Subject: [Add] DDR and the 85% problem

From: Ben Schwartz <[email-masked]>
Date: Tue, 9 Mar 2021 15:52:06 -0500

As requested by the chairs, here is a re-spin of my previous PR for the
"85% problem":

https://github.com/ietf-wg-add/draft-ietf-add-ddr/pull/11

This PR enables, but does not require, clients to connect to an encrypted
resolver upstream of a forwarder, if the forwarder allows it.

--Ben

---

From: tirumal reddy <[email-masked]>
Date: Wed, 10 Mar 2021 15:39:40 +0530

Thanks Ben. The proposed text is a good start, it covers several
deployments

a) Legacy routers whose config and firmware cannot be updated:
Opportunistic discovery, Do53 forwarder uses private IP and encrypted DNS
resolver uses public IP address.
b) Legacy routers whose config can be updated but firmware cannot be
updated: DHCP/RA config updated to point to the encrypted DNS server with
public IP address. In this case, authenticated discovery is possible.
c) Routers with DNS forwarder with filtering capability can block SUDN to
continue to enforce filtering (Similar to canary domain).
d) DNS forwarder with filtering but cannot be updated (similar to a). I
would say it is a corner case scenario.

It may be a good idea to discuss it in detail in a separate draft.

Cheers,
-Tiru

On Wed, 10 Mar 2021 at 02:23, Ben Schwartz <bemasc=
[email-masked]> wrote:

> --
> Add mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/add
>