Subject: Re: [Doh] [Ext] Re: Associating a DoH server with a resolver

From: Erik Nygren <[email-masked]>
Date: Sat, 23 Mar 2019 17:41:19 -0400

On Tue, Oct 23, 2018 at 11:40 PM Adam Roach <[email-masked]> wrote:

>
> So, e.g., interested clients would query for a URI record of type
> _doh._tcp.resolvers.arpa, and get back a full HTTPS URL as a response.
>

Reviving this suggestion after reading some recent threads, this approach
(query your local OS-configured resolver for a URI record with a well-known
name)
seems like a reasonably cleanish way to opportunitistically get a DoH
server URI
associated with the currently configured resolver.   It's arguably less of
a hack
than cramming things into a TXT record on a reverse DNS IP.

(Martin asked on a more recent thread something along the lines of "why
don't
we just do a .well-known lookup against the network-configured resolver,
and something
like this seemed like the best equivalent.)

For better or worse it would also work when a caching forwarding resolver
is present
in passing through the record from whatever the caching forwarding resolver
(eg,
dnsmasq in a home gateway) was pointing to.  It also has the benefit that
clients don't
need to know the IP address of their resolver, they just need to be able to
do a URI record
lookup against a well-known name.

Especially of the OS helps mediate DoH server selection (which would be
beneficial
long-term regardless) the exact OS APIs that exist today are somewhat less
interesting.

      Erik

(Purely for enterrainment value: this well-known name could be in some
other class
like CHAOS rather than IN, like some other recursive-resolver-synthesized
names
like "version.bind txt chaos".  This is not meant to be a serious
suggestion.)

---

From: Ben Schwartz <[email-masked]>
Date: Sat, 23 Mar 2019 18:37:29 -0400

On Sat, Mar 23, 2019 at 5:41 PM Erik Nygren <[email-masked]> wrote:

> (query your local OS-configured resolver for a URI record with a
> well-known name)

Technically, a DoH configuration is a "URI template", not a URI.
(Typically, this means it contains a substring like "{dns}".)  Do you
consider this similar enough to be good use of the URI RRtype?

> in passing through the record from whatever the caching forwarding
> resolver (eg,
> need to know the IP address of their resolver, they just need to be able
> to do a URI record
> _______________________________________________
> Doh mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/doh
>