Subject: [Add] DRDP: response to feed backs provided during the meeting

From: Daniel Migault <[email-masked]>
Date: Thu, 26 Mar 2020 19:26:00 -0400

Hi,

Thank you for the feed backs provided during the meeting. Here
is a response to three concerns raised during the meeting. Feel
free to let me know your thoughts.

1. One comment was that having a unique centralize repository of
resolving domains for public resolvers was a terrible idea. I
agree with this as it implies a complex governance. I will update
the draft and let it as "a" repositories for resolving domains
instead. I however believe that repositories of resolving domain
share a common format so one is able to switch easily and move
from one repo to the other.

Note that resolving domains associated to local resolvers may also
happen to be found in such repos. Currently I am not convinced
that we should envision a large number of local resolving
domains, but I am happy to hear otherwise.

2. Another comment concerned the number of resolving domains. I
think I recall that the current list of resolvers used by the
Google Public DNS is greater than 11.000. I do not know if that
list is available but I am wondering whether these entries are IP
addresses or domain names. I suspect that IP addresses are used
and that some ISPs are proposing multiple IP addresses. If that
is correct, handling resolving domains instead of IP addresses
might help reduce the length. Of course this assume sthe
discovery protocol will help discovery the IP addresses. In
addition, I am also wondering how much these entries are "public"
resolvers that are globally available. I suspect that, thought
global IP addresses may be used, their access might be limited to
DNS client that belong to a specific network. Again this is only
a suspicion and I am happy to learn more about.

Thought I am not sure I am using relevant links, the link below
mention a 50ish of domains.
https://github.com/curl/curl/wiki/DNS-over-HTTPS#publicly-available-servers
https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Test+Servers#DNSPrivacyTestServers-Publicresolvers

The link below provides much more public resolvers 11.000 public
resolving, but I suspect that most of them are open resolver. Of
course these are public, but maybe not what we expect when we
mention public resolver - which is probably why a centralized
repository is a terrible idea.  https://public-dns.info/

Overall, I have the impression that we have 11000 entries because
we are missing a discovery protocol and that a the list for
global resolver (expressed as domain) is expected to remain much
smaller.

3. Regarding the format, to be used to host a list of resolving
domain, the use of DNS messages to host the list seems to me wise
as DNS is the protocol that for sure DNS client will understand.
In addition, I believe that tcp will be able to handle large list
of domains. One drawback thought seems that we may not be able to
compress this list with gzip for example. Using a URI that
redirects to an HTTPS or FTP requires the DNS client to have
these protocols which is not given nor necessary. I am happy to
hear your thoughts on this.

Yours,
Daniel

-- 
Daniel Migault
Ericsson

---

From: "Deen, Glenn (NBCUniversal)" <[email-masked]>
Date: Thu, 26 Mar 2020 23:52:03 +0000

Without hat.

On 3/26/20, 4:26 PM, "Add on behalf of Daniel Migault" <[email-masked]<mailto:[email-masked]> on behalf of [email-masked]<mailto:[email-masked]>> wrote:

Hi,

1.. One comment was that having a unique centralize repository of
resolving domains for public resolvers was a terrible idea. I
agree with this as it implies a complex governance. I will update
the draft and let it as "a" repositories for resolving domains
instead. I however believe that repositories of resolving domain
share a common format so one is able to switch easily and move
from one repo to the other.
Isn’t the DNS itself a global repository of domains?   Could something be signed and published in it?

Yours,
Daniel

--
Daniel Migault
Ericsson

---

From: Daniel Migault <[email-masked]>
Date: Thu, 26 Mar 2020 20:46:08 -0400

Thanks for the feed backs Glenn. This is also an opinion I share. The main
motivation for using DNS is that DNS is for sure supported by the DNS
client.
As the repo is expected to simply return a list of domains.  One way to do
could consist in listing the resolving domains in TXT RRsets. Another way
could consists in listing these domains using PTR RRsets which would enable
sanity check over the domain name.

The current document uses the second method and the repo designated by
example.com would be represented as:

_rdns.example.com
       PTR resolving_domain_0
       PTR resolving_domain_n

One inconvenient of using DNS seems that I am not aware of mechanisms to
compress the list of resolving domain beyond the compression provided by
RFC1035. I suspect such compression will be less efficient than gzipping
the entire list but in a txt file.

Yours!
Daniel

On Thu, Mar 26, 2020 at 7:52 PM Deen, Glenn (NBCUniversal) <
[email-masked]> wrote:

> Without hat.
>
>
>
> On 3/26/20, 4:26 PM, "Add on behalf of Daniel Migault" <
> [email-masked] on behalf of [email-masked]> wrote:
>
>
>
> Hi,
>

-- 
Daniel Migault
Ericsson

---

From: "John Levine" <[email-masked]>
Date: 26 Mar 2020 20:55:52 -0400

>Isn’t the DNS itself a global repository of domains?   Could something be signed and published in it?

I think that has a bootstrap problem.  You don't know where to look
unless you know where to look.

If it's at a well-known DNS name, we're back to the single point of failure.

R's,
John