Subject: [dns-privacy] Authoritative DoT or DoH

From: "Henderson, Karl" <[email-masked]>
Date: Thu, 14 Mar 2019 19:18:13 +0000

In the last couple of days there has been a lot of activity concerning DNS over HTTPS (DoH) - Hoffman and Alibaba presentations at ICANN and IETF drafts: draft-reid-doh-operator/draft-livingood-doh-implementation-risks-issues/draft-betola-bcp-doh-clients.

These discussions have focused on DoH for client (typically web browser) communication with recursive resolvers, and its comparisons with DoT for this purpose.

Is there any compelling reason at this point to be considering DoH for recursive resolver-to-authoritative name server communications?

As I noted at the DPRIVE interim meeting, the working group needs empirical studies looking at performance and attack vectors for authoritative DNS encryption.

Unless there are compelling reasons to consider Authoritative DoH, I propose the working group focus its authoritative DNS encryption assessments around Authoritative DoT.

In support, I am willing to co-author an Authoritative DoT operational consideration draft in order to outline the operational challenges the community needs to address - similar to the draft-reid-doh-operator draft between client and recursive.

---

From: Bill Woodcock <[email-masked]>
Date: Thu, 14 Mar 2019 22:33:44 -0700

> On Mar 14, 2019, at 12:18 PM, Henderson, Karl <KHenderson=[email-masked]> wrote:

Nope, because there’s already a DoT for recursive-to-authoritative draft.

https://www.ietf.org/archive/id/draft-bortzmeyer-dprive-resolver-to-auth-01.txt

                                -Bill

---

From: Brian Haberman <[email-masked]>
Date: Fri, 15 Mar 2019 07:41:15 -0400

Hi Karl,

> In support, I am willing to co-author an Authoritative DoT operational consideration draft in order to outline the operational challenges the community needs to address - similar to the draft-reid-…

Thanks for volunteering for such a task. Before we go that route, can
you confirm that the information that has been collected to date on
recursive to authoritative captures all the issues from your perspective?

https://github.com/DPRIVE/dprive-v2-ms-and-reqs/blob/master/dprive-v2-ms-and-reqs.md

Regards,
Brian