Subject: Re: [Doh] Changes for draft-ietf-doh-dns-over-https-03

From: John Mattsson <[email-masked]>
Date: Tue, 20 Mar 2018 18:26:58 +0000

Hi,

Looks good. Some comments:

- Section 1.
"On-path network devices may spoof DNS responses, block DNS requests, or just redirect DNS queries to different DNS servers that give less-than-honest answers."

Could mention more things regarding the "different DNS servers". Suggestion:
"On-path network devices may spoof DNS responses, block DNS requests, or just redirect DNS queries to different DNS servers that may give less-than-honest answers, have large or variable latency, or may simply not support the wanted DNS features."

- Section 2.
The draft should use the updated boilerplate in RFC8174
     "The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL
      NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED",
      "MAY", and "OPTIONAL" in this document are to be interpreted as
      described in BCP 14 [RFC2119] [RFC8174] when, and only when, they
      appear in all capitals, as shown here."

- Section 3.      	
- "clients - whether operating systems or individual applications"

What about home routers?

- Section 5. 
- "potentially encoded with base64url"

Why potentially? Seems like something that need to be standardized. Suggestion: "encoded with base64url"

- Somewhere
I think the draft should mention other benefits at well. Suggestion:
"The use of DOH mitigates DNS amplification attacks and allows for authentication of the DNS API server and authentication/authorization of the DNS API client."

Cheers,
John