Subject: [dnsoverhttp] Post-Seoul thoughts

From: Paul Hoffman <[email-masked]>
Date: Tue, 22 Nov 2016 18:12:57 +0000

Greetings. The gathering in Seoul was useful and pretty interesting.

One thing that didn't get mentioned in the loose minutes taken by two folks was that someone mentioned was that HTTP servers might not want to use DNS-over-HTTP to push DNS data into clients but instead to use <link rel="dns-prefetch"> to cause the client to prefetch the DNS data itself. Doing this completely alleviates some of the questions that were raised in the meeting about the security model of the client trusting the server's data.

Given dns-prefetch, the use cases for DNS-over-HTTP maybe reduce to:
- update of DNS information
- a different transport for getting DNS information
- tunneling through aggressive firewalls

Does that seem right to other folks?

--Paul Hoffman

---

From: Patrick McManus <[email-masked]>
Date: Tue, 22 Nov 2016 14:35:53 -0500

On Tue, Nov 22, 2016 at 1:12 PM, Paul Hoffman <[email-masked]>
wrote:

> t someone mentioned was that HTTP servers might not want to use
> DNS-over-HTTP to push DNS data into clients but instead

that doesn't remove the use case. link tags add N round trips, and removing
that latency literally is the use case. Presumably the server has cached
copies of the data it needs to staple.

I think we still have all 4 use cases.

---

From: Shane Kerr <[email-masked]>
Date: Wed, 23 Nov 2016 10:59:04 +0800

Patrick,

At 2016-11-22 14:35:53 -0500

> I think we still have all 4 use cases.

Well, the lookups can be done in parallel so N round trips needn't take
much longer than 1 round trip. Still 0 trips is of course better than 1
trip, everything else being equal. ;)

I'm not sure what "to staple" means in this context. (Actually I only
know about stapling physical things, like paper in an office or sheets
of plastic in construction.) Can you explain or give a link? :)

Cheers,

--
Shane

---

From: Patrick McManus <[email-masked]>
Date: Tue, 22 Nov 2016 22:51:44 -0500

hiya

> trip, everything else being equal. ;)
one lookup can take multiple rtts.. one for (each) ns, one for the a/aaaa..
etc. obviously highly dependent on state. N seemed an easier way to put it,
but you're right that the focus is on > 0.

> of plastic in construction.) Can you explain or give a link? :)
just to inline into a response content that would have normally been
fetched by the client after receiving the response. OCSP Stapling is a
great example from TLS. https://en.wikipedia.org/wiki/OCSP_stapling