Subject: [Add] "Equivalent" resolvers

From: "Martin Thomson" <[email-masked]>
Date: Wed, 09 Sep 2020 12:34:52 +1000

https://github.com/ietf-wg-add/draft-add-requirements/issues/17

The proposed requirements include text on two options:

> 1. Equivalent - these provide DNS responses that are identical to the ones served by the unencrypted resolver.
> 2. Alternative - these serve different responses to some queries. For example one entity may offer a set of encrypted resolvers with different levels of filtering (none, just malware, or malware & adult content), or different proximity (local or central).

I think that this should be limited equivalent resolves.  That at least seems achievable.

I don't know how to do the latter without getting embroiled in policy questions.  I know that the charter allows us to slide down this slippery slope, but I think that it would be wise to first seek answers to the easy questions.

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 9 Sep 2020 16:24:08 +0000

> I don't know how to do the latter without getting embroiled in policy questions.  I know that the charter allows us to slide down this slippery slope, but I think that it would be wise to first see…

There is another reason for dropping "alternative": the client system doesn't know what kind of answers the unencrypted resolver is giving, so it can't judge what is alternative. Similarly, the resolver itself can't determine what kind of answers the client was getting unencrypted, so it can't say "don't use me, I'm not equivalent".

I agree that this distinction should be dropped from the main body of the document, and maybe just turned into a security consideration.

--Paul Hoffman