Subject: [Add] STUN for DNS?

From: Christian Huitema <[email-masked]>
Date: Mon, 16 Nov 2020 12:21:30 -0800

Should we have the equivalent of STUN for DNS? STUN was defined many
years ago in the context of NAT traversal, so hosts behind a NAT could
enlist help from server and learn how their "public" IP address appears
on the other side of the NAT. Likewise, with STUN for DNS, hosts could
get help from a third-party server and learn the "public" IP address of
the recursive resolver configured on their system. One of the
applications would be to obtain the seed needed for the "equivalent
encrypted resolver" discovery; there are probably quite a few other
applications.

The simplest design would be to configure the host with just the domain
name of the STUN for DNS resolver, say "s4d.example.net", and with a key
for that resolver. The host that wants to identify the local service
constructs a unique query by picking a random number "rrr", and asks for
a TXT record associated with "rrr.s4d.example.net". The request is
routed by the local resolver (maybe a Wi-Fi router) to a recursive
resolver and then to the selected server, which is authoritative for the
selected domain name (s4d.example.net). The STUN 4 DNS resolver
programmatically creates a TXT record containing the encrypted value of
the source address from which the query was received -- that is, the
address of the recursive resolver. That response will then be relayed to
the host.

Would there be any interest in defining such service?

-- Christian Huitema

---

From: Ben Schwartz <[email-masked]>
Date: Mon, 16 Nov 2020 16:22:26 -0500

You might be interested in Akamai's whoami service [1], which does
essentially what you're describing.

Note that large recursive resolvers load-balance across a large number of
exit IPs [2], so every query through such a system will return a different
answer.

I don't think we should rely on such a design in ADD.

[1]
https://developer.akamai.com/blog/2018/05/10/introducing-new-whoami-tool-dns-resolver-information
[2]
https://developers.google.com/speed/public-dns/faq#locations_of_ip_address_ranges_google_public_dns_uses_to_send_queries

On Mon, Nov 16, 2020 at 3:21 PM Christian Huitema <[email-masked]>
wrote:

> --
> Add mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/add
>

---

From: Shane Kerr <[email-masked]>
Date: Tue, 17 Nov 2020 09:29:40 +0100

Christian,

> Would there be any interest in defining such service?

I have long thought that some STUN-like approach would be useful for 
DNS. In the same way that before STUN every host would need their own 
proprietary, ad hoc approach for dealing with NAT, today every mobile 
system that wants to gracefully navigate the Internet likely has at 
least minimal inference of how the local DNS works.

Maybe a better approach than defining a specific algorithm is to look at 
the various local resolution approaches and seeing what setups they are 
designed to work around (maybe GetDNS, systemd-resolved, and Android as 
a reasonable start), and then either steal^Wstandardize their work or 
develop even better versions?

I have no idea if such work should happen in ADD, DNSOP, some other 
working group, or even a new working group (assuming there is interest).

Cheers,

--
Shane