Subject: [Doh] comments to DoH/RFC8484

From: Stefan Kärst <[email-masked]>
Date: Mon, 28 Jun 2021 12:52:35 +0200

hi Team,

I'd like to add some personal thoughts about RFC8484

I'm working as an system administrator for quite a long time now. I 
started working in IT in 1991.

part of my daily work is to analyse problems regarding applications 
running on GNU/Linux, either as VMs, bare metal or within clouds and/or 
containers. based on my experience half of all problems are caused by 
network issues including DNS.

because of this it is important for me to be able to reproduce problems 
and collect data to support customers. one of these tasks include 
querying DNS. whether on the customers machines or on my own. as DNS is 
an open globally distributed system, I can be sure to get the same 
answers as applications/computers at the customers site are using.

DoH not only breaks protocol layering. It makes our work useless in 
terms of reproducing the data applications use. this is as bad as 
caching of IP addresses within applications.

both things do not belong into any application. IMHO
there are dns resolvers and caching services like nscd available for 
both purposes.

as application use encrypted communication, we cannot check the (meta) 
data and provide any kind of support if things do not work. even if DNS 
would be encrypted .. it still is an open system so I can get the same 
answers as any software would use.
any software that works as a monolithic black box is a nightmare for 
system administrators.

I really hope you drop DoH in favour of DNS over TLS. with DNSSEC and 
DANE there are standards available that make more sense in terms of 
enhancing DNS rather than reinventing the wheel and put things into 
application for what the operation system is meant to be responsible.

I wish you could use your powers to promote DNS over TLS to keep DNS an 
open distributed system for all! (except you are working for the Chinese 
or Russian government and wish to make such services a secret to anybody ;)

IMHO DoH has aspects of "security through obscurity" ;)  I cannot see 
any advatage in DoH.

HTH
Kind Regards!
greetings from germany
Stefan Kärst

https://en.wikipedia.org/wiki/Communication_protocol#Protocol_layering
https://en.wikipedia.org/wiki/Security_through_obscurity

---

From: StarBrilliant <[email-masked]>
Date: Thu, 01 Jul 2021 22:40:11 +0000

Hi Stefan,

I am not an IETF person. But as the core maintainer of the project "m13253/dns-over-https", my short answer to your question is:
DoT is nation-widely blocked in China; while DoH is not (and can't be), unless it's a well-known DoH server on their human-maintained block-list.

Speaking of encrypted DNS, besides DoT, we also have DNSCrypt many years ago. They both work well in countries where you could sue your ISP if they forbid you from using them. DoH not only hides the content of your DNS communication, but also hides the fact itself that you are using an encrypted DNS service.

Any technology could potentially become a double-edged sword. You could gain Internet neutrality by hiding DNS from your ISP; but your home IoT products can also send encrypted DNS requests hiding from you. We can't stop the development of technology; instead, standardizing them would push the balance more towards the kind side than the evil side.

Also, DoH allows web applications written in JavaScript to submit DNS requests, where DoT can't.

Best regards,
StarBrilliant

On Mon, Jun 28, 2021, at 10:52, Stefan Kärst wrote:
> _______________________________________________
> Doh mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/doh
> 
> 
> *Attachments:*
>  * OpenPGP_signature

---

From: Ray Bellis <[email-masked]>
Date: Wed, 14 Jul 2021 18:31:55 +0100

> On 1 Jul 2021, at 23:40, StarBrilliant <[email-masked]> wrote:
> 
> Also, DoH allows web applications written in JavaScript to submit DNS requests, where DoT can’t

If that was all that DoH did a lot of people would be much happier.

Ray