From nobody Fri Jul 27 16:00:32 2018 Return-Path: X-Original-To: resolverless-dns@ietf.org Delivered-To: resolverless-dns@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 280751277C8; Fri, 27 Jul 2018 16:00:27 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IETF Secretariat To: "IETF Announcement List" Cc: mcmanus@ducksong.com, adam@nostrum.com, warren@kumari.net, resolverless-dns@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.83.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: ietf@ietf.org Message-ID: <153273242708.421.17530275616993790137.idtracker@ietfa.amsl.com> Date: Fri, 27 Jul 2018 16:00:27 -0700 Archived-At: Subject: [Resolverless-dns] New Non-WG Mailing List: Resolverless-dns X-BeenThere: resolverless-dns@ietf.org X-Mailman-Version: 2.1.27 List-Id: Resolverless DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 27 Jul 2018 23:00:27 -0000 A new IETF non-working group email list has been created. List address: resolverless-dns@ietf.org Archive: https://mailarchive.ietf.org/arch/browse/resolverless-dns/ To subscribe: https://www.ietf.org/mailman/listinfo/Resolverless-dns Purpose: Handling of DNS information obtained from sources other than configured resolvers. For additional information, please contact the list administrators. From nobody Mon Jul 30 04:45:54 2018 Return-Path: X-Original-To: resolverless-dns@ietfa.amsl.com Delivered-To: resolverless-dns@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 59B5B13107B for ; Mon, 30 Jul 2018 04:45:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.021 X-Spam-Level: X-Spam-Status: No, score=-6.021 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.979, RCVD_IN_DNSWL_HI=-5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nic.cz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XcMBmoSH3IKc for ; Mon, 30 Jul 2018 04:45:52 -0700 (PDT) Received: from mail.nic.cz (mail.nic.cz [IPv6:2001:1488:800:400::400]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B9313131078 for ; Mon, 30 Jul 2018 04:45:48 -0700 (PDT) Received: from [IPv6:2001:67c:1220:80c:8466:4f64:ab50:fdfc] (unknown [IPv6:2001:67c:1220:80c:8466:4f64:ab50:fdfc]) by mail.nic.cz (Postfix) with ESMTPSA id 5684E601FC for ; Mon, 30 Jul 2018 13:45:47 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nic.cz; s=default; t=1532951147; bh=DNf/PGWyl1chTahU8bNISTcpYD4uCHuQ0wu5CwKs35I=; h=To:From:Date; b=j8UHeAk6B9KMGYjDd1R6PGkIr38Y7IbIM+fUbq9EBt4muhNKFZvfCFfVqG82fwkA1 +Kz+K+faVbIFEaMatw2kvfRrH3TFlhs4HEe/z4qk0AJiXyR4ZqICj76leuLeNC972V QRJ7nQVNxNHg8+44iK8KmS5pyD1oXWpaUNBwUKRo= To: resolverless-dns@ietf.org From: =?UTF-8?B?UGV0ciDFoHBhxI1law==?= Openpgp: preference=signencrypt Autocrypt: addr=petr.spacek@nic.cz; prefer-encrypt=mutual; keydata= xsFNBFhri/0BEADByTMkvpHcvPYwyhy0IDQ1B2+uU6AWP0QJQB3upM/YqxoJBeMQ5SxpO+W6 BsU0hTIF90AKIgiiDtMH1oNhHnzRXqePKORIgL3BbH5OxGcbqCYk1fIKk43DliCN1RcbTyRV REnCRQGWMTUbRS/jQ3uyTAX4rT0NhPWhPy6TMLGEg6WJJz0IzhBEw3TitvAlq6XHbi5EZYwU AHqIcuqr3sS+qkWqlIBlahu1hqhTcmYGz7ihjnWkOFi1rjRfLfudAtgFpUSmsixh2tifdy+C d8OBQbtF2kM7V1X5dUzw/nUBXm1Qex2qohRmCspwqivu7nlDMrLoilmPaeoR5evr5hpIDdfP cJAPTJk4n56q6MTHFJWkGa0yq13AJHLANNjQ/dF+W6Dhw9w2KBpuw0iGZQBBf5G9SQ1xJ+tU 9filaldsTAX1gMkVso//kGEbuRIJnJr7Z8foE/zofFyoAv21VWy2vpgQ3CnEWOZMSmYH7/gZ qcM7nfkjk4zAijpjYA3qlXoWa44/nrkAGvt7sAMsxY1C2H7tr3h3/rwyfbBqQ9nMpNwYLXXa Dil7uzyqlpKDjwWCzYd3sH7ATyT4htrd0BY5+IFimSfHyLwixhakH8E14YYyV9tzkrB7fiWd g7+zDThLtZMvtrehtkjVDPT50xg8TMr68hd3GRWBUJHszMTnlQARAQABzSJQZXRyIMWgcGHE jWVrIDxwZXRyLnNwYWNla0BuaWMuY3o+wsF9BBMBCAAnBQJYa4wfAhsDBQkDwmcABQsJCAcC BhUICQoLAgQWAgMBAh4BAheAAAoJEM6N1qGlCiHkjGoP/3fvimzczcaqPM8lgY9fKKcr2DhH 42HF+fXsj0SvPeEoYDuWwIcsTGna6sdmrhCD/mB6eCNivAOcZYDH7j3YDgdFX2xy1sRY0ylF uyfcOT1Qn1xNTglSaf00gUWDgLBQB/USphB9Of6U1ka4gLJpCWKoZ3cLQe09cUpq9HOZYs/g WSNx9UTr06fcO0rtgZpg+IZJN/R2ORhQBwk4n2Dtx5J+Xyoy7ht1Fwz07BWAGJ4P8oJOhsi1 LukDD8ul3+6IeoSbRvyGpP6boegaMwxPR10VgsrYU2t1cK58iRv/xJ3TClb0JBn5aI3Bmh1j mPROrC55tvxRoeRLmxXHzbPZpWdbRjEcf9SEiAGNTgo9C+eXbubeSETWgisfJhZ4ebhkHnfz e+e+hvbaTSoFyMbKeOlfoYCmaDRBgT53i72HIkvO+HrVcmulZytw/yyOHuwObEFVgn3AeORv rb8I1kiv5W4wnZxDslhCeRR+wMGiKhc9ewU/mg3Rqo6GN+8mT0DHnsHuq1lu3WYslfNYkBSo nFcctFD2KXVozrwpn3vWJ4Qt6qu5XS1lDCD5WshZXh7qoISWnnMqsMyBW/R7WyiABeIz4uOg SkRwT2wSUYr+JtBZIjREy2JQDVhjf18DL1Qa7OxSes8YwWSx1pQAzwbfFx0gzRDyIT/39le4 pX430yTQzsFNBFhri/0BEADFp4ZfxSoKTAad0IkFK9CVoZ6XKywYLFNPPhzw++gbvHL2EX7Q qhEsqbsWMYpH4jc/Kq55OYYU/lIcULuD0Y9oDR26XFQou0FeSNnzRGb607U8OFOPQ+ei92Mm 1YPQ33GPj8GqbQpkAp35sfjJ64TH/EQY38RN33jsHRkhwtWU/6yo+RZs7cFRuihuLl8FuoP0 A5u/x+lNNeIBk8f27LVYrF81NSDDDYjnObCah+QLzGAwGDtjWkBVawpoHWwq58OQSx5piwyO CnFJeFONRcTRgOz239rsEA5LeYfmOGcnNwG6CHoJ5ZdWJw5OV9BoA7UTHG95xVHV5QiEm6q6 igI6wKV2RtFS7Roe0Wt8H7gC41JeqaKTUsGkz6uJraF8mmKyS8E+mSh3djmqdJNHF1pJqKxA xPYA9Y0jPnYWeEH4fPeOR2YvBjztsye9nOv1AuKNu03duzocyU95DfP/lwNJr5SH918Vf1t7 WcJj9dg6J9Jc5LOwg13Qr31TuZijrMdqM7LJKC/0tOkSeXNoMlHJOIqbqm7N414I0HytbENf 7AiyDxNA5TzJKkB0eBPLm2FMQCHLfasJHgbCrQut6nYw3f3Gn3+PDzGEHI9sfQv/mYvO77oR SGw+3Hy1ToxIncIirAyRpa5KdPLklDpADvpfkXjuL6IfZZ0OIWKLSRa/DQARAQABwsFlBBgB CAAPBQJYa4v9AhsMBQkDwmcAAAoJEM6N1qGlCiHkn54P/AgyzrffYzRq6d7vHfFhd8HzHHrU BtOK+5182DME1JX9Aow5Dy9kbfxAfTc4tbCY5EnhoUICbmVAJ5wL5lrGxQPSnulIyF8OmJjc VlGI6zXYvP0VHZ/L8dPcf+RPqhMCPpaxe2+h5XpPxvOkDLlnCrsA4J1bAGW5kpxdGnY4aRrv aKhtGMqgSwSx25l3RnoOROU/hTDV4EHCuTkMRfILmsuNT7It40iL5nyDiJ8o3p1CLjRwUzVn 4r4jE8DXhbWXaKJ0KQZpKiQDVV7qJcJIeBJvZpFfxJ44LxBct9TkC69ROntYhd6M7031DT3P IYW9VyMhLN5dRfzhEdFUc+3AlnoOOKcGwYiCnH2DwDva3ZicOAH8099mWZcwVL/sjKKbJGPo JbdT9C3gSnsoa3uBbsiChRhAno80Jsk/igb4QaMw4PsS3230kfBGkQ/oAPPM0iJ9kn8NXB/9 iBe5cKEUiiYQfSn9x1HyG0sT3/jSYaq3obmBNHJE24w/RKWoPsaKjoyaInAuU5L0cNZ30OWd eWFREIxlajFl2vXb9nCc80/i6PceJySiyJgd5cYEL4hfn/B6RXph9kAJySsqlIZoBhcwneGX mAS0M41jJjuIQdt5pkLhM9XoXjBFMGGtA/CtiicEgitItJfVCxdLG4bZOCrfPmevMGLxpEmB GouQ9dVQ Organization: CZ.NIC Message-ID: Date: Mon, 30 Jul 2018 13:45:47 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit X-Virus-Scanned: clamav-milter 0.99.2 at mail X-Virus-Status: Clean Archived-At: Subject: [Resolverless-dns] definition of resolverless operation X-BeenThere: resolverless-dns@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: Resolverless DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Jul 2018 11:45:54 -0000 Dear resolverless-participants, let me start with a simple question: What should I imagine when I read "resolverless" DNS? Does it mean that "each client does DNS resolution on its own"? That would resemble situation where each client has its own DNS resolver instance and does full recursion. Is this analogy correct? If not, what other definition of resolverless is used in this mailing list? Thank you for your patience with people who were not in Montreal! -- Petr Špaček @ CZ.NIC From nobody Mon Jul 30 05:41:45 2018 Return-Path: X-Original-To: resolverless-dns@ietfa.amsl.com Delivered-To: resolverless-dns@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9487C13108C for ; Mon, 30 Jul 2018 05:41:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q1u66H2Cy8Gn for ; Mon, 30 Jul 2018 05:41:41 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 21870131094 for ; Mon, 30 Jul 2018 05:41:38 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 541F1280186; Mon, 30 Jul 2018 14:41:36 +0200 (CEST) Received: from relay01.prive.nic.fr (pa-th3.interco.nic.fr [192.134.4.74]) by mx4.nic.fr (Postfix) with ESMTP id 4DDDE28015F; Mon, 30 Jul 2018 14:41:36 +0200 (CEST) Received: from b12.nic.fr (b12.users.prive.nic.fr [10.10.86.133]) by relay01.prive.nic.fr (Postfix) with ESMTP id 4833664228C0; Mon, 30 Jul 2018 14:41:36 +0200 (CEST) Received: by b12.nic.fr (Postfix, from userid 1000) id 3825A3FFE4; Mon, 30 Jul 2018 14:41:36 +0200 (CEST) Date: Mon, 30 Jul 2018 14:41:36 +0200 From: Stephane Bortzmeyer To: Petr =?utf-8?B?xaBwYcSNZWs=?= Cc: resolverless-dns@ietf.org Message-ID: <20180730124136.bue3s6hjvsnrouj5@nic.fr> References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: X-Operating-System: Debian GNU/Linux 9.5 X-Kernel: Linux 4.9.0-6-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: NeoMutt/20170113 (1.7.2) X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2018.7.30.122717 Archived-At: Subject: Re: [Resolverless-dns] definition of resolverless operation X-BeenThere: resolverless-dns@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: Resolverless DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Jul 2018 12:41:44 -0000 On Mon, Jul 30, 2018 at 01:45:47PM +0200, Petr Špaček wrote a message of 11 lines which said: > What should I imagine when I read "resolverless" DNS? The way I understand it, there is a resolver, but the clients can also get domain name data without going through a resolver. For instance, the HTTP server you are currently talking with could push domain name data to you (may be with a variant of DoH) and you may accept it, and even populate your cache with it (the rationale being that the HTTP server for example.com may be at least as authoritative for foobar.example.com than the resolver). From nobody Tue Jul 31 11:44:36 2018 Return-Path: X-Original-To: resolverless-dns@ietfa.amsl.com Delivered-To: resolverless-dns@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F0017130E69 for ; Tue, 31 Jul 2018 11:44:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.801 X-Spam-Level: X-Spam-Status: No, score=-0.801 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=riseup.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 236X1IZhQzpW for ; Tue, 31 Jul 2018 11:44:33 -0700 (PDT) Received: from mx1.riseup.net (mx1.riseup.net [198.252.153.129]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 358A4130E5E for ; Tue, 31 Jul 2018 11:44:33 -0700 (PDT) Received: from cotinga.riseup.net (cotinga-pn.riseup.net [10.0.1.164]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client CN "*.riseup.net", Issuer "COMODO RSA Domain Validation Secure Server CA" (verified OK)) by mx1.riseup.net (Postfix) with ESMTPS id AD6481A060B for ; Tue, 31 Jul 2018 11:44:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=riseup.net; s=squak; t=1533062672; bh=E8LJ2DlXgAREBNSA3Dsogo3dleBNFm21RJD/U7cXexA=; h=To:In-Reply-To:From:Subject:Date:From; b=XdUdEIYAk9xyDj8qphvuPNprYYLry9W0iyWxTxhHKSuaZ1VbbZ3gY33QWVe1z3Gkk nno53YqS5mEEebjExBNuFQKp9srY4Q76TXRACRZoLaw5qnvMXHruXqkYbPVuryXoxu kcg/mCqUlGXrCTiUeFDysKdiXYD0NKhSpLdfaaqo= X-Riseup-User-ID: C4F828E55C3EC542EEABA338E0D2FC430D4B00191A51DD9DB1B124B86B5E2756 Received: from [127.0.0.1] (localhost [127.0.0.1]) by cotinga.riseup.net with ESMTPSA id 92A5F619FC for ; Tue, 31 Jul 2018 11:44:31 -0700 (PDT) To: resolverless-dns@ietf.org In-Reply-To: From: nusenu Openpgp: preference=signencrypt Autocrypt: addr=nusenu-lists@riseup.net; prefer-encrypt=mutual; keydata= xsFNBFj53gUBEADYKwT0pW1yiqt6UReZW8T2nXVCyeVT2G6z7AvW69afp82uthRH237pQ7Qs 5vq91DivN6fGN6cVksp0N9Yv+5HEQAwUxpLfcNDcGzmHMd0JMItEtozGv3a4FuiUoHAqeGXM 6Kzi3v5F2PZGF+U4QaGKEZq6u50gO/ZFy4GfC9z9tsO6Cm7s7KldVHMGx/a0MEGMwh6ZI9x2 hGXSSAKu58KRUkEpHzDiQTj+/j58ndNfZRQv6P5BLppHADRPqwEOm4RQcQYskyM0FdKXbJ8E 5GW268meflfv2BASsl3X/Xqxp+LNrstXIbFZ+38hVlQDDmdvaASpPTzIAxf8FxMYZqI+K1UE kP5nU45q84KiZoXwT6YYJDKToLSDnYkKlsrCSnLkE3Nb/IexgNoYO4nE6lT9BDV3athQCWw1 FwB5idRYWnIqbVgUFgYZDUdZBJmeTEeI+Wn5hFz6HvFVc/+haMVTcoEKSkG/tsSGsKOc2mp6 z+71io9JWrVQGmw7OeZeE4TvkF9GhwS8jrKO4E0crfcT/zT6368PZCO6Wpir8+po/ZfOWbbh 1hi3MxmXn4Fki55Zrvhy3sf28U+H/nByQV4CssYv/xVhIZsN/wNQLcDLgVs4JTBUik8eQR0Y Qrq9lG3ZVtbpEi7ZTJ6BOGIn2TKHsVIVGSQA0PdKpKYV45Lc4QARAQABzSBudXNlbnUgPG51 c2VudS1saXN0c0ByaXNldXAubmV0PsLBfQQTAQgAJwUCWPneBQIbAwUJBaOagAULCQgHAgYV CAkKCwIEFgIDAQIeAQIXgAAKCRCtYTjCRc1Cfq/kD/sHx+mnL6OLwJvBj1rVTyoHJYJARajz Go0yRlbrZSH6Z05OD3SDR9UVpWOZeY8JyFoTyCFQjAbIVjKifj0uSmi0j1iahrAgGGfik0cN XUkCxrW6jcJQ37EbvYWu4PryqLuC7IeQW1wCcB1ioyGYKkm2K6LZ9rzZPVYSmPohJ+gVI0Jt EdlNZl4JuZot9eA5w/22uvcStQHzXDsUxfqK8OAJpU8E3iBBdNpLPMDWpFz4g2yw5PD6jZ+K Q39PYMUFULaKe4YCw1O+0MFhZJI4KEcRYHuVy1b3cJjxzgVfEyFctLDsO1sh07vBhoVKUi8W e00pvGtv8QYxxMYIA3iACbsjGEr69GvvZ2pAnu9vT9OUCaES4riDCxbkMxK/Cbwk8F6mo0eq HDQ7sOZWQv81ncdG9ovlA7Pj96cEXgdtbbllF1aUZ8sAmT14YjGzhArGv7kyJ1imH5tX3OXk hBGA9JTk2mDNjEpFaTEajSvDiKyeEhWNTLm15siWkpg1124yjUkhQ3OCkw7aUDMiVn8+DQHo J2pP/84uUvngbhm1jV7nk8mxTUFgppUePkb5hhnRRzeK72QY00EwRdn7qnpNgijMJ3Fpjfy2 EeCEl3nNdcB7U0F+0ijA6P/+DROldxNr4eiP50RvV8XiW/yi2IkKBk50GNB87yYnDETxxx/c 2i00AM7BTQRY+d4FARAAwJZ6U7UT8uB1WCfLK3AOR1Wa9bzOAghlTR4WXbHB4ajQKG7/Fzud 99bnwD0V3/AOVz/SbGDyHe+7HMvd1A0Ll4NgyH6OpxY7wOwCXAYTAbcXLpM7eKTjjsb9A9XG 3FcIGvjcy76OkaewqhiABaShlStEYcPkRusHZuecXtCnfCjJKihU/kinWpBO9gY6SrF2KFCw aeS4r37brXQ9y8uy3gZ168QFuIa5AKfL0r5YN3k4StNSA2p5Z/pufWXMN3B03QC+3fireiz3 dinlHK6XjUW8oWSdNxJhexT/lUw+episNuWTQruy7PD+HeohYGXqjggmPUiWc171Sewb2f8H CHViHMee8QXqo/LSRkYVrtsx0HUSMKsVQOma/u2By03ucroIkQJQQfqX3YpK1i3EpUO2L0/m E8UpBvUm1vrst54EFym4tYNJTj9reVffFKh2cczmPVN5o8v3RrdTF96mGtcb9EJbGV4277ZE LqUspviEBXynqU3yZ48JhIWHj22/ha6TeBpapYZDOJ8lePed8E34J/GYE2YXl65LhpXAKvWz O3KiByGMysb9Li6zqZ9/BYQtg5CA6Q8Oo7pBxK4iiDH3GX2WvymmLoaOBpOaIYdvKr39fajE mzfbg7TdZKXxqp2KDrbw7vUJLDyrmPWpxHyhKHItzoi1Y59wzYSq3h0AEQEAAcLBZQQYAQgA DwUCWPneBQIbDAUJBaOagAAKCRCtYTjCRc1CfpfgEAC3tXZzhgKbF6fx5gMNDp/9MBpialvu k69UaGL3HUqM0/ytiT4FjYUmOK2mk37iop46GivsOC50PykG9gjbg9/QKUqgsZzJ8LJ+ldY4 /GKtiP5JoO59Obj8MJJ5Ta8yPfZiiNx/I8ydqd18E4PmQUCPlEKhett81t3+8R/mGwG72TaA hHwDjZAEjiXdnXh+z0AKpflCnYQafq0V73ofzuw4KovpJWMk/WPs5oSHhuV4TZ8nRkF6BR4y rEvs1kq8Y6DuNqQGwY3yilpnmqfMzzlWo7MlY657domU54bhGOsvNuZZsFDlcBczQo6h9OKq ckkVHUMAw38pX+EghzEfhYVWYmLNv5G9TA/M2s3frO3aN7ukNDq7CKIwfVz71/VfPaLQMY7/ jirzp9yIBZEi4E+PwP38FAGiD+nxzuUJv1rvxf6koqUGoHRvdppju2JLrC2nKW0La7RX7uZJ esCVkamT/XaXPROBTrZZqwbIXh2uSMzgXkC2mE1dsBf2rdsJ4y73+0DYq7YE52OV9MNoCYLH vpkapmD00svsP4sskRsrquPHkBBVCJa22lTaS8Oow9hGQe7BDjEhsVoPol889F0mbTRb3klv mGQ6/B/HA0pGWR9wISY8a7D40/qz6eE6+Yg22mtN1T8FFlNbyVmtBj0R/2HfJYhGBElLPefH jhF0TA== Message-ID: <8a90e06f-06d0-515c-6337-6451273e263a@riseup.net> Date: Tue, 31 Jul 2018 18:44:00 +0000 MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="XOhiUZfAhz2CqCodKbK2Qb3PYjQoUmNuw" Archived-At: Subject: Re: [Resolverless-dns] definition of resolverless operation X-BeenThere: resolverless-dns@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: Resolverless DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 31 Jul 2018 18:44:35 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --XOhiUZfAhz2CqCodKbK2Qb3PYjQoUmNuw Content-Type: multipart/mixed; boundary="XV332y19iO2TUliaMwVkP3oOthPnJPiaB"; protected-headers="v1" From: nusenu To: resolverless-dns@ietf.org Message-ID: <8a90e06f-06d0-515c-6337-6451273e263a@riseup.net> Subject: Re: [Resolverless-dns] definition of resolverless operation --XV332y19iO2TUliaMwVkP3oOthPnJPiaB Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable > What should I imagine when I read "resolverless" DNS? dkg presented the idea at the IETF101 DoH meeting session, although it had a different name at the time, it might be useful as an in= tro nonetheless recording (~40min) https://www.youtube.com/watch?v=3DtijYo6ZXGWU&feature=3Dyoutu.be&t=3D3814= slides https://datatracker.ietf.org/meeting/101/materials/slides-101-doh-opportu= nistic-dns-00 --=20 https://twitter.com/nusenu_ https://mastodon.social/@nusenu --XV332y19iO2TUliaMwVkP3oOthPnJPiaB-- --XOhiUZfAhz2CqCodKbK2Qb3PYjQoUmNuw Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEElpDPH7u0KYWVTfK7rWE4wkXNQn4FAltgrggACgkQrWE4wkXN Qn63NRAA1u2daP79Fx29HSAmI4mFCnZ5/04Qu/Sb1sfxth87jUBjpZ3XklOdSqol jRdedJXVOTLA3AAi9diV0mlKo+N+DFVs8fUHUjHG/FuaSz18iZ1ahTAs3RuaDoLd +DyTkyNhMXhiJVM+hJT1IYTBYSIgQhRztM5MGW8rWU6yRXC2hg9gVuSyHLUPOHxT eMvCtt/weVp3tod+HzQMIfBBsGCO8wV9CdFlWSvqv5dDqakz01nUiLN6+iPj97FV 2s1ObpqgnMMabHU0FsXa+Dl/fLyoAaqsBAiKIxMvRLvty6KzViiIebsM49WQ92Gi 5QQzgA0q91lk1JCHGEpYH5/6EQ6m0klnsTTsd0ILSaIF/DolTYDx4eLQd8OnSA5p 0UuDZdtPEHIUhYBZ1wfzN4DcNYKlg9DYFyG/j1DcOBlxe6ANaxkU8wEWhIDec6Wx QP2OwHJyjzBqDAZNJIr9+NmlplVp39GJ8P9yJdWCRHYsJonaw/v8bVlW1QAcZdgn SjLlUbFWbSLQ9F4n7ptXr6I9xAEPIovhbm67a6D0pAIvxXDzjoOn8dMx5L/WR/x+ 43lVmHcDtKMRvkt7KjIaoOJsGsLpmLhONO9SvfjMicmC1U1MjS6u7rYWBysIgfzQ Ka7WQgyXa9ru4wNyWvxXRt1iojh907DDiyMI1JM2u6rePJWDlUs= =3OKq -----END PGP SIGNATURE----- --XOhiUZfAhz2CqCodKbK2Qb3PYjQoUmNuw-- From nobody Tue Jul 31 15:36:10 2018 Return-Path: X-Original-To: resolverless-dns@ietfa.amsl.com Delivered-To: resolverless-dns@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 438DA130E8A for ; Tue, 31 Jul 2018 15:36:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.801 X-Spam-Level: X-Spam-Status: No, score=-0.801 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=riseup.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ii-2VcdXiyz7 for ; Tue, 31 Jul 2018 15:36:06 -0700 (PDT) Received: from mx1.riseup.net (mx1.riseup.net [198.252.153.129]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2CC03130E48 for ; Tue, 31 Jul 2018 15:36:06 -0700 (PDT) Received: from cotinga.riseup.net (cotinga-pn.riseup.net [10.0.1.164]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client CN "*.riseup.net", Issuer "COMODO RSA Domain Validation Secure Server CA" (verified OK)) by mx1.riseup.net (Postfix) with ESMTPS id C3A8E1A0A30 for ; Tue, 31 Jul 2018 15:36:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=riseup.net; s=squak; t=1533076565; bh=WwHK1QukA8L1PFwkcOt9vx2TOeF+s+vZ5UHjmLcXjxM=; h=To:From:Subject:Date:From; b=sG/kXU8aEHd74nZ4IBXqxLo+QPh+YPsUQU9+y1Byv7wRrUFlMhuQQP1SeAaBsJ3tG PAoThmv4uzvpDZODC5VkP0ZzdmLNZmeYuRBZE8SGM1JUMLyvEI2vHZWL5AVjtqxuFP 4OQk+rIz9gXNNrl4rVPOUjIPKQp6ux+nWjFm3iKc= X-Riseup-User-ID: 45CDCE0E12F7C7A897865674BC76F75AA535C1A76D9B2D9C1512D55C66414E71 Received: from [127.0.0.1] (localhost [127.0.0.1]) by cotinga.riseup.net with ESMTPSA id 416F2619F2 for ; Tue, 31 Jul 2018 15:36:03 -0700 (PDT) To: resolverless-dns@ietf.org From: nusenu Openpgp: preference=signencrypt Autocrypt: addr=nusenu-lists@riseup.net; prefer-encrypt=mutual; keydata= xsFNBFj53gUBEADYKwT0pW1yiqt6UReZW8T2nXVCyeVT2G6z7AvW69afp82uthRH237pQ7Qs 5vq91DivN6fGN6cVksp0N9Yv+5HEQAwUxpLfcNDcGzmHMd0JMItEtozGv3a4FuiUoHAqeGXM 6Kzi3v5F2PZGF+U4QaGKEZq6u50gO/ZFy4GfC9z9tsO6Cm7s7KldVHMGx/a0MEGMwh6ZI9x2 hGXSSAKu58KRUkEpHzDiQTj+/j58ndNfZRQv6P5BLppHADRPqwEOm4RQcQYskyM0FdKXbJ8E 5GW268meflfv2BASsl3X/Xqxp+LNrstXIbFZ+38hVlQDDmdvaASpPTzIAxf8FxMYZqI+K1UE kP5nU45q84KiZoXwT6YYJDKToLSDnYkKlsrCSnLkE3Nb/IexgNoYO4nE6lT9BDV3athQCWw1 FwB5idRYWnIqbVgUFgYZDUdZBJmeTEeI+Wn5hFz6HvFVc/+haMVTcoEKSkG/tsSGsKOc2mp6 z+71io9JWrVQGmw7OeZeE4TvkF9GhwS8jrKO4E0crfcT/zT6368PZCO6Wpir8+po/ZfOWbbh 1hi3MxmXn4Fki55Zrvhy3sf28U+H/nByQV4CssYv/xVhIZsN/wNQLcDLgVs4JTBUik8eQR0Y Qrq9lG3ZVtbpEi7ZTJ6BOGIn2TKHsVIVGSQA0PdKpKYV45Lc4QARAQABzSBudXNlbnUgPG51 c2VudS1saXN0c0ByaXNldXAubmV0PsLBfQQTAQgAJwUCWPneBQIbAwUJBaOagAULCQgHAgYV CAkKCwIEFgIDAQIeAQIXgAAKCRCtYTjCRc1Cfq/kD/sHx+mnL6OLwJvBj1rVTyoHJYJARajz Go0yRlbrZSH6Z05OD3SDR9UVpWOZeY8JyFoTyCFQjAbIVjKifj0uSmi0j1iahrAgGGfik0cN XUkCxrW6jcJQ37EbvYWu4PryqLuC7IeQW1wCcB1ioyGYKkm2K6LZ9rzZPVYSmPohJ+gVI0Jt EdlNZl4JuZot9eA5w/22uvcStQHzXDsUxfqK8OAJpU8E3iBBdNpLPMDWpFz4g2yw5PD6jZ+K Q39PYMUFULaKe4YCw1O+0MFhZJI4KEcRYHuVy1b3cJjxzgVfEyFctLDsO1sh07vBhoVKUi8W e00pvGtv8QYxxMYIA3iACbsjGEr69GvvZ2pAnu9vT9OUCaES4riDCxbkMxK/Cbwk8F6mo0eq HDQ7sOZWQv81ncdG9ovlA7Pj96cEXgdtbbllF1aUZ8sAmT14YjGzhArGv7kyJ1imH5tX3OXk hBGA9JTk2mDNjEpFaTEajSvDiKyeEhWNTLm15siWkpg1124yjUkhQ3OCkw7aUDMiVn8+DQHo J2pP/84uUvngbhm1jV7nk8mxTUFgppUePkb5hhnRRzeK72QY00EwRdn7qnpNgijMJ3Fpjfy2 EeCEl3nNdcB7U0F+0ijA6P/+DROldxNr4eiP50RvV8XiW/yi2IkKBk50GNB87yYnDETxxx/c 2i00AM7BTQRY+d4FARAAwJZ6U7UT8uB1WCfLK3AOR1Wa9bzOAghlTR4WXbHB4ajQKG7/Fzud 99bnwD0V3/AOVz/SbGDyHe+7HMvd1A0Ll4NgyH6OpxY7wOwCXAYTAbcXLpM7eKTjjsb9A9XG 3FcIGvjcy76OkaewqhiABaShlStEYcPkRusHZuecXtCnfCjJKihU/kinWpBO9gY6SrF2KFCw aeS4r37brXQ9y8uy3gZ168QFuIa5AKfL0r5YN3k4StNSA2p5Z/pufWXMN3B03QC+3fireiz3 dinlHK6XjUW8oWSdNxJhexT/lUw+episNuWTQruy7PD+HeohYGXqjggmPUiWc171Sewb2f8H CHViHMee8QXqo/LSRkYVrtsx0HUSMKsVQOma/u2By03ucroIkQJQQfqX3YpK1i3EpUO2L0/m E8UpBvUm1vrst54EFym4tYNJTj9reVffFKh2cczmPVN5o8v3RrdTF96mGtcb9EJbGV4277ZE LqUspviEBXynqU3yZ48JhIWHj22/ha6TeBpapYZDOJ8lePed8E34J/GYE2YXl65LhpXAKvWz O3KiByGMysb9Li6zqZ9/BYQtg5CA6Q8Oo7pBxK4iiDH3GX2WvymmLoaOBpOaIYdvKr39fajE mzfbg7TdZKXxqp2KDrbw7vUJLDyrmPWpxHyhKHItzoi1Y59wzYSq3h0AEQEAAcLBZQQYAQgA DwUCWPneBQIbDAUJBaOagAAKCRCtYTjCRc1CfpfgEAC3tXZzhgKbF6fx5gMNDp/9MBpialvu k69UaGL3HUqM0/ytiT4FjYUmOK2mk37iop46GivsOC50PykG9gjbg9/QKUqgsZzJ8LJ+ldY4 /GKtiP5JoO59Obj8MJJ5Ta8yPfZiiNx/I8ydqd18E4PmQUCPlEKhett81t3+8R/mGwG72TaA hHwDjZAEjiXdnXh+z0AKpflCnYQafq0V73ofzuw4KovpJWMk/WPs5oSHhuV4TZ8nRkF6BR4y rEvs1kq8Y6DuNqQGwY3yilpnmqfMzzlWo7MlY657domU54bhGOsvNuZZsFDlcBczQo6h9OKq ckkVHUMAw38pX+EghzEfhYVWYmLNv5G9TA/M2s3frO3aN7ukNDq7CKIwfVz71/VfPaLQMY7/ jirzp9yIBZEi4E+PwP38FAGiD+nxzuUJv1rvxf6koqUGoHRvdppju2JLrC2nKW0La7RX7uZJ esCVkamT/XaXPROBTrZZqwbIXh2uSMzgXkC2mE1dsBf2rdsJ4y73+0DYq7YE52OV9MNoCYLH vpkapmD00svsP4sskRsrquPHkBBVCJa22lTaS8Oow9hGQe7BDjEhsVoPol889F0mbTRb3klv mGQ6/B/HA0pGWR9wISY8a7D40/qz6eE6+Yg22mtN1T8FFlNbyVmtBj0R/2HfJYhGBElLPefH jhF0TA== Message-ID: <6db5d9d9-ab94-0ccd-3b32-c01d37ed3403@riseup.net> Date: Tue, 31 Jul 2018 22:35:00 +0000 MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="WN6iYw0fbfSqSDL1lsy9VJzoHYIJzYLsj" Archived-At: Subject: [Resolverless-dns] narrowest possible scope: first-party origin, HTTPS-only + DNSSEC-signed X-BeenThere: resolverless-dns@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: Resolverless DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 31 Jul 2018 22:36:08 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --WN6iYw0fbfSqSDL1lsy9VJzoHYIJzYLsj Content-Type: multipart/mixed; boundary="0e3YOTJrn5nOw804X7UOOqLJCFqX37YM9"; protected-headers="v1" From: nusenu To: resolverless-dns@ietf.org Message-ID: <6db5d9d9-ab94-0ccd-3b32-c01d37ed3403@riseup.net> Subject: narrowest possible scope: first-party origin, HTTPS-only + DNSSEC-signed --0e3YOTJrn5nOw804X7UOOqLJCFqX37YM9 Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable (I'm quoting from the meeting notes that Patrick sent out [1]) > Paul: We started with "where might we be getting this data"? Let's=20 > limit this to HTTP. >=20 > DKG: I think that an interesting thought experiment would be to=20 > define the narrowest possible scope where something like this might=20 > be interesting. If that means "within one tab", HTTPS-only,=20 > DNSSEC-signed, hopefully at some point we can find something that=20 > doesn't make too many objections, and then maybe we can walk it out. I support DKG's suggestion of the scope: DNS data coming from opportunistic sources=20 (that is a source that has not been configured as a DNS resolver) - MUST be DNSSEC-signed - MUST be transported via an authenticated HTTPS connection By that definition anything non-HTTPS is out of scope. I'd like to clarify the "within on tab" item. I'd propose to use URL bar origin as a boundary. That is, if you have two tabs pointing to=20 example.com they might share the DNS data learned in either tab. Should the URL bar origin be the entire FQDN or should it be limited to t= he SLD? mail.example.com www.example.com=20 would be the same URL bar origin if we stop at the second level domain. my motivation for supporting this work: - decentralization/privacy:=20 the configured resolver(s) get to learn less DNS queries, at the same time we do not introduce new resolvers to the system/applicat= ion=20 (we MUST **never** actively ask webservers from whom we got DNS data opportunistically for DNS records if they were not specifically configure= d as resolvers) I see a privacy+latency win here that is similar to OCSP-stapling where t= he webserver basically acts as a reverse-proxy for the user as well. - fewer networks will be in-path (single endpoint [webserver] vs. multipl= e endpoints [webserver+multiple auth. NS])=20 when a user visits a website (context: [3]) - has the potential to reduce the hard question of: "Whom should users gi= ve their DNS queries?" since the chosen resolver will get to see less if this is adopted widely = (but DNSSEC might become a limiting factor) - creates a performance incentive for zone owners to deploy DNSSEC=20 - creates a performance incentive for browser vendors to implement DNSSEC= validation - might help reduce tracking opportunities of DoH clients by DoH servers = (since they get less data) - might help in bringing DANE to the web/browser world - I see a value of this work in the context of privacy focused browsers like Tor Browser that have already strong URL bar origin isolation [2] and limited persistent state that might become useful in solving some=20 of the privacy concerns this new construct might introduce. [1] https://mailarchive.ietf.org/arch/msg/doh/jWMuniwu-V4rucpscVlInBAZPWs= [2] https://www.torproject.org/projects/torbrowser/design/#identifier-lin= kability [3] https://nymity.ch/tor-dns/ --=20 https://twitter.com/nusenu_ https://mastodon.social/@nusenu --0e3YOTJrn5nOw804X7UOOqLJCFqX37YM9-- --WN6iYw0fbfSqSDL1lsy9VJzoHYIJzYLsj Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEElpDPH7u0KYWVTfK7rWE4wkXNQn4FAltg5EkACgkQrWE4wkXN Qn76Tw/+MYNEHiQiS92rxa3xg+mKAileS04VyBxEbHZOHnCZ/ZXc0vyY0l33lrp4 EB11r6I5u4WRRvVndvKKwPbNq+iOZB/8ib9s5cbpx2q09cfiUTAxsoIiz85OMPKe U88fDYeuMATaj6RmFtXaoVO0OSrPXUAV0ZQZ9MDUjTXpzitLnw630JkCxT32AmCo uha1/xqDGQuXKrn9E3rFQ+Kn4JXVIJzzqSsCfZl6AsQJlYC+cop1ZkaAPVAo+2jR YhYwy/cjn1xmJFUKd0npgmRC7/kgm4D3+H4aAUXsg4Gv72zod5u9MuLoRQ/AmXuL GDhIkX4youo2vHxAvpRBLV+QwtyU0K3GczQw+FNg+THddPXvN1xxSyoh6LM1EOOs uUYjILgbZ+Q6kfgNBefJsyM9xYOVArh48TRJm0rJWcg3FlW3BO3XnHdbbqzyzl3Z srLzGbmrO/M6WoKJC3K/hSMsawxkGackKzEkeJmDKmVvSa2XDyK+u59+BDGbWSdE DkyWqecRNUuhQR0CCZ1j9LpWX52UGw0nP4THGMhdwfof3yltuXOoRlXuDGaSD6t1 uf1KkSJ3m6RnhoV/505qov9o822j9YZ6/YE2hFPiGsh5I0pLK80KeHbm5DmDtsu0 3sDu/Z9fCoiafgeLPi486LBFIIE+eFzP/hXsFNZV/+Cy1o95ymI= =qgf9 -----END PGP SIGNATURE----- --WN6iYw0fbfSqSDL1lsy9VJzoHYIJzYLsj--