Subject: [Doh] DOH and split DNS

From: "Paul Hoffman" <[email-masked]>
Date: Sun, 05 Nov 2017 07:46:33 -0800

On 5 Nov 2017, at 0:30, Eliot Lear wrote:

>   * Use of this mechanism can cause problems with split DNS, where the
>     internal DNS is not the same as what is made available externally. 
>     Many corporate networkers hide their internal topology from the
>     external DNS.  If an end host queries an external DNS for an
>     internal resource, the result would be NXDOMAIN.  To avoid this, at
>     a minimum, the browser should have some configuration as to what is
>     internal.  I conjecture that this would reflect what is commonly
>     found in a proxy.pac file.

---

From: Mark Nottingham <[email-masked]>
Date: Mon, 6 Nov 2017 11:13:19 +1100

If the user takes a positive step to configure a DOH server (e.g., in their browser), this is directly analogous to manually configuring an alternative DNS server -- except that the network can try to take active measures to block other DNS servers, and that's more difficult with DOH.

Regardless of that, once the user has done something to the configuration, it's reasonable to say that they've taken responsibility for the consequences of that action -- including the sudden disappearance of "internal" resources. Some careful wording around the configuration mechanism should help.

Allowing something like proxy.pac to override DOH doesn't make any sense, given that the primary purpose of DOH is to NOT allow the local network to impose policy on communication with the DNS server.

Cheers,

> On 6 Nov 2017, at 2:46 am, Paul Hoffman <[email-masked]> wrote:
> 
> _______________________________________________
> Doh mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/doh

--
Mark Nottingham   https://www.mnot.net/

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 6 Nov 2017 07:00:14 -0500

On Mon, Nov 06, 2017 at 11:13:19AM +1100, Mark Nottingham wrote:
> 
>  Some careful wording around the configuration mechanism should help.
> 

That careful wording had better be pretty careful.  I don't believe
for an instant that most users have a workable theory for which
resolution mechanism they're using, and if they configure DOH and
suddenly all the "internal sites" don't work they're going to be
pretty surprised.

It strikes me as pretty strange, too, to suggest that, if a user
configures proxy.pac, they don't want the local network to offer such
policies.  If the user is prepared to use the proxy, presumably the
user is prepared to use it to impose local policy, no?

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Patrick McManus <[email-masked]>
Date: Mon, 6 Nov 2017 10:11:57 -0500

If we were to do an operational doc, it seems fine to note that who you ask
determines what the answer is and therefore you need to consider who you
are asking. Uncontroversial - indeed its really a motivator for DoH in the
big picture.

On Mon, Nov 6, 2017 at 7:00 AM, Andrew Sullivan <[email-masked]>
wrote:

> > Allowing something like proxy.pac to override DOH doesn't make any
> sense, given that the primary purpose of DOH is to NOT allow the local
> network to impose policy on communication with the DNS server.
> >
>

---

From: Eliot Lear <[email-masked]>
Date: Thu, 9 Nov 2017 16:35:54 +0530

> user is prepared to use it to impose local policy, no?

That was my thinking, but I will add that this needs some more
thinking.  proxy.pac files can contain many things to match off of, and
if it's an IP address range, it won't be useful.  If it's a domain name
or wildcard (like .mydomain.example.com) then perhaps so.  Also, there
are some corner cases when it might not work- in some environments a
proxy may be required internally.  As such, when something is not
"direct" it might still be within one side of a split DNS fence, as it
were, and so the proxy.pac file would give the wrong answer. 

Eliot