Subject: Re: [Doh] [EXTERNAL] Re: DoH

From: "Reed, Jon" <[email-masked]>
Date: Mon, 1 Apr 2019 10:55:15 +0000

On 3/29/19, 9:07 AM, "Adam Roach" <[email-masked]> wrote:

    On 3/29/19 12:54, Paul Brears wrote:
    > I think the key difference is that on a normal Widows PC you’d need device admin credentials to change DNS provider.

    This again conflates product concerns with protocol ones. Applications 
    have always had the ability to incorporate their own resolver library 
    and configure it to use servers other than those provided by the 
    operating system (cf. c-ares, adns). The concern you describe is that 
    some popular applications may choose to do so.
    
I think at this point, it's difficult to separate the protocol from its use by applications _as it pertains to these sorts of discussions_.  As an engineer, I understand the difference and I think it's important to continue to convey it, but I think for many people, DoH may be forever conflated with the concept of a browser selecting a recursive for you.  I think it's fair to say that the existence of the DoH protocol itself makes it much much easier for applications to incorporate their own resolver library, since many environments provide an HTTPS client "for free".  (In my experience, when an application chooses to use ares or adns, it's because the app needs the async functionality, as opposed to simply selecting an alternate resolver library.  Certainly they're both much harder to integrate than simply issuing a GET request.)
 
To avoid re-hashing everything on yet another thread, and speaking for myself only, it sounds like the answer to John's question is: "Yes, there has been considerable discussion in various working groups about the impact of widespread deployment of applications that choose bypass the system resolver, and choose to do so over a protocol that is indistinguishable from regular HTTPS traffic.  There isn't a good answer yet.  Several people have authored drafts about the operational issues, and there was a side-meeting at IETF 104 about which working groups are suitable for raising these issues, but this is a concern shared by some network operators, security software vendors, and cloud providers."

-Jon

--
Jon Reed <[email-masked]>
Senior Performance Engineer
Akamai Technologies
Nameservers Service Performance