Subject: [Driu] Suggestion: DHCP to choose a DNS provider from a list of trusted servers

From: Mateusz Jończyk <[email-masked]>
Date: Tue, 22 May 2018 17:04:18 +0200

Hello,
I have devised the following mechanism:

A DNS API client would have a list of "trustworthy" DNS API servers, but which
DNS API server from that list is used could be selected using DHCP.

This would have the following advantages:
1. It would give network administrators an easy way to choose a DNS provider
across a whole network (using DHCP) and configure it in one place instead of on
multiple machines.

2. It would also enable use of ISP's DNS API server (as a main server or as a
fallback), which would make it possible to share global DNS load across many
ISP's DNS servers.

At the same time, it would provide protection against phishing and rogue actors.

I have written some time ago why it is beneficial to enable fallback to ISP's
DNS API servers (modified):

We may end up with the whole Internet using few DOH servers. There are probably
few providers that would host publicly-available DOH servers: Cloudflare
(1.1.1.1), Google, OpenDNS, IBM (or the folks responsible for 9.9.9.9) and
possibly Microsoft and Apple (for use with Windows / macOS) [3]. I doubt that
OpenDNS would be happy to have their DOH server configured in applications as
default, and Microsoft and Apple as well (in products other then theirs).

This would be very different from the current situation where most people are
using the DNS server of their own ISP.

That change may be great because it increases security, but could create several
points of failure for the whole Internet [1]. It would be vulnerable to DoS. It
is important to have some local fallback - i.e.
DOH or DNS servers hosted by ISPs.

Greetings,
Mateusz

[1] This would be much worse then the current situation with DNS root servers.

---

From: Tom Pusateri <[email-masked]>
Date: Tue, 29 May 2018 18:03:00 -0400

> On May 22, 2018, at 11:04 AM, Mateusz Jończyk <[email-masked]> wrote:
> 
> Hello,

As evidenced by the recent Cloudflare BGP hijack, trusting an IP address isn’t sufficient.

You have to authenticate the server. Authentication via a Certificate Authority is not sufficient either. Any CA can sign any certificate. That leaves:
1. SPKI pinning
2. DANE/DNSSEC

You can’t trust the DNS information you learn via any mechanism (DHCP or hand configured) because it might not really be that server. You have to authenticate it.

This means that DHCP distribution is no more/less trustworthy than hand configuring. It’s just another source of DNS info that has to be verified.

Tom