Subject: [Doh] DNSSEC, DOH, and DNS headers

From: Andrew Sullivan <[email-masked]>
Date: Mon, 19 Mar 2018 10:39:29 -0400

Hi,

Section 6 of -03 says this:

   Different response media types will provide more or less information
   from a DNS response.  For example, one response type might include
   the information from the DNS header bytes while another might omit
   it.

But section 9 says

	 A DNS API client may also perform full
   DNSSEC validation of answers received from a DNS API server or it may
   choose to trust answers from a particular DNS API server, much as a
   DNS client might choose to trust answers from its recursive DNS
   resolver.

It seems to me that these are in tension with one another, because the
AD and CD bits are in the header that the response type is permitted
to throw away.  Maybe it could be resolved thus:

NEW

	 A DNS API client may also perform full
   DNSSEC validation of answers received from a DNS API server or it may
   choose to trust answers from a particular DNS API server, much as a
   DNS client might choose to trust answers from its recursive DNS
   resolver.  This capability might be affected by the response media
   type a DNS API server supports.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: manu tman <[email-masked]>
Date: Mon, 19 Mar 2018 22:41:04 +0000

I think Paul remove the notion of different content type in a recent PR so
we may as well remove this bit from section 6.
Manu

On Mon, Mar 19, 2018 at 2:40 PM Andrew Sullivan <[email-masked]>
wrote:

> _______________________________________________
> Doh mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/doh
>

---

From: Patrick McManus <[email-masked]>
Date: Tue, 20 Mar 2018 08:05:34 +0000

I appreciate this. we can make the change.