Subject: Re: [DNSOP] Erik Kline's Yes on draft-ietf-dnsop-dns-tcp-requirements-13: (with COMMENT)

From: Erik Kline <[email-masked]>
Date: Mon, 1 Nov 2021 15:29:08 -0700

> > [S4.1, comment]
> >
> > * "Resolvers and other DNS clients should be aware that some servers
> >   might not be reachable over TCP.  For this reason, clients MAY want
> >   to track and limit the number of TCP connections and connection
> >   attempts to a single server."
> >
> >  I think the same comment could be made about paths to a server from
> >  a given network, e.g., in the case of one network filtering TCP/53 for
> >  some reason.
> >
> >  I'm not sure how to best reword this to add a per-network notion to
> >  TCP connection success tracking, but I did want to note that a mobile
> >  client's measure of TCP connection success to a single server might
> >  vary from network to network.  (for your consideration)
>
> Is this because mobile devices are more likely to have multiple network choices (say wifi and cellular data) and so the device should include the local network when remembering which works and which doesn’t?

Yes, they have multiple networks simultaneously and also through time.
What's reachable/unreachable on one network might not be
reachable/unreachable on another.  Just moving from one Wi-Fi SSID to
another can make a difference, e.g.:

    * imagine two SSIDs that each hand out 8.8.8.8 but have different
TCP 53 filtering policies, and

    * (more concretely) I have DNS-over-TLS active on my phone and on
one nearby coffee shop SSID TCP 853 is blocked while on another
everything works just fine

(Hopefully I'm making some kind of sense.)

---

From: "Wessels, Duane" <[email-masked]>
Date: Fri, 5 Nov 2021 17:02:35 +0000

> On Nov 1, 2021, at 3:29 PM, Erik Kline <[email-masked]> wrote:
> 
> Caution: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. 
> 
>>> [S4.1, comment]
>>> 

Thanks Erik, how does this look to you?

       <t>Resolvers and other DNS clients should be aware that some
       servers might not be reachable over TCP.  For this reason, clients
       MAY track and limit the number of TCP connections and
       connection attempts to a single server.  Reachability problems
       can be caused by network elements close to the server, close
       to the client, or anywhere along the path between them.  Mobile
       clients that cache connection failures MAY do so on a per-network
       basis, or MAY clear such a cache upon change of network.</t>

DW

---

From: Erik Kline <[email-masked]>
Date: Fri, 5 Nov 2021 10:08:49 -0700

On Fri, Nov 5, 2021 at 10:02 AM Wessels, Duane <[email-masked]>
wrote:

> > Caution: This email originated from outside the organization. Do not
> click links or open attachments unless you recognize the sender and know
> the content is safe.
> >
> >>> [S4.1, comment]
> >>>
> >> Is this because mobile devices are more likely to have multiple network
> choices (say wifi and cellular data) and so the device should include the
> local network when remembering which works and which doesn’t?
> >
LGTM.

s/MAY/SHOULD/g also LGTM (since I know some mobile OSes already do stuff
like this)

Thanks!