Subject: Re: [Add] thinking in new directions -- draft-hardaker-dprive-add-doh-dnsop-filter-request

From: "John R Levine" <[email-masked]>
Date: 2 Oct 2019 22:28:33 -0400

>> If it were me, I'd say you get what you get, and if you want something
>> else, use 8.8.8.8 or someone with the same taste in filtering you
>> have.
> 
> And that's one option.  However, that forces resolvers to become good
> filterers or filter experts to become good world-class resolvers.

Either that or outsource it.  It's moving in the direction that e-mail is. 
When I'm on public networks these days at hotels and airports, as often as 
not the DNS resolver I get from DHCP is 8.8.8.8.

If you want to run your servers yourself, for mail systems there's a lot 
of external info available to run your spam filters, like DNSBLs of IP 
addresses and domain names, and spammy patterns to update your 
spamassassin, that we use along with local tweaks.  I expect that DNS 
resolvers will similarly use advice from external sources, probably 
distributed as RPZ, again with local tweaks.

It also occurs to me that it'd be pretty painful to have one resolver trying to 
mix and match filter policies, so if you did this, it'd make more sense for the 
initial query to send back an IP address and port of the resolver that provides 
that policy.  Maybe it'd be local, maybe it'd point somewhere else.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly