Subject: [Add] FW: Comments on the Requirements for Adaptive DNS Discovery doc

From: Andrew Campling <[email-masked]>
Date: Thu, 10 Sep 2020 13:01:56 +0000

I sent the following comments on the requirements document to Chris Box, forgot to copy the ADD list which I am now rectifying.

Andrew

Section 1

  *   Noting other discussions on the list, I believe it would be helpful in paragraph 2 to explicitly state that the clients may be, for example, web browsers, other applications, operating systems, IoT devices etc - ie this needs to work for the Internet and not just for web-related use cases.

Section 3

  *   1. Equivalent - should the resolver be considered equivalent if it is functionally the same but located within a different legal jurisdiction?  [this may be contentious!]  The definition should certainly be extended beyond identical DNS responses to cover identical limitations including, for example, any filtering, private domains etc - see the comment against Section 4 below.
  *   2. Alternative - these serve different responses to some queries. For example one entity may offer a set of encrypted resolvers with different levels of filtering (such as  none, just malware, or malware & adult content), or different proximity (local or central). [suggest adding "such as" as the list is not exhaustive, eg no mention of court-ordered blocking, may be considered by some to be exhaustive without that qualifier]

  *   3.1, final para - expand to reference the possible use of private IP addresses [RFC 1918] by some forwarders - it's in the table but not the main body of text.

  *   3.1.2 The explanation of the additional benefit relating to IoT devices is unclear, needs a little expansion - in what circumstances is the additional benefit gained.

  *   3.3 - currently unstated, believe that the discovered VPN resolver(s) should be equivalent in most (all?) cases to maintain functionality provided by the VPN

Section 4
[It would seem that a further possible aspects of "equivalent" should be covered in section 3, second bullet, eg a restriction of a resolver to private domains and the other aspects cover by this section].

Section 5

  *   Second bullet - "Modify unencrypted DNS traffic to filter or augment the user experience" - add "in a manner not known to, or chosen by, the user or administrator"
  *   Second papa - "Clients cannot assume that their network or endpoint does not have such an attacker unless given some means of authenticating or otherwise trusting the communication with their DNS resolver."
  *   Sixth bullet - "Cause clients to use a discovered resolver which has no authenticated delegation from a client-known entity." - definition of a "client-known entity"?
  *   Seventh bullet - "Influence automatic discovery mechanisms such that a client uses one or more resolvers that are not otherwise involved with providing service to the client, such as: a network provider, a VPN server, a content provider being accessed, or a server that the client has manually configured." - does / should a provider of content that the client is accessing have the same status as the other three, all of which require conscious actions being taken by the user.
  *   Final para - it's unclear what this is trying to convey other than it's difficult.

  *   5.1, final para - no mention is made of ways to use other encrypted DNS options opportunistically, is the intention to suggest that only DoT is suitable in such circumstances?

  *   5.2, first para - "The exact behaviour is a local client policy decision" - noting the possibly problematic use of "policy" in an ADD draft, should this in fact read "The exact behaviour should be a user or administrator decision"?

  *   5.2, second para - "these system components may be good candidates for failing open unless the user or administrator has indicated otherwise,..."

  *   5.2, third para - "but if these networks are trusted by or administered by the user or administrator, the user or administrator..."