be blocked by additional DNS queries and HTTP requests. For example, could an analytics provider interfere with performance evaluation here, if it were present in a lot of pages? Or, what if the results indicate a performance problem in one common hosting vendor (anything from AWS to Wordpress)? As I said, the paper is a welcome contribution, but I find the results surprising and want to look more. I would have expected DoH and DoT to be about the same in practice, but your paper does not show this. > We didn't include the full list in the paper itself for space reasons and > because extracting the list from the paper would be cumbersome. It will be > part of our future open source release though. > Understood--I meant that I looked for a separate download and didn't see one (thank you for sending it along). thanks, Rob --0000000000002131bb058e0f354c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Fri, Jul 19, 2019 at 3:10 AM Kevin= Borgolte <kevin@iseclab.org>= ; wrote:

> But, I think you should add the list and the reason for the range choi= ce to the paper. For example, I can't tell what range you actually used= from your description (although that might just be due to a hurried reply)= .

Section 3.2.4 talks about the selection of websites:

We collect HARs (and resulting DNS lookups) for the top 1,000 websites on t= he Tranco top-list to understand browser performance for the average user v= isiting popular sites. Furthermore, we measure the bottom 1,000 of the top = 100,000 websites (ranked 99,000 to 100,000) to understand browser performan= ce for websites that are less popular.

= I see, that makes sense. I'm still having trouble interpreting the meas= urements, given that pageload can be blocked by additional DNS queries and = HTTP requests. For example, could an analytics provider interfere with perf= ormance evaluation here, if it were present in a lot of pages? Or, what if = the results indicate a performance problem in one common hosting vendor (an= ything from AWS to Wordpress)? As I said, the paper is a welcome contributi= on, but I find the results surprising and want to look more. I would have e= xpected DoH and DoT to be about the same in practice, but your paper does n= ot show this.


We didn't include the full list in the paper itself for space reasons a= nd because extracting the list from the paper would be cumbersome. It will = be part of our future open source release though.

=
Understood--I meant that I looked for a separate download and di= dn't see one (thank you for sending it along).

thanks,
Rob
--0000000000002131bb058e0f354c-- From nobody Sun Jul 21 18:55:09 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 22EF9120141 for ; Sun, 21 Jul 2019 13:26:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.501 X-Spam-Level: X-Spam-Status: No, score=-17.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qC6gY3zGl3pi for ; Sun, 21 Jul 2019 13:26:49 -0700 (PDT) Received: from mail-yb1-xb42.google.com (mail-yb1-xb42.google.com [IPv6:2607:f8b0:4864:20::b42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B15DE120143 for ; Sun, 21 Jul 2019 13:26:38 -0700 (PDT) Received: by mail-yb1-xb42.google.com with SMTP id a14so14306673ybm.11 for ; Sun, 21 Jul 2019 13:26:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=Ap9z8tN29nhp8ZXJLRDW4HcOWg5FnscBjlQam/S43Rc=; b=SZNmI14bKycz6JVh7biOzvVkN4hf7jZfdKLhThc9ry+zS9gG+baHqgrhAMAhVi+GAI fXz5rWnouX1x07YfwCxfRkV38a604tHOvljWWA2bD/vbSdsg10MGfSthCyQLObgAUQ/V Z6oWClYgSbS0JwfiEh+u8Sx/GawvfJPS42a8sz6XWvSF2L0k9V+EJlbVRe8gKfDedJKJ mgBhrLXiQ9PwodBN5hfwmyyg4nyYqqZlrJaSmtC+G/zu0lYKpTEg3tpSCOWZ/7MNUBpk qi9RbBRYPjEK6H7YVhPc/DbrC78KXQs24J6O46VyNGv/E8t/egIHuQGFGYQLmsE7k4dd wMnw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=Ap9z8tN29nhp8ZXJLRDW4HcOWg5FnscBjlQam/S43Rc=; b=WZsAShXCyJqP52EVFgF1fMbvd3mGA2cvERzt2XfchmX1rLLukB2ZqzMDBEZxQkSyEW BI4A+17DM/KdcIp281l2A7wcM1ZKrw/Dt+NxPpbQ3OOXCeuXuWHKP16jdhb8zkG8+6n2 CN+1eta46wZRABg4Ptva7x1rmIPW8D8gWjm+EgkOY5XgNWLZwDyJ/VeosDbSnB/6PCrX 6hqYIW3SZO56lRghy/bICX8zGRs5p0HmkiIuPV68uLv4l6/zC8Svh1KTJdlz5QGojPXS Z2FKi5vKloJFwnlvnTUl6XYduq11UPL14H+fCmYj6C7sZVN/JlMis0bizmotOUS+goFd swug== X-Gm-Message-State: APjAAAXGbup5CvyJeDzgGA4/PiLyxD9FdWXjEpyDfkrVRF0/QrZLWeWL pdcWcEE8FzLUlR2DFkUSGmigPEbMWCV/b8u1VP9UfA== X-Google-Smtp-Source: APXvYqwGAWqfYbLvM8YO51NxMsLw1SaT9POywsXyd2j2xXVWd1R4S+ofZZ16imlhGyt9wanHUv8d0Sx7HDOj1etM8A4= X-Received: by 2002:a25:4585:: with SMTP id s127mr36737162yba.139.1563740797325; Sun, 21 Jul 2019 13:26:37 -0700 (PDT) MIME-Version: 1.0 References: <402781F4-33D8-4FD4-8087-FDCEFFF2D549@iseclab.org> <267CBE74-9DC5-40D8-A61F-7C566644A1CB@iseclab.org> In-Reply-To: <267CBE74-9DC5-40D8-A61F-7C566644A1CB@iseclab.org> From: Puneet Sood Date: Sun, 21 Jul 2019 16:26:24 -0400 Message-ID: To: Kevin Borgolte Cc: Rob Sayre , DoH WG , pschmitt@cs.princeton.edu, dnsop WG , jordanah@princeton.edu, feamster@uchicago.edu, add@ietf.org, dns-privacy@ietf.org, ahounsel@cs.princeton.edu Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: X-Mailman-Approved-At: Sun, 21 Jul 2019 18:55:08 -0700 Subject: Re: [Doh] [dns-privacy] [DNSOP] Do53 vs DoT vs DoH Page Load Performance Study at ANRW X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Jul 2019 20:26:56 -0000 Thanks for sharing the results of your work. It will be great to have the software available so others can run the experiments from other locations. When looking at the page load results the CDF graphs comparing the various services are very useful to see the relative performance of different services. However I could not find the range of time values for the page loads in the experiment. Basically what percentage of the page load time variation was related to DNS? Note: For Google DoH, we will be reviewing our implementation for latency. BTW we have launched our production RFC 8484 DoH service recently at https://dns.google/dns-query (https://security.googleblog.com/2019/06/google-public-dns-over-https-doh.h= tml). It will be great if you can update your software to use this endpoint. * The experiment was run from Princeton, New Jersey in Northeast US. The location is in a very well connected part of the world between network peering points in NYC and Washington DC. You will not see much difference (due to network latency) between the cloud providers and the default (local) Do53. Running the experiment from locations which are further away from cloud providers would provide another interesting set of data. * Conclusion on benefit (or lack) of ECS. Did the page load measurements include content that would benefit from proximity to the end user, e.g. streaming videos or large downloads? This kind of content benefits from ECS when the resolver is further away from the client. Thanks, Puneet On Fri, Jul 19, 2019 at 1:42 AM Kevin Borgolte wrote: > > > > This paper looks interesting. Is the software used in the paper publish= ed? > > Thanks! The code isn=E2=80=99t open source yet, but we will make it publi= c alongside the Docker setup we used for running it. Not sure when that is = going to happen exactly though. > > > Or, at least, is the test page set published? I haven't read the whole = thing yet, but it seems like the page set would be relevant if the paper te= sts page load time. > > The list of websites is attached. It is extracted from the top 1,000 and = 99,000 to 100,000 of a Tranco list. > > Best, > Kevin > > _______________________________________________ > dns-privacy mailing list > dns-privacy@ietf.org > https://www.ietf.org/mailman/listinfo/dns-privacy From nobody Mon Jul 22 11:25:14 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5AC38120338 for ; Mon, 22 Jul 2019 09:42:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mByYEGXSEOL5 for ; Mon, 22 Jul 2019 09:42:00 -0700 (PDT) Received: from copdcmhout01.cable.comcast.com (copdcmhout01.cable.comcast.com [162.150.44.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D600F12033D for ; Mon, 22 Jul 2019 09:41:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1563813705; x=2427727305; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=drixkcZtrbubfprxlM48dAw+8UpCYqQmWTDXVt4vrpE=; b=aQhwkWzgR7E/HB8UvEIoWXnEOVNyndp8uyirYelpwE6vTGc2CBs9w+mbG8pOiFAa yEVkvHjd3f4eNrsdNAVA/WHdx5D5dQdLYYvhIE5naXUZqMosHHbVzVkj0r+WcOAk amt7Bc9KOtJoK45v1t7H/YlKKt3w0Vxfl4GOYNA2ZAXPvFe0I3XHoLnmpnEuTbT8 mOtKhTlB0oN0EpKAEQMU22c1uRamAxLLaTmDgXnFj468Hdv0dmvSm6g74NAb32Q8 ln6ki7TOz7N/d+xCpfUZPREnJ/xV1fBdTjrVI9wVQ5JNhpvpadB+hn67wrbbMhRQ NDoKM29QGHwt4WbSfpZACg==; X-AuditID: a2962c47-ab9ff7000002e144-05-5d35e7496d5c Received: from COPDCEXC38.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by copdcmhout01.cable.comcast.com (SMTP Gateway) with SMTP id 1A.DD.57668.947E53D5; Mon, 22 Jul 2019 10:41:45 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by COPDCEXC38.cable.comcast.com (147.191.125.137) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Mon, 22 Jul 2019 12:41:58 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.008; Mon, 22 Jul 2019 12:41:58 -0400 From: "Livingood, Jason" To: Puneet Sood , Kevin Borgolte CC: DoH WG , "add@ietf.org" , "pschmitt@cs.princeton.edu" , dnsop WG , "feamster@uchicago.edu" , "jordanah@princeton.edu" , "dns-privacy@ietf.org" , Rob Sayre , "ahounsel@cs.princeton.edu" Thread-Topic: [DNSOP] [dns-privacy] Do53 vs DoT vs DoH Page Load Performance Study at ANRW Thread-Index: AQHVQAKpiwWiGVXJY0iQLg/SQuIMEqbWwjGA Date: Mon, 22 Jul 2019 16:41:57 +0000 Message-ID: <5F9202DE-ED2F-4F2A-8463-12334E54BC46@cable.comcast.com> References: <402781F4-33D8-4FD4-8087-FDCEFFF2D549@iseclab.org> <267CBE74-9DC5-40D8-A61F-7C566644A1CB@iseclab.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1b.0.190715 x-originating-ip: [68.87.29.8] Content-Type: text/plain; charset="utf-8" Content-ID: <0938F540FC185941B33EB4EDF2E99508@comcast.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrNKsWRmVeSWpSXmKPExsWSUDRnsq7nc9NYg+Ov+Sz+n17HZtHw7j6b xYbWHawWd99cZrG4dvcim8WiU0cYLS7O47Q4vfs8u8Xa+4wWL44mW3TOmsDkwO3R97iT1ePE siusHjtn3WX3WLLkJ5PH/jVvWD1a/25g8VjTkhDAHtXAaFOSUZSaWOKSmpaaV5xqx6WAAWyS UtPyi1JdE4tyKoNSc1ITsSsDqUxJzcksSy3Sx2qMPlZzErqYMv4/6WYsuMFVsf3YHNYGxi1c XYwcHBICJhLPD3N3MXJxCAkcYZLYOHkCE4TTwiTxcd57RgjnNKPE+Y9HgRxODjYBM4m7C68w g9giAtESPX3nmEGKmAUamCWWHJoPlhAGSrSv/MsIURQjcejMTiYI20jixpy5bCA2i4CqxO2t 11hBbF4BF4kZy/4zQ2xrZJKY+7IXrIhTIFBi+4aFYEMZBcQkvp9aAzaIWUBc4taT+WC2hICA xJI955khbFGJl4//gQ0VFdCX+HJuEwtEXE6iZ0crI8jPzAKaEut36UOMsZK4cvISM4StKDGl +yE7xD2CEidnPoFqFZc4fGQH6wRGyVlINs9CmDQLyaRZSCbNQjJpASPrKkZeQzMjPUNTAz0T Ez1zw02MwCS4aJqO+w7GD+djDzEKcDAq8fDGXTaNFWJNLCuuzD3EKMHBrCTCm2cAFOJNSays Si3Kjy8qzUktPsQozcGiJM57eLJGrJBAemJJanZqakFqEUyWiYNTqoFRVCv2/p66OusVCkzb K7Yd3iO3kT3nxYmX+1oOz2TkvWL6h+HN4pD3s42NA392h12Kf+OlU/hC8Ljn170WPgZMl0ri i55zaFWlPrH9K9vuFTirzlnK3Tdvz7tgZ64tWX0T/gRLS9puq17xpULedI70gvLZLycXXZ2o khZqUy52ffmfzT/ctixTYinOSDTUYi4qTgQAmRhp4n4DAAA= Archived-At: X-Mailman-Approved-At: Mon, 22 Jul 2019 11:25:13 -0700 Subject: Re: [Doh] [DNSOP] [dns-privacy] Do53 vs DoT vs DoH Page Load Performance Study at ANRW X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Jul 2019 16:42:06 -0000 T24gNy8yMS8xOSwgNDoyNyBQTSwgIkROU09QIG9uIGJlaGFsZiBvZiBQdW5lZXQgU29vZCI6DQo+ IFJ1bm5pbmcgdGhlIGV4cGVyaW1lbnQgZnJvbSBsb2NhdGlvbnMgd2hpY2ggYXJlIGZ1cnRoZXIg YXdheSBmcm9tIGNsb3VkIHByb3ZpZGVycyB3b3VsZCBwcm92aWRlIGFub3RoZXIgaW50ZXJlc3Rp bmcgc2V0IG9mIGRhdGEuDQoNCltKTF0gKzEuIEkgdW5kZXJzdGFuZCB0aGUgVVMgRkNDIGlzIGNv bnNpZGVyaW5nIHJ1bm5pbmcgRG9IIHRlc3RzIGZyb20gdGhlaXIgTWVhc3VyaW5nIEJyb2FkYmFu ZCBBbWVyaWNhIGVuZCBwb2ludHMgYXJvdW5kIHRoZSBVUy4gVGhvc2UgZGV2aWNlcyBhcmUgbWFu YWdlZCBieSBTYW1Lbm93cywgd2hpY2gganVzdCBhbm5vdW5jZWQgdGhleSBhZGRlZCBhIERvSCB0 ZXN0IHRvIHRoZWlyIHN1aXRlIG9mIG1lYXN1cmVtZW50cy4gDQoNCj4gQ29uY2x1c2lvbiBvbiBi ZW5lZml0IChvciBsYWNrKSBvZiBFQ1MuIERpZCB0aGUgcGFnZSBsb2FkIG1lYXN1cmVtZW50cyBp bmNsdWRlIGNvbnRlbnQgdGhhdCB3b3VsZCBiZW5lZml0IGZyb20gcHJveGltaXR5IHRvIHRoZSBl bmQgdXNlciwgZS5nLiBzdHJlYW1pbmcgdmlkZW9zIG9yIGxhcmdlIGRvd25sb2Fkcz8gVGhpcyBr aW5kIG9mIGNvbnRlbnQgYmVuZWZpdHMgZnJvbSBFQ1Mgd2hlbiB0aGUgcmVzb2x2ZXIgaXMgZnVy dGhlciBhd2F5IGZyb20gdGhlIGNsaWVudC4NCg0KW0pMXSBJIHdvbmRlciBpZiBpdCBtaWdodCBi ZSB1c2VmdWwgZm9yIENETnMgdG8gcHVibGlzaCBzb21lIG1lYXN1cmVtZW50IHRlc3QgVVJMcyB0 aGF0IGFyZSBoaWdobHkgbG9jYWxpemVkIChlLmcuIGRpc3RyaWJ1dGVkIHdpZGVseSAmIGFzIGNs b3NlIGFzIHBvc3NpYmxlIHRvIHVzZXJzKS4gVGhhdCBtaWdodCBlbmFibGUgYmV0dGVyIHRlc3Rp bmcgb2YgcGVyZm9ybWFuY2UgZm9yIGFjY2Vzc2luZyBjb250ZW50IHRoYXQgYmVuZWZpdHMgZnJv bSBwcm94aW1pdHkgdG8gdXNlcnMuIA0KDQoNCg== From nobody Mon Jul 22 13:48:00 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C6E901200A3; Mon, 22 Jul 2019 13:45:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GOK20zdapykp; Mon, 22 Jul 2019 13:45:46 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110070.outbound.protection.outlook.com [40.107.11.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 492B212012A; Mon, 22 Jul 2019 13:45:46 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=IFJVrEdSRBfxJLiCfvQp6OEw3GfMyhqgW+sz/q+6F1jEvqd2G1KY/XfLD8rLIvWJBDUNVSreD/7AcsUx+SgkVD2AA3KHb9h9IL8BS5btkQD9ndmGu6G24uGRFN/UJ8E06cMUhyOmpfB0iaJSR7QjAgUes2pb16KuVmBwUvYQGbz9U8/htLlxSLbWdQrebSX+2AecXHajpIjoxqTskPClF0vpH6thl8vXq1bsOy6ynOtMMZGfa7e5PLtsB5aw1qXiqi0ohTZKsjJZ22jJaZHQpvIDWTBX+iTb4/lx8EUXnekKqhNDw2YOEgTbu0rXphNIja033Pwe3gGq1/aklf3sZw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=o146CmlurwIaPWB9Cqst/sMkAX9H9j80pCT837h5a5s=; b=kpDUT03nBFVlDx5DmI1sQZdAORU50HLJUQH9p3tDO7znGz4+i072QZAEF5JygRhxzyEPEF8Am/lQkWvTNeA+ej3V8vKQipxnVDCvGQpdUSl47OEetee2dp/+lU876xvkE2O8qKGpTnsY5956utW5reHDrIXj87AAKEDroblq03H++BWxIY7cEGeCcT00S6N2PmmwgpVo3o25QHXyixgA0GdkoB1U3xOyCI85PlDX8tKK54c7CtS7MBLg8Mfy/A8wX2GPV/x0q9awbopWybL/NUwM2GGh99h6jC0yTQCZB77LBKpz2ijNEWYrK7WZjvIMZw9KmK2RlR6TqffUz0mEJQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=419.consulting;dmarc=pass action=none header.from=419.consulting;dkim=pass header.d=419.consulting;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=o146CmlurwIaPWB9Cqst/sMkAX9H9j80pCT837h5a5s=; b=r4JkEk++2XpsGOgnUFKAOPAk7/gn/iSqUpteAoMsgCsigH3ZdUUnl9HiTj7wwXA3M385shLGbokCIGeZqraq5Zi4x/35OTzFiGqjNq8lYowRcUkyU/1TXm1eSg4c39GrJ0WtVFDpAhAU7heddIimIilJGB3Ch4NPgOHDUp3Hn5Q= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB1024.GBRP265.PROD.OUTLOOK.COM (20.176.142.146) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2094.16; Mon, 22 Jul 2019 20:45:43 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::387c:9c12:531b:b7bd]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::387c:9c12:531b:b7bd%3]) with mapi id 15.20.2094.013; Mon, 22 Jul 2019 20:45:43 +0000 From: Andrew Campling To: "Livingood, Jason" , Puneet Sood , Kevin Borgolte CC: DoH WG , "add@ietf.org" , "pschmitt@cs.princeton.edu" , dnsop WG , "feamster@uchicago.edu" , "jordanah@princeton.edu" , "dns-privacy@ietf.org" , Rob Sayre , "ahounsel@cs.princeton.edu" Thread-Topic: [Add] [DNSOP] [dns-privacy] Do53 vs DoT vs DoH Page Load Performance Study at ANRW Thread-Index: AQHVQL/cJUg4QBvECkyH0tktfw4M+abXGMdg Date: Mon, 22 Jul 2019 20:45:43 +0000 Message-ID: References: <402781F4-33D8-4FD4-8087-FDCEFFF2D549@iseclab.org> <267CBE74-9DC5-40D8-A61F-7C566644A1CB@iseclab.org> <5F9202DE-ED2F-4F2A-8463-12334E54BC46@cable.comcast.com> In-Reply-To: <5F9202DE-ED2F-4F2A-8463-12334E54BC46@cable.comcast.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:bc12:c64f:3fad:1ac0] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 77048815-7749-4dba-879c-08d70ee590ed x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB1024; x-ms-traffictypediagnostic: LO2P265MB1024: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 01068D0A20 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(34096005)(39830400003)(366004)(346002)(396003)(376002)(136003)(189003)(199004)(54094003)(7696005)(6506007)(76176011)(81156014)(102836004)(8936002)(186003)(446003)(46003)(25786009)(71200400001)(476003)(44832011)(486006)(68736007)(11346002)(508600001)(81166006)(8676002)(71190400001)(6116002)(14454004)(66446008)(33656002)(66476007)(66556008)(6246003)(99286004)(316002)(54906003)(110136005)(229853002)(55016002)(9686003)(2906002)(53936002)(7736002)(256004)(305945005)(86362001)(6436002)(7416002)(66946007)(74316002)(5660300002)(4326008)(76116006)(64756008)(52536014)(14444005)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB1024; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: uGjzLfzOjYOC3ekrnmIboWqNsia7BBS1/maUndzlkly92wCpBuvQ/QhFTxvTEE3eLKKtHfzu5XgOevNtCr9pwHR6uvpxmSXuE9NVrrkWbTsu43HbXyaVUzI8O/IZBOKCTdnwwP/TEZrcx8Vr4xjAuO14XGHQRa0K9TcTXfrSPQtcBbEvV+e+87WRL60XU0sly0ExtsbQAwO62QQOzvBKcEyeMW21k6riyS55ANoiQFiu90PGATHdB46iJqbmbJcy/INMtjTp9fbx8CbISgFrLPkXOoAWxSghFSEi7g2Cpbp/6CqHQaw4BNb75964mhb+w9cKFC5w8I61B74rvOAUH2/17euHsCf3ECSURYfDdqyoQlvxSqc7ulbetHdww0V2Z4mA/scvRW4H8sMiQ6ep9FEWnGR+jEwn4fgeTbYHcFg= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: 77048815-7749-4dba-879c-08d70ee590ed X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jul 2019 20:45:43.6481 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: andrew.campling@419.consulting X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB1024 Archived-At: X-Mailman-Approved-At: Mon, 22 Jul 2019 13:47:57 -0700 Subject: Re: [Doh] [Add] [DNSOP] [dns-privacy] Do53 vs DoT vs DoH Page Load Performance Study at ANRW X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Jul 2019 20:45:49 -0000 T24gNy8yMi8xOSwgNTo0MiBQTSwgIkROU09QIG9uIGJlaGFsZiBvZiBKYXNvbiBMaXZpbmdvb2Qi Og0KDQo+IE9uIDcvMjEvMTksIDQ6MjcgUE0sICJETlNPUCBvbiBiZWhhbGYgb2YgUHVuZWV0IFNv b2QiOg0KPj4gUnVubmluZyB0aGUgZXhwZXJpbWVudCBmcm9tIGxvY2F0aW9ucyB3aGljaCBhcmUg ZnVydGhlciBhd2F5IGZyb20gY2xvdWQgcHJvdmlkZXJzIHdvdWxkIHByb3ZpZGUgYW5vdGhlciBp bnRlcmVzdGluZyBzZXQgb2YgZGF0YS4NCg0KPiBbSkxdICsxLiBJIHVuZGVyc3RhbmQgdGhlIFVT IEZDQyBpcyBjb25zaWRlcmluZyBydW5uaW5nIERvSCB0ZXN0cyBmcm9tIHRoZWlyIE1lYXN1cmlu ZyBCcm9hZGJhbmQgQW1lcmljYSBlbmQgcG9pbnRzIGFyb3VuZCB0aGUgVVMuIFRob3NlIGRldmlj ZXMgYXJlIG1hbmFnZWQgYnkgU2FtS25vd3MsIHdoaWNoIGp1c3QgYW5ub3VuY2VkIHRoZXkgYWRk ZWQgYSBEb0ggdGVzdCB0byB0aGVpciBzdWl0ZSBvZiBtZWFzdXJlbWVudHMuIA0KDQo+PiBDb25j bHVzaW9uIG9uIGJlbmVmaXQgKG9yIGxhY2spIG9mIEVDUy4gRGlkIHRoZSBwYWdlIGxvYWQgbWVh c3VyZW1lbnRzIGluY2x1ZGUgY29udGVudCB0aGF0IHdvdWxkIGJlbmVmaXQgZnJvbSBwcm94aW1p dHkgdG8gdGhlIGVuZCB1c2VyLCBlLmcuIHN0cmVhbWluZyB2aWRlb3Mgb3IgbGFyZ2UgZG93bmxv YWRzPyBUaGlzIGtpbmQgb2YgY29udGVudCBiZW5lZml0cyBmcm9tIEVDUyB3aGVuIHRoZSByZXNv bHZlciBpcyBmdXJ0aGVyIGF3YXkgZnJvbSB0aGUgY2xpZW50Lg0KDQo+IFtKTF0gSSB3b25kZXIg aWYgaXQgbWlnaHQgYmUgdXNlZnVsIGZvciBDRE5zIHRvIHB1Ymxpc2ggc29tZSBtZWFzdXJlbWVu dCB0ZXN0IFVSTHMgdGhhdCBhcmUgaGlnaGx5IGxvY2FsaXplZCAoZS5nLiBkaXN0cmlidXRlZCB3 aWRlbHkgJiBhcyBjbG9zZSBhcyBwb3NzaWJsZSB0byB1c2VycykuIFRoYXQgbWlnaHQgZW5hYmxl IGJldHRlciB0ZXN0aW5nIG9mIHBlcmZvcm1hbmNlIGZvciBhY2Nlc3NpbmcgY29udGVudCB0aGF0 IGJlbmVmaXRzIGZyb20gcHJveGltaXR5IHRvIHVzZXJzLiANCg0KW0FDXSBUaGlzIHdvdWxkIGJl IGhlbHBmdWwgZ2l2ZW4gaXQgYXBwZWFycyBzb21lIChhbGw/KSBEb0ggcmVzb2x2ZXJzIGhhdmUg aW5kaWNhdGVkIHRoYXQgdGhleSB3aWxsIG5vdCBwYXNzIHN1ZmZpY2llbnQgaW5mb3JtYXRpb24g dG8gKHJpdmFsKSBDRE4gdmVuZG9ycyB0byBhbGxvdyBnZW9ncmFwaGljIHJvdXRpbmcuICBDbGVh cmx5IGlmIHRoaXMgaXMgY29tbW9ucGxhY2UgdGhlbiBwZXJmb3JtYW5jZSBnYWlucyBmcm9tIERv SCwgaWYgYW55LCBjb3VsZCBiZSBsb3N0IGZyb20gYW4gZW5kLXVzZXIgcGVyc3BlY3RpdmUgZHVl IHRvIGluZWZmaWNpZW50IHJvdXRpbmcgb2YgY29udGVudC4gIA0KDQoNCkFuZHJldw0KwqANCg0K DQo= From nobody Mon Jul 22 13:59:39 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BE1CD120120; Mon, 22 Jul 2019 13:52:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ISPZzqp7F6qD; Mon, 22 Jul 2019 13:52:43 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [24.104.150.213]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A188712008C; Mon, 22 Jul 2019 13:52:43 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-9546.meeting.ietf.org [31.133.149.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 2494D892E8; Mon, 22 Jul 2019 20:52:42 +0000 (UTC) From: Paul Vixie To: dnsop@ietf.org Cc: Andrew Campling , "Livingood, Jason" , Puneet Sood , Kevin Borgolte , DoH WG , "pschmitt@cs.princeton.edu" , "jordanah@princeton.edu" , "feamster@uchicago.edu" , "add@ietf.org" , "dns-privacy@ietf.org" , Rob Sayre , "ahounsel@cs.princeton.edu" Date: Mon, 22 Jul 2019 20:52:39 +0000 Message-ID: <5018674.DSy9L6O0YW@linux-9daj> Organization: none In-Reply-To: References: <402781F4-33D8-4FD4-8087-FDCEFFF2D549@iseclab.org> <5F9202DE-ED2F-4F2A-8463-12334E54BC46@cable.comcast.com> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: X-Mailman-Approved-At: Mon, 22 Jul 2019 13:59:37 -0700 Subject: Re: [Doh] [DNSOP] [Add] [dns-privacy] Do53 vs DoT vs DoH Page Load Performance Study at ANRW X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Jul 2019 20:52:46 -0000 On Monday, 22 July 2019 20:45:43 UTC Andrew Campling wrote: > ... > > [AC] This would be helpful given it appears some (all?) DoH resolvers have > indicated that they will not pass sufficient information to (rival) CDN > vendors to allow geographic routing. Clearly if this is commonplace then > performance gains from DoH, if any, could be lost from an end-user > perspective due to inefficient routing of content. several people have disagreed with my public statements that "everyone should run their own rdns, don't use quad-anything" on the basis of the blender effect. when i tell them about ECS they stop talking, which is too bad, because they then don't get to hear the stories of how /32 and /128 are the default ECS subnet size for many ISP resolvers. apparently ECS creates problems for privacy, but _how could we have suspected_? -- Paul From nobody Mon Jul 22 14:20:11 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 68DAB1200B6; Mon, 22 Jul 2019 14:19:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nr3Nn1gc22uj; Mon, 22 Jul 2019 14:19:53 -0700 (PDT) Received: from shaun.rfc1035.com (smtp.v6.rfc1035.com [IPv6:2001:4b10:100:7::25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B6CD91200A3; Mon, 22 Jul 2019 14:19:53 -0700 (PDT) Received: from dhcp-8a04.meeting.ietf.org (dhcp-8a04.meeting.ietf.org [31.133.138.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 903C52421538; Mon, 22 Jul 2019 21:19:49 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: <5018674.DSy9L6O0YW@linux-9daj> Date: Mon, 22 Jul 2019 22:19:47 +0100 Cc: dnsop , DoH WG , "add@ietf.org" , "dns-privacy@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: <402781F4-33D8-4FD4-8087-FDCEFFF2D549@iseclab.org> <5F9202DE-ED2F-4F2A-8463-12334E54BC46@cable.comcast.com> <5018674.DSy9L6O0YW@linux-9daj> To: Paul Vixie X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Doh] [DNSOP] [Add] [dns-privacy] Do53 vs DoT vs DoH Page Load Performance Study at ANRW X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Jul 2019 21:19:55 -0000 > On 22 Jul 2019, at 21:52, Paul Vixie wrote: >=20 > apparently ECS creates problems for privacy, but _how could we have = suspected_? IIRC the ECS privacy issues were recognised at the time. They lost out = to the argument that CDNs were already doing (or about to do) ECS and it = would be better (for some definition of better) if this was done in a = way that had an RFC behind it. From nobody Mon Jul 22 14:27:57 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6DBAA1200B6; Mon, 22 Jul 2019 14:27:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fd71GAA_nA1A; Mon, 22 Jul 2019 14:27:36 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3D9221200A3; Mon, 22 Jul 2019 14:27:36 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-9546.meeting.ietf.org [31.133.149.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 97B76892E8; Mon, 22 Jul 2019 21:27:35 +0000 (UTC) From: Paul Vixie To: Jim Reid Cc: dnsop , DoH WG , "add@ietf.org" , "dns-privacy@ietf.org" Date: Mon, 22 Jul 2019 21:27:34 +0000 Message-ID: <2239147.6quBxzdCF9@linux-9daj> Organization: none In-Reply-To: References: <402781F4-33D8-4FD4-8087-FDCEFFF2D549@iseclab.org> <5018674.DSy9L6O0YW@linux-9daj> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Doh] [DNSOP] [Add] [dns-privacy] Do53 vs DoT vs DoH Page Load Performance Study at ANRW X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Jul 2019 21:27:38 -0000 On Monday, 22 July 2019 21:19:47 UTC Jim Reid wrote: > > On 22 Jul 2019, at 21:52, Paul Vixie wrote: > > > > apparently ECS creates problems for privacy, but _how could we have > > suspected_? (that, by the way, was sarcasm.) > IIRC the ECS privacy issues were recognised at the time. raised, yes. recognized, no. > They lost out to > the argument that CDNs were already doing (or about to do) ECS and it would > be better (for some definition of better) if this was done in a way that > had an RFC behind it. this was said, and was false, at the time. it's more obviously false today, i think. -- Paul From nobody Wed Jul 24 15:18:27 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E1CB7120372; Wed, 24 Jul 2019 14:18:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.999 X-Spam-Level: X-Spam-Status: No, score=-6.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nlnetlabs.nl Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A_-Zk3iRKwwq; Wed, 24 Jul 2019 14:18:09 -0700 (PDT) Received: from dicht.nlnetlabs.nl (dicht.nlnetlabs.nl [IPv6:2a04:b900::1:0:0:10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 511441202A7; Wed, 24 Jul 2019 14:18:09 -0700 (PDT) Received: from [10.0.1.190] (modemcable171.137-178-173.mc.videotron.ca [173.178.137.171]) by dicht.nlnetlabs.nl (Postfix) with ESMTPSA id B9FBF113D0; Wed, 24 Jul 2019 23:18:04 +0200 (CEST) Authentication-Results: dicht.nlnetlabs.nl; dmarc=fail (p=none dis=none) header.from=nlnetlabs.nl Authentication-Results: dicht.nlnetlabs.nl; spf=fail smtp.mailfrom=willem@nlnetlabs.nl DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nlnetlabs.nl; s=default; t=1564003085; bh=p6stGxKZbKPizs+mW8CTrg0eBwswg9fgLlduVG20WjA=; h=To:Cc:References:From:Subject:Date:In-Reply-To; b=KhFdwQKbTqIZjA16hI6E6bYwKfEl4aNIwkgHRYTS9/bhTFd1cGGOOl/lnSQEtQEy9 qPFciFCqeP91L7o1/Y+vmPyk7OdBNY/PELCQWyNzsJ4pZ+GJ5ABrROStd+VmzkNrV5 6GrpwInQdO8NZQXUUZ3xG3nMSDJa2fpO6JH77WIg= To: Puneet Sood , Kevin Borgolte Cc: DoH WG , add@ietf.org, pschmitt@cs.princeton.edu, dnsop WG , feamster@uchicago.edu, jordanah@princeton.edu, dns-privacy@ietf.org, Rob Sayre , ahounsel@cs.princeton.edu References: <402781F4-33D8-4FD4-8087-FDCEFFF2D549@iseclab.org> <267CBE74-9DC5-40D8-A61F-7C566644A1CB@iseclab.org> From: Willem Toorop Openpgp: preference=signencrypt Autocrypt: addr=willem@nlnetlabs.nl; prefer-encrypt=mutual; keydata= mQINBE1s81EBEACuJzGgccrmYEAzHc//vBq66gH7orM0GtKfQZHh4uR1FMxZXl07WevUYNuB ywTpinU9rpY1Q3S4w6QgNklgpsaHXmbOpyFjJ8FpllV8TRPiXiNrNxTpMnlb6InoszopX69t kBVHTP6cJkNgPx6R4BM0ARqEGQmOL8mAcoWyGVzbsamuGRaia54zs/kc3i9yiqEzRkoQmfwr 7sr49n7gOpmaqXvonOSiUvgEziep77emMcqVa/qZxR1r7KUq85qTNTqsQwl2cQdKS7WwOeuG 6ZIJmJ1bakriKzLBYF5xIHKSYJW0ZA20tNFrVKgTkEjiXvAJh4HlJEIi35tqa/IzWUJSc1ai nhBjxbwSl8BRq5aaPgwB+xXiDqY6BrQW1slvl5TF2A6Xr7JJ0rkH3EZgXxABAZ3WJ3RLwq1z 8jnNYj+UW/mSLsbOtgfOiBhFUXMZneHvVVvz6F6XAtyrejDl5sD2gnzm1VDfK6T6bvLtR7zr kWre0lpycDmgmUKgaEiXzfLvwT9RaWk8GdqU2GG+QOiwf+hT0peDieuodjMr59sUbx7GqVe/ 45rJBRSx+HCl2Jm7Th2Xr0kpStCd7ebVoEq9wpMyu+dM9wOTtibA9P3+9u4rAdimpAdQxEbh WbRNCng2EVhThbqRK3cTZLbtqKaWgAJqa/IQVpL9b5ps8Z4JVQARAQABtCNXaWxsZW0gVG9v cm9wIDx3aWxsZW1AbmxuZXRsYWJzLm5sPokCPgQTAQIAKAIbIwYLCQgHAwIGFQgCCQoLBBYC AwECHgECF4AFAlbUE5oFCRDr7kkACgkQ5fj4IS93pJiGfA/8C1+/M+EaQItVzQ/iPCbagBTq WOSispMzJne9gmimJzPs+lxgnrXOuYlIBywHpWB2Jmz45h+Cc4+di48WQfV9tHENn9MVFkwK zSdcY6v5eot6xSY5FRHS226MPR9UJ8/z5PvlizZUVbbM+Ngxg3Rx045Q0FnQm0o5VasEJ1Po R3CSiELJoZ13ukTk5pQlKyVknUKH1E1ds+Xtg1jpZBqiLiBzcLkKWYqBvrXI6XAEPr+woRgj 3xV8P24Uj232uK7xoe82jWIeZWXt/AbHBSmNOWPIgMd9i3FjdeTDml5sZSy3BlDYMr8hINen hYLhdLpJnXwPcsaj0ivcV+xSjLtSh0mE4gudcVhk5XR1M6emSlATC6+Bqn0M9JNTn4SHhkNS yo87aPwKqWFDlvjAZlRyPym9miJBlzech2uOlYSk6GFuead7MpGAipf5PwNNRKDMDi3y+H47 YG2izbrqj3cOZdqZmErwrzCU8xVkxzY/EY6w/MNMFNeqmXVGxzIZ8y9KAjH6JO96M/AxS4mX HJh1ocfHtSm90Ahy/HPJK+2+5+IgkAymKsvyIbvjs7FccMUo+OiSPWYi+xO/NXA4pBlUuGmV 55Kog7ym1flzo8OD9uHfLPrVORBHgnsITbzf9vgJ0emy8fxMCkzFT334gC1OVhD1ff1frbPX yVbcGI8AO+q5Ag0ETWzzUQEQAKTs4hWz94K66PtsHj/cBtHmJCJx9BsHP8eoUjd4iBR7cWgT Tgt1PGCNBzCPGIuUia808dqxu1L8OWjQpwXDCjXqAibn0mCJMRONVszxJKkjYnZGKGOo8cg7 OmQBZyEd6qrfxVf/dwHLsdQTJZzz9bGOxuYVAAu0q3PHW5gGFc+pp3eN47qzGMxEjsoETj/c laxjqisohG13/hkP6PvDoD7OOdOGdQQP8b4GRBD6rZ/FqMLv4C80zDnzCH1rLpNGQplf1any 06WTAsDL4f6gEALH62TIxOX4U7WxeuvHxyKXOAuN+ex/MvF2az124YbcWC7t1dqVW3ys20zK aememyXSKxV6aMn4KBcJF3CdM1oABZDyviL9el7Q/yQylpZC6El4QowaPIOAuzOdIc6cuM6P TWvBArcKVgQhWfJshfeFmfkxpz/hWc9K40yCjmb+hPZIr3RbXSsQItUUkBqOSMHNroIgX+Ia WMq3e7yMHdMqlKr0lU52lfBbfECjleB/NO4K3SGJBPzTgLtze+LsWxSJQoQMWKv6ISwQrW3r smUjqgQNrSGROX3rRy8Nvuzravs4a3FmdUpHIWw2KfY2M6AsX9HBFuRsimgqFjQm5VbqXA7N tHJCnA1RvqXlg/iJ5w+DElHosxwjHS+UbejDGmVQ+ITqlh3991osPjZq1Iy1ABEBAAGJAiUE GAECAA8CGwwFAlbUE5oFCRDr7kkACgkQ5fj4IS93pJjBwxAAnko5CSFDX/ZqW97satNacACH SAOOM8/jz1p2QtJSwbrbLsJRMpN1mSnjXWPBTmXoP4SGHGtxTVZxrYCpSMEHMqOV4yK3QlUn QXnf+CSvo2Ud3rpCh/lFLVHqG2Sy5Ietf/T+GGsoPd9DIdTHO0aFlW2yRQPxSrbYpv1v2aAC gRO4114qkex2j36diqlLod/OU4OQ51nuSesjTrUM9Fz6ikBJ1UDjakjAXe/HiRxUmdv4LANC mso+Gn17Co5lUdpn3fa8zTwNNAgLm6RBiBSSdaYExM9ir6pHrcWL5N+iZKnVmfE5CBufziZq 7V1E3I4FRuvDN4echbf58c6YxBQDsd9VZMJeFWY60w4JEXpHQdt129GS1FN/2PQ8NmAUXYCk YYk6Lv1tnGJCSLnD3ObLyWm+sjA5yAK2H8WU+nutsDF63yFJujNMpmB3bi9+699TzsyQNVKd 2fH38cgk1gZFb6Nbx9+lrTIwzAJJlOu8UwbR0HgGuRmrWp0EIm3tcy4xqWF3CavnM22BAOKK KH+qnwx8BRrx58coHQFMswW4W7Bo+jpKbQJ4RV2cXUEbmHbYUoXDHZyv/RzOI46dXAoWFc3o CoqLqpsZYZstJ4UJHXB5aHi1zxJDwzKxsflmSKfIUr3glRWCy/ylcPMEXzPBb3qbGFMUboio UjqLuNV4SSY= Message-ID: <0e59fc40-e25d-68b0-6759-b20484277086@nlnetlabs.nl> Date: Wed, 24 Jul 2019 17:18:03 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: X-Mailman-Approved-At: Wed, 24 Jul 2019 15:18:25 -0700 Subject: Re: [Doh] [DNSOP] [dns-privacy] Do53 vs DoT vs DoH Page Load Performance Study at ANRW X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 21:18:11 -0000 On 21-07-19 16:26, Puneet Sood wrote: > * The experiment was run from Princeton, New Jersey in Northeast US. > The location is in a very well connected part of the world between > network peering points in NYC and Washington DC. You will not see much > difference (due to network latency) between the cloud providers and > the default (local) Do53. Running the experiment from locations which > are further away from cloud providers would provide another > interesting set of data. Thanks for this Puneet and for stating this at the microphone during the presentation. I have some numbers that support this. At the hackathon at the African Internet Summit in Kampala Uganda one month ago, I participated with a team using RIPE Atlas to compare response time of the locally configured resolvers of RIPE Atlas probes in the Africa region, to the cloud resolvers 1.1.1.1, 8.8.8.8 and 9.9.9.9. On UDP, on the median, local resolvers returned responses 27 times quicker than the fastest cloud resolver: 2ms RTT for the local resolver versus 55ms for the fastest cloud resolver (which was 9.9.9.9). On TCP, local resolvers provide responses at least 6 times quicker. 14ms versus 94ms (again Quad9). We also measured DoT which had +-3 times longer response time than TCP on the cloud DNS providers. There were only very few probes with resolvers other than the quads that supported DoT, but those were also remote given their long round trip times. See also our post/report on: https://labs.ripe.net/Members/willem_toorop/hackathon-africa-internet-summit-2019 From nobody Thu Jul 25 11:37:03 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9DBFE1201A0 for ; Thu, 25 Jul 2019 11:37:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I55aW9oibQZG for ; Thu, 25 Jul 2019 11:36:59 -0700 (PDT) Received: from eidolon.nox.tf (eidolon.nox.tf [IPv6:2a07:2ec0:2185::]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 815F0120198 for ; Thu, 25 Jul 2019 11:36:59 -0700 (PDT) Received: from equinox by eidolon.nox.tf with local (Exim 4.92) (envelope-from ) id 1hqibp-001QCW-1P for doh@ietf.org; Thu, 25 Jul 2019 20:36:57 +0200 Date: Thu, 25 Jul 2019 20:36:57 +0200 From: David Lamparter To: doh@ietf.org Message-ID: <20190725183657.GV258193@eidolon.nox.tf> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit User-Agent: Mutt/1.10.1 (2018-07-13) Archived-At: Subject: [Doh] ISP position re. hardcoded DoH servers X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 18:37:02 -0000 Hi all, it happens to be that I run a small ISP in Germany. Probably one of the smallest, but this does give me the advantage that I have no company politics blocking me from things like sending this mail. First of all, I'm hoping to implement DoH as soon as possible on our ISP-side DNS caches. When that happens depends on the availability of an open source DoH cache, or maybe a DoH to "classical" converter that we can stack on top of our existing cache. We'd throw the DNS queries into our existing resolver either way, so I'd actually prefer a proxy over a full cache. At the same time, I will be working to send an all-users bulletin asking our users for their opinions regarding blocking any known hardcoded DoH servers in any application. Since I know our userbase reasonably well, I can predict that we will indeed be implementing this. Since we don't look at any layer 4 headers, this will take the form of simple IP/Prefix blackhole routes. Of course you can try and make this as painful as possible by stacking the DoH service onto something that users will miss. Maybe some well-visited front page. I have no way to isolate DoH traffic from other HTTPS traffic, and I wouldn't want it any other way. But I'll still block anything you hardcode, on layer 3. I'm doing this because you do not have informed consent from the users if you ship a general purpose application with some default DoH server. (btw: Single-purpose applications (e.g. Video streaming services) are a different story, nothing wrong with hardcoding an e.g. Netflix DoH server into the Netflix App. This is about general-purpose things like browsers.) The only way you can get informed consent is to present the user with a dialog box that asks "Do you want to perform all web name queries through ? [Yes] [No]". If you do that, I'll turn into your advocate instead of adversary. And while we're at it, I'd like to point out that a hardcoded DoH in an application is probably illegal in Germany. German law prohibits / invalidates "surprising" clauses (BGB §305c), and I'm reasonably confident a court will agree that sending all unrelated name lookups to a DoH server of the browser vendor's choice is surprising. The only way to fix that is to make it, well, not a surprise. Maybe ask your lawyers before you get the GDPR bill. (again, Netflix app sending DoH to Netflix: no surprise. Browser sending all name queries to some DoH: big surprise.) (I'm not a lawyer, the above is not legal advice, I'm just pointing out there might be a legal angle to this too.) It is what it is. Sorry about that. -David P.S.: I don't believe it is useful to respond to this mail. There's nothing technical to be discussed here, only philosophy. From nobody Thu Jul 25 12:43:44 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 750071201CE for ; Thu, 25 Jul 2019 12:43:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Be9U4kLEqgei for ; Thu, 25 Jul 2019 12:43:40 -0700 (PDT) Received: from mail-ua1-x92d.google.com (mail-ua1-x92d.google.com [IPv6:2607:f8b0:4864:20::92d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 925C91201C6 for ; Thu, 25 Jul 2019 12:43:40 -0700 (PDT) Received: by mail-ua1-x92d.google.com with SMTP id 8so20318178uaz.11 for ; Thu, 25 Jul 2019 12:43:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=ZRwI6Ww+IbJfES6pni0dRpQvQdGEmhAnhztCNlGpIhg=; b=PE1HO171afkiYbxwEO0GPzNpGs4Rn92/8q3WrDcer+uFunOIG4sxPR4/3292x5be4Q VJqa4xbZEm6QvA2umvX3o/sN68/HDcs09cvNCGtuul3lHqZ2l9KbVQhgcGZqY0x6QNfd ckDkIL3sttzE+LwSQ7Ic/XI3uESaYFOIdf+lowv0IuwCrT/QxNEw1LnFh0LP9ko7qTvf xvzNtrDmQKlKj6Czic0GrMj/V4yfXWMpQ+k8Xwc5ioTZf6a4l6PYq1/c1pKeYPwL6H/O 0GXn9YriCdbLxKyrBmvmEtQdXY1l1Nj/Hz8fXz5Mr8uXctiPGRqLMePxbmiSWhkOtqbI wvtQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=ZRwI6Ww+IbJfES6pni0dRpQvQdGEmhAnhztCNlGpIhg=; b=eVZ0QoHL/GJiEZvSPnrCdP/BD0BtCPE+1nJ3hsYMjq3GAs//9qC08WuYI9nGooBbF2 a93ygWvML9rHbp177DZjIVEYfISJ+OCNf4RA1LHMIO8+vNnqKWkqXVy/6JQCH9EDG+RE hVhNcAeoynbCHxNyRRoD83rTKV9TRAkn0w0ZZKuPfOCXcSz8tErN9zC031x/4KSnj4mY wbo3N+f/v60wMTOXSvy3dPj+TqHkbAUcFXTFEBVzCrs4Cv9k/rRk4OPR9G927sQ5HgHF Ay4IW9JZ7ihI9L8TmrhGtZqTdIhWULVUXs9TqSxGoztqQLuRiE5szR5JV5n8Hb2VUVjS pg5w== X-Gm-Message-State: APjAAAWV12tuwJf4k2Te63NrWv2LFXxlFN3dji6zZ/Q1liVk2UCZF+y2 yQflWVGU8vvNjptWMFfeY/26/7WHKONJtA== X-Google-Smtp-Source: APXvYqzUn2bNNyWvw2zH+541++Sq0H7zzpgVc5eyn/lI1Q+QXGnizxLCQqlmADi7JoqG7IfAWPGywQ== X-Received: by 2002:ab0:13e2:: with SMTP id n31mr3951853uae.61.1564083819238; Thu, 25 Jul 2019 12:43:39 -0700 (PDT) Received: from ?IPv6:2001:67c:1232:144:5581:1760:1fae:6b33? ([2001:67c:1232:144:5581:1760:1fae:6b33]) by smtp.gmail.com with ESMTPSA id a23sm2291402vkl.52.2019.07.25.12.43.38 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 25 Jul 2019 12:43:38 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Ted Lemon X-Mailer: iPhone Mail (16G77) In-Reply-To: <20190725183657.GV258193@eidolon.nox.tf> Date: Thu, 25 Jul 2019 15:43:37 -0400 Cc: doh@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <4F4BD393-20BA-4797-8665-1CE405B75964@fugue.com> References: <20190725183657.GV258193@eidolon.nox.tf> To: David Lamparter Archived-At: Subject: Re: [Doh] ISP position re. hardcoded DoH servers X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 19:43:42 -0000 I think there is an assumption in the approach you are taking that the threa= t model is centralized resolvers tracking users in a transparent way. I don=E2= =80=99t think it=E2=80=99s really a philosophical question to ask whether th= is is indeed the threat mode about which users should be concerned.=20 Sent from my iPhone > On Jul 25, 2019, at 2:36 PM, David Lamparter wrote: >=20 > Hi all, >=20 >=20 > it happens to be that I run a small ISP in Germany. Probably one of the > smallest, but this does give me the advantage that I have no company > politics blocking me from things like sending this mail. >=20 > First of all, I'm hoping to implement DoH as soon as possible on our > ISP-side DNS caches. When that happens depends on the availability of > an open source DoH cache, or maybe a DoH to "classical" converter that > we can stack on top of our existing cache. We'd throw the DNS queries > into our existing resolver either way, so I'd actually prefer a proxy > over a full cache. >=20 > At the same time, I will be working to send an all-users bulletin asking > our users for their opinions regarding blocking any known hardcoded DoH > servers in any application. Since I know our userbase reasonably well, > I can predict that we will indeed be implementing this. Since we don't > look at any layer 4 headers, this will take the form of simple IP/Prefix > blackhole routes. >=20 > Of course you can try and make this as painful as possible by stacking > the DoH service onto something that users will miss. Maybe some > well-visited front page. I have no way to isolate DoH traffic from > other HTTPS traffic, and I wouldn't want it any other way. But I'll > still block anything you hardcode, on layer 3. >=20 > I'm doing this because you do not have informed consent from the users > if you ship a general purpose application with some default DoH server. >=20 > (btw: Single-purpose applications (e.g. Video streaming services) are a > different story, nothing wrong with hardcoding an e.g. Netflix DoH > server into the Netflix App. This is about general-purpose things like > browsers.) >=20 > The only way you can get informed consent is to present the user with a > dialog box that asks "Do you want to perform all web name queries > through ? [Yes] [No]". If you do that, I'll turn into your > advocate instead of adversary. >=20 > And while we're at it, I'd like to point out that a hardcoded DoH in an > application is probably illegal in Germany. German law prohibits / > invalidates "surprising" clauses (BGB =C2=A7305c), and I'm reasonably > confident a court will agree that sending all unrelated name lookups to > a DoH server of the browser vendor's choice is surprising. The only way > to fix that is to make it, well, not a surprise. Maybe ask your lawyers > before you get the GDPR bill. >=20 > (again, Netflix app sending DoH to Netflix: no surprise. Browser > sending all name queries to some DoH: big surprise.) >=20 > (I'm not a lawyer, the above is not legal advice, I'm just pointing out > there might be a legal angle to this too.) >=20 >=20 > It is what it is. Sorry about that. >=20 >=20 > -David >=20 > P.S.: I don't believe it is useful to respond to this mail. There's > nothing technical to be discussed here, only philosophy. >=20 > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh From nobody Thu Jul 25 13:12:19 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F39951201DB for ; Thu, 25 Jul 2019 13:12:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Expme0sQkcRr for ; Thu, 25 Jul 2019 13:12:15 -0700 (PDT) Received: from eidolon.nox.tf (eidolon.nox.tf [IPv6:2a07:2ec0:2185::]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B5D931201E3 for ; Thu, 25 Jul 2019 13:12:15 -0700 (PDT) Received: from equinox by eidolon.nox.tf with local (Exim 4.92) (envelope-from ) id 1hqk60-0026th-QT; Thu, 25 Jul 2019 22:12:13 +0200 Date: Thu, 25 Jul 2019 22:12:12 +0200 From: David Lamparter To: Ted Lemon Cc: doh@ietf.org Message-ID: <20190725201212.GY258193@eidolon.nox.tf> References: <20190725183657.GV258193@eidolon.nox.tf> <4F4BD393-20BA-4797-8665-1CE405B75964@fugue.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <4F4BD393-20BA-4797-8665-1CE405B75964@fugue.com> User-Agent: Mutt/1.10.1 (2018-07-13) Archived-At: Subject: Re: [Doh] ISP position re. hardcoded DoH servers X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 20:12:18 -0000 On Thu, Jul 25, 2019 at 03:43:37PM -0400, Ted Lemon wrote: > I think there is an assumption in the approach you are taking that the > threat model is centralized resolvers tracking users in a transparent > way. I don’t think it’s really a philosophical question to ask whether > this is indeed the threat mode about which users should be concerned. Ok, let's get into a discussion about whether it's philosophical or not... But, first, just for completeness sake, it's been pointed out to me that browser vendors tried to clarify that they're putting up a user choice and there is FUD involved here. I'm perfectly happy if browsers offer the users the choice to use some DoH server. That's informed consent. To Ted's point, I don't care about how to value the threat model of centralized resolvers tracking their users. I'm actually not /that/ worried about the resolver operators doing it out of malice. The problem is that this ends up creating centrally administered high-value targets. This concerns me: - technically, since instances of the same DoH anycast service are likely set up close to identically, and likely to be subject to similar security issues - structurally, since a greater number of users can be compromised, or even just lose service, by breaking a smaller number of targets - philosophically, since one centrally administered / coordinated structure is more susceptible to subversion or legal compromise than a decentralized one. We live in the age of headline news on database leaks and privacy breaches. Of course we'll all do our best to audit our code and operational practices and make them as unlikely as possible. But, sh*t /will/ hit the fan at some point... I decided I prefer a few smaller turds over one big one. These *are* problems even if people have informed consent. But, if they opted to use Gooflare or Netzilla DNS - they made their choice, they got it. (And we're back to philosophy, because I do see some merit in the argument that a few competent people might build more secure and private DNS than a million incompetent ones.) Cheers, -David From nobody Thu Jul 25 15:19:58 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ED67C1201F1 for ; Thu, 25 Jul 2019 15:19:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MSGID_FROM_MTA_HEADER=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UGKCWDrXgFHP for ; Thu, 25 Jul 2019 15:19:53 -0700 (PDT) Received: from atl4mhob07.registeredsite.com (atl4mhob07.registeredsite.com [209.17.115.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9CC891201D1 for ; Thu, 25 Jul 2019 15:19:53 -0700 (PDT) Received: from mailpod.hostingplatform.com (atl4qobmail03pod6.registeredsite.com [10.30.71.211]) by atl4mhob07.registeredsite.com (8.14.4/8.14.4) with ESMTP id x6PMJokP030192 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL) for ; Thu, 25 Jul 2019 18:19:51 -0400 Message-Id: <201907252219.x6PMJokP030192@atl4mhob07.registeredsite.com> Received: (qmail 20119 invoked by uid 0); 25 Jul 2019 22:19:50 -0000 X-TCPREMOTEIP: 207.164.135.99 X-Authenticated-UID: jw@pcthink.com Received: from unknown (HELO ?10.254.153.242?) (jw@pcthink.com@207.164.135.99) by 0 with ESMTPA; 25 Jul 2019 22:19:50 -0000 SavedFromEmail: jw@pcthink.com Date: Thu, 25 Jul 2019 18:19:46 -0400 In-Reply-To: <20190725201212.GY258193@eidolon.nox.tf> Importance: normal From: =?UTF-8?Q?JW_=CE=BB_John_Woodworth?= To: David Lamparter , Ted Lemon Cc: jw@pcthink.com, doh@ietf.org MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="--_com.samsung.android.email_2795714866355590" Archived-At: Subject: Re: [Doh] ISP position re. hardcoded DoH servers X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 22:19:57 -0000 ----_com.samsung.android.email_2795714866355590 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: base64 Ci0tLS0tLS0tIE9yaWdpbmFsIG1lc3NhZ2UgLS0tLS0tLS1Gcm9tOiBEYXZpZCBMYW1wYXJ0ZXIg PGVxdWlub3hAZGlhYzI0Lm5ldD4gPiBPaywgbGV0J3MgZ2V0IGludG8gYSBkaXNjdXNzaW9uIGFi b3V0IHdoZXRoZXIgaXQncyBwaGlsb3NvcGhpY2FsPiBvciBub3QuLi4+IEJ1dCwgZmlyc3QsIGp1 c3QgZm9yIGNvbXBsZXRlbmVzcyBzYWtlLCBpdCdzIGJlZW4gcG9pbnRlZCBvdXQgdG8gbWU+IHRo YXQgYnJvd3NlciB2ZW5kb3JzIHRyaWVkIHRvIGNsYXJpZnkgdGhhdCB0aGV5J3JlIHB1dHRpbmcg dXAgYSB1c2VyPiBjaG9pY2UgYW5kIHRoZXJlIGlzIEZVRCBpbnZvbHZlZCBoZXJlLsKgIEknbSBw ZXJmZWN0bHkgaGFwcHkgaWY+IGJyb3dzZXJzIG9mZmVyIHRoZSB1c2VycyB0aGUgY2hvaWNlIHRv IHVzZSBzb21lIERvSCBzZXJ2ZXIuPiBUaGF0J3MgaW5mb3JtZWQgY29uc2VudC5BZ3JlZWQuSSBk b24ndCBwZXJzb25hbGx5IGhhdmUgYW4gaXNzdWUgd2l0aCBpbXBsZW1lbnRpbmcgYSBuZXcgdHJh bnNwb3J0IG1lY2hhbmlzbSBhbmQgZm9yIHRoZSBtb3N0IHBhcnQgdGhlIGVuY3J5cHRpb24uQWN0 dWFsbHksIGFzIGEgX3VzZXJfIEkgbG92ZSB0aGUgZW5jcnlwdGlvbiBhc3BlY3Qgb2YgRG9UIGFu ZCBEb0guwqAgTXkgX3BlcnNvbmFsXyBwcmVmZXJlbmNlIHdvdWxkIGJlIGEgbG9jYWwgc2Vydmlj ZSDDoCBsYSBuc3N3aXRjaCB0byBvZmZlciBzb21lIGNvbnNpc3RlbmN5IGFyb3VuZCBteSBVWC5I b3dldmVyLCBhcyB0aGF0IHNhbWUgdXNlciwgSSBkb24ndCB3YW50IHRoZSBwcm92ZXJiaWFsIHJ1 ZyBwdWxsZWQgb3V0IGZyb20gdW5kZXIgbWUuwqAgQXBwbGljYXRpb25zIHRoYXQgZG8gdGhlIHVu ZXhwZWN0ZWQgYXJlIGdlbmVyYWxseSBjb25zaWRlcmVkIGJ1Z2d5IG9yIG1hbHdhcmUgKHNvbWV0 aW1lcyBib3RoPykuwqAgSW4gb3RoZXIgd29yZHMgLS0gd2hlbiBpdCBjb21lcyB0byBtb3Zpbmcg bXkgY2hlZXNlLCBhc2ssIG9yIGZvciB0aGUgbG92ZSBvZiBldmVyeXRoaW5nIHNhY3JlZCAtLSBk b24ndCBkby4ywqIsVXNlciBKb2hu ----_com.samsung.android.email_2795714866355590 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: base64 PGh0bWw+PGhlYWQ+PG1ldGEgaHR0cC1lcXVpdj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0 L2h0bWw7IGNoYXJzZXQ9VVRGLTgiPjwvaGVhZD48Ym9keSBkaXI9ImF1dG8iPjxkaXY+PGJyPjwv ZGl2PjxkaXYgc3R5bGU9ImZvbnQtc2l6ZToxMDAlO2NvbG9yOiMwMDAwMDAiIGRpcj0iYXV0byI+ PC9kaXY+PGRpdiBzdHlsZT0iZm9udC1zaXplOjEwMCU7Y29sb3I6IzAwMDAwMCIgZGlyPSJhdXRv Ij48L2Rpdj48ZGl2IHN0eWxlPSJmb250LXNpemU6MTAwJTtjb2xvcjojMDAwMDAwIiBkaXI9ImF1 dG8iPjwhLS0gb3JpZ2luYWxNZXNzYWdlIC0tPjxkaXY+LS0tLS0tLS0gT3JpZ2luYWwgbWVzc2Fn ZSAtLS0tLS0tLTwvZGl2PjxkaXY+RnJvbTogRGF2aWQgTGFtcGFydGVyICZsdDtlcXVpbm94QGRp YWMyNC5uZXQmZ3Q7IDwvZGl2PjxkaXY+PGJyPjwvZGl2PjwvZGl2PiZndDsgT2ssIGxldCdzIGdl dCBpbnRvIGEgZGlzY3Vzc2lvbiBhYm91dCB3aGV0aGVyIGl0J3MgcGhpbG9zb3BoaWNhbDxkaXYg ZGlyPSJhdXRvIj4mZ3Q7IG9yIG5vdC4uLjxiciBkaXI9ImF1dG8iPjxiciBkaXI9ImF1dG8iPiZn dDsgQnV0LCBmaXJzdCwganVzdCBmb3IgY29tcGxldGVuZXNzIHNha2UsIGl0J3MgYmVlbiBwb2lu dGVkIG91dCB0byBtZTwvZGl2PjxkaXYgZGlyPSJhdXRvIj4mZ3Q7IHRoYXQgYnJvd3NlciB2ZW5k b3JzIHRyaWVkIHRvIGNsYXJpZnkgdGhhdCB0aGV5J3JlIHB1dHRpbmcgdXAgYSB1c2VyPC9kaXY+ PGRpdiBkaXI9ImF1dG8iPiZndDsgY2hvaWNlIGFuZCB0aGVyZSBpcyBGVUQgaW52b2x2ZWQgaGVy ZS4mbmJzcDsgSSdtIHBlcmZlY3RseSBoYXBweSBpZjwvZGl2PjxkaXYgZGlyPSJhdXRvIj4mZ3Q7 IGJyb3dzZXJzIG9mZmVyIHRoZSB1c2VycyB0aGUgY2hvaWNlIHRvIHVzZSBzb21lIERvSCBzZXJ2 ZXIuPC9kaXY+PGRpdiBkaXI9ImF1dG8iPiZndDsgVGhhdCdzIGluZm9ybWVkIGNvbnNlbnQuPC9k aXY+PGRpdiBkaXI9ImF1dG8iPjxicj48L2Rpdj48ZGl2IGRpcj0iYXV0byI+PGJyPjwvZGl2Pjxk aXYgZGlyPSJhdXRvIj5BZ3JlZWQuPC9kaXY+PGRpdiBkaXI9ImF1dG8iPjxicj48L2Rpdj48ZGl2 IGRpcj0iYXV0byI+SSBkb24ndCBwZXJzb25hbGx5IGhhdmUgYW4gaXNzdWUgd2l0aCBpbXBsZW1l bnRpbmcgYSBuZXcgdHJhbnNwb3J0IG1lY2hhbmlzbSBhbmQgZm9yIHRoZSBtb3N0IHBhcnQgdGhl IGVuY3J5cHRpb24uPC9kaXY+PGRpdiBkaXI9ImF1dG8iPjxicj48L2Rpdj48ZGl2IGRpcj0iYXV0 byI+QWN0dWFsbHksIGFzIGEgX3VzZXJfIEkgbG92ZSB0aGUgZW5jcnlwdGlvbiBhc3BlY3Qgb2Yg RG9UIGFuZCBEb0guJm5ic3A7IE15IF9wZXJzb25hbF8gcHJlZmVyZW5jZSB3b3VsZCBiZSBhIGxv Y2FsIHNlcnZpY2Ugw6AgbGEgbnNzd2l0Y2ggdG8gb2ZmZXIgc29tZSBjb25zaXN0ZW5jeSBhcm91 bmQgbXkgVVguPC9kaXY+PGRpdiBkaXI9ImF1dG8iPjxicj48L2Rpdj48ZGl2IGRpcj0iYXV0byI+ SG93ZXZlciwgYXMgdGhhdCBzYW1lIHVzZXIsIEkgZG9uJ3Qgd2FudCB0aGUgcHJvdmVyYmlhbCBy dWcgcHVsbGVkIG91dCBmcm9tIHVuZGVyIG1lLiZuYnNwOyBBcHBsaWNhdGlvbnMgdGhhdCBkbyB0 aGUgdW5leHBlY3RlZCBhcmUgZ2VuZXJhbGx5IGNvbnNpZGVyZWQgYnVnZ3kgb3IgbWFsd2FyZSAo c29tZXRpbWVzIGJvdGg/KS4mbmJzcDsgSW4gb3RoZXIgd29yZHMgLS0gd2hlbiBpdCBjb21lcyB0 byBtb3ZpbmcgbXkgY2hlZXNlLCBhc2ssIG9yIGZvciB0aGUgbG92ZSBvZiBldmVyeXRoaW5nIHNh Y3JlZCAtLSBkb24ndCBkby48L2Rpdj48ZGl2IGRpcj0iYXV0byI+PGJyPjwvZGl2PjxkaXYgZGly PSJhdXRvIj48YnI+PC9kaXY+PGRpdiBkaXI9ImF1dG8iPjLCoiw8L2Rpdj48ZGl2IGRpcj0iYXV0 byI+VXNlciBKb2huPGJyIGRpcj0iYXV0byI+PGJyPjwvZGl2PjwvYm9keT48L2h0bWw+ ----_com.samsung.android.email_2795714866355590--