Subject: [Add] Communication of DNS resolver information for use in selection decisions

From: Chris Box <[email-masked]>
Date: Wed, 27 Jan 2021 18:13:28 +0000

In the meeting it sounded like Ekr had a different interpretation to me of
the second charter deliverable.

> - Define a mechanism that allows clients to discover DNS resolvers
> that support encryption and that are available to the client
> either on the public Internet or on private or local networks.
>
I agree the above is the first step we should work on, and we have been
doing so.

> - Define a mechanism that allows communication of DNS resolver
> information to clients for use in selection decisions. This could be
> part of the mechanism used for discovery, above.
>
The difference of opinion here might be the meaning of "resolver
information". I personally think this goes beyond learning how to contact
the resolver. I think it encompasses areas like "Resolver behavior
self-description" that Tommy Jensen presented. Do the chairs agree?

If they say yes, then of course we should only standardise information that
real clients are interested in consuming. So as the next step I am
wondering if it would be useful to get a group of client developers
together at some point and pose these questions:

   - When your client joins an untrusted network, and the network
   designates a set of encrypted resolvers, which pieces of information would
   be useful to you in deciding whether and when to use any of those resolvers?
   - What would allow you to use a designated resolver automatically?
   - What would be useful to you if you thought you needed to present a UI
   dialog?
   - Which debugging information would you like to be able to display on
   request?

However I am not a client developer, so please tell me if I am misguided.
I'm aware that Oblivious DNS would significantly change the answers to the
above, but only when it is in use. So the questions are more about what is
useful resolver information in the context of sending non-oblivious queries.

Chris

P.S. Don't get me wrong, I don't want to hold up progress on designation:
this should continue independently.

---

From: Ben Schwartz <[email-masked]>
Date: Wed, 27 Jan 2021 15:05:28 -0500

Thanks Chris.  I think this is a very reasonable approach.

The contents of a "resolver self-description" are generally unverifiable to
the client, which limits their utility considerably.  In the context of
designated resolvers, I think this is most likely to be useful for
debugging (your last bullet).  I'm reminded of the (unstandardized)
"version.bind" chaos record [1].

[1] https://kb.isc.org/docs/aa-00359