A resolver, presumably an Encrypted Resolver, designated by another resolver for use in its own place.  This designation can <del> be authenticated with TLS certificates. </del>  A DNS resolver using any encrypted DNS transport.  This includes current mechanisms such as DoH and DoT as well as future entity. When a client discovers Designated Resolvers, it learns information <del> such as the supported protocols, ports, and server name to use in certificate validation.  This information is provided in Service Binding (SVCB) records for DNS Servers.  The formatting of these records, including the DNS-unique parameters such as "dohpath", are defined by I-D.ietf-add-svcb-dns. </del>  The following is an example of an SVCB record describing a DoH server discovered by querying for "_dns.example.net": D.ietf-add-svcb-dns.  However, if any protocol does not involve some form of certificate validation, new validation mechanisms will need to be defined to support validating designation as defined in <del> authenticated. </del>  4. This document defines two preferred methods to automatically use Designated Resolvers: <del> Authenticated Discovery authenticated, for when a TLS certificate can be used to validate the resolver's identity. </del>  Opportunistic Discovery opportunistic, for when a resolver is accessed using a non-public IP address. 4.2. <del> Authenticated Discovery is a mechanism that allows automatic use of a </del>  Designated Resolver that supports DNS encryption that performs a TLS handshake. <del> In order to be considered an authenticated Designated Resolver, the TLS certificate presented by the Designated Resolver MUST contain both the domain name (from the SVCB answer) and the IP address of the designating Unencrypted Resolver within the SubjectAlternativeName certificate field.  The client MUST check the SubjectAlternativeName field for both the Unencrypted Resolver's IP address and the advertised name of the Designated Resolver.  If the certificate can be validated, the client SHOULD use the discovered Designated Resolver for any cases in which it would have otherwise used the Unencrypted Resolver.  If the Designated Resolver has a different IP address than the Unencrypted Resolver and the TLS certificate does not cover the Unencrypted Resolver address, the client MUST NOT automatically use the discovered Designated Resolver.  Additionally, the client SHOULD suppress any further queries for Designated Resolvers using this Unencrypted Resolver for the length of time indicated by the SVCB record's Time to Live (TTL). </del>  If the Designated Resolver and the Unencrypted Resolver share an IP address, clients MAY choose to opportunistically use the Designated 4.3. <del> There are situations where authenticated discovery of encrypted DNS </del>  configuration over unencrypted DNS is not possible.  This includes Unencrypted Resolvers on non-public IP addresses such as those defined in RFC1918 whose identity cannot be confirmed using TLS approach (not validating the names presented in the SubjectAlternativeName field of the certificate) as long as the IP address of the Encrypted Resolver does not differ from the IP address <del> of the Unencrypted Resolver.  This approach can be used for any encrypted DNS protocol that uses TLS. </del>  5. indicate that "resolver.example.com" supports both DoH and DoT, and that the DoH server indicates a higher priority than the DoT server. <del> Often, the various supported encrypted DNS protocols will be accessible using the same hostname.  In the example above, both DoH and DoT use the name "resolver.example.com" for their TLS certificates.  If a deployment uses a different hostname for one protocol, but still wants clients to treat both DNS servers as designated, the TLS certificates MUST include both names in the SubjectAlternativeName fields.  Note that this name verification is not related to the DNS resolver that provided the SVCB answer. For example, being able to discover a Designated Resolver for a known Encrypted Resolver is useful when a client has a DoT configuration for "foo.resolver.example.com" but is on a network that blocks DoT traffic.  The client can still send a query to any other accessible resolver (either the local network resolver or an accessible DoH server) to discover if there is a designated DoH server for "foo.resolver.example.com". </del>  6. Operators who choose to forward queries for "resolver.arpa" upstream should note that client behavior is never guaranteed and use of DDR by a resolver does not communicate a requirement for clients to use <del> the SVCB record when it cannot be authenticated. </del>  6.2. <del> Resolver owners that support authenticated discovery will need to list valid referring IP addresses in their TLS certificates.  This may pose challenges for resolvers with a large number of referring IP </del>  addresses.  7. Since clients can receive DNS SVCB answers over unencrypted DNS, on- user queries without the knowledge of the client or network. If the IP address of a Designated Resolver differs from that of an <del> Unencrypted Resolver, clients applying Authenicated Discovery (authenticated) MUST validate that the IP address of the Unencrypted Resolver is covered by the SubjectAlternativeName of the Designated Resolver's TLS certificate. </del>  Clients using Opportunistic Discovery (opportunistic) MUST be limited to cases where the Unencrypted Resolver and Designated Resolver have the same IP address. <del> The constraints on validation of Designated Resolvers specified here </del>  apply specifically to the automatic discovery mechanisms defined in <del> this document, which are referred to as Authenticated Discovery and </del>  Opportunistic Discovery.  Clients MAY use some other mechanism to <del> validate and use Designated Resolvers discovered using the DNS SVCB </del>  record.  However, use of such an alternate mechanism needs to take into account the attack scenarios detailed here.

Remove text about extra cert checks, just focus on the IP address Add considerations about server name handling. Server must accept IP address for SNI and URI host. Clients must not use URL for this value. Clients can either send the IP address or the ServiceMode TargetName
NAME this removes checking for both the name and the IP address. The text about checking the name is for when the client started with a name, not an IP address.
NAME please take another look!
When this says "the domain name (from the SVCB answer)", what does it refer to? Does this refer to the TargetName of a SVCB record? If so, which TargetName? If I query for SVCB records at URL, I might get an arbitrary number of AliasMode SVCB RRs, which might each lead to some number of other AliasMode SVCB RRs on the way to a ServiceMode SVCB RR. That might be a lot of options.
I continue to believe that this entire concept should be removed from the draft. The IP address of the Unencrypted Resolver is the only securely sourced reference identity, and it is the only identity that should be required in the certificate.
The name that’s used in the HTTP request as the authority and the TLS SNI really should be in the certificate :) we’ve covered this before, and I see no reason that these connections would have a strange exception to not expect a match between the DoH name and the certificate. NAME is right we should clarify in the text about how to handle aliases. In fact, NAME should this be in the reference doc about DNS SVCB instead of here? It describes how to construct the DoH URI, and the answer here needs the be the same as the DoH URI’s hostname.
To be clear, I agree with NAME the addition of a second reference identity is a mistake. But I was not asking about that. You can't rely on DNS SVCB to solve this problem, because you invented this particular problem. DNS SVCB does the sensible thing and assumes that the client will not allow its opinions regarding a reference identity to be influenced by something as dangerous as DNS (see also: mistakes of MX). As this document doesn't hold to that principle, it has to deal with the consequences of that choice. At a minimum, that means deciding on exactly how your new reference identity is determined. I think your options basically reduce to one of: The first non-attr-leaf TargetName in the chain leading to the ServiceMode SVCB RR. The TargetName in ServiceMode SVCB RR. The DNR draft has a much better approach here: As we're relying on DHCP/RA for "trustworthy" configuration, have that system provide a name.
Yes, and the authority is the IP address. When using DDR with 9.9.9.9, the DoH URI should be , regardless of the actual transport IP. That draft currently says: by combining the prefix "https://", the service name, the port from the "port" key if present, and the "dohpath" value and transport establishment. This name is the hostname used to construct the original SVCB query, and cannot be influenced by the SVCB record contents. I think we need a change to both drafts. EDIT: See URL, which distinguishes the "binding authority" from the "authentication name". This would allow DDR to say something like
NAME thanks for the change in the SVCB-DNS draft. That certainly helps make this more consistent. With that change, then we no longer need to have any special case in DDR for making sure that both the address and the name used in the HTTP authority are the covered in the cert, since they'll be the same.
I'm sorry, what? The WG soundly rejected IP address hostnames as a requirement back in RESINFO days. This is a full 180 pivot. I see reviewing the notes that no consensus was gained during IETF 109 on the topic of "why do we have two identities?". I think it's fair to say DDR only cares about the source IP address. I would expect in practice that most clients will end up confirming the hostname as well because who would do that for all HTTPS connections except DDR ones, but it certainly is a HTTPS/TLS requirement and not a DDR requirement. I suggest we remove the hostname requirement. I strongly oppose requiring the hostname to equal the source IP address. It will likely make recursive resolver deployment a nightmare, and absolutely needs to be brought to the list before any text changes are made.
Going off of Tommy's point, another reason it would be incorrect to force the HTTP host or TLS SNI to be an address is that this wouldn't work for the "opportunistic" case, where the address is shared but not covered by the cert. So I think we should remove the line about checking the hostname in the cert, but also explain how to get the name from the SVCB record. Initially, the first name we get back in the chain sounds like the right answer.
In the same-IP opportunistic case, there is no certificate validation, so it doesn't matter what name (if any) is in the cert. Using the (local, private) IP address makes this unambiguous. Using the hostname makes this confusing: it suggests the existence of a reference identity where none exists.
This seems like a topic for NAME – either to explain the resolution (if it’s resolved by then) – or to explain the issue and the different sides of the discussion.
NAME Your message got a bit mangled, but I agree that this would be worth discussing as a group.
NAME I wasn’t suggesting anything about certificate validation. Rather, that for opportunistic mode, we should provide guidance about which hostname to use in the SNI and HTTP authority.
NAME NAME NAME to make this concrete, I wrote up what I was thinking in
Too follow up what I said in the meeting: What if you have a situation where a DoH server is co-located with a hosting system, e.g., "URL" and "URL" and the CDN just steers based on Host: header. So what I do is I stand up a DoH server on "URL" that produces lying responses. Then I arrange for your SVCB record to have the name "URL" and I have persuaded the client to accept responses from my invalid server.
One suggestion, but otherwise looking good.

A resolver, presumably an Encrypted Resolver, designated by another resolver for use in its own place.  This designation can  <ins> be verified with TLS certificates. </ins> A DNS resolver using any encrypted DNS transport.  This includes current mechanisms such as DoH and DoT as well as future entity. When a client discovers Designated Resolvers, it learns information  <ins> such as the supported protocols and ports.  This information is provided in Service Binding (SVCB) records for DNS Servers.  The formatting of these records, including the DNS-unique parameters such as "dohpath", are defined by I-D.ietf-add-svcb-dns. </ins> The following is an example of an SVCB record describing a DoH server discovered by querying for "_dns.example.net": D.ietf-add-svcb-dns.  However, if any protocol does not involve some form of certificate validation, new validation mechanisms will need to be defined to support validating designation as defined in  <ins> verified. </ins> 4. This document defines two preferred methods to automatically use Designated Resolvers:  <ins> Verified Discovery verified, for when a TLS certificate can be used to validate the resolver's identity. </ins> Opportunistic Discovery opportunistic, for when a resolver is accessed using a non-public IP address. 4.2.  <ins> Verified Discovery is a mechanism that allows automatic use of a </ins> Designated Resolver that supports DNS encryption that performs a TLS handshake.  <ins> In order to be considered a verified Designated Resolver, the TLS certificate presented by the Designated Resolver MUST contain the IP address of the designating Unencrypted Resolver in a subjectAltName extension.  If the certificate can be validated, the client SHOULD use the discovered Designated Resolver for any cases in which it would have otherwise used the Unencrypted Resolver.  If the Designated Resolver has a different IP address than the Unencrypted Resolver and the TLS certificate does not cover the Unencrypted Resolver address, the client MUST NOT automatically use the discovered Designated Resolver.  Additionally, the client SHOULD suppress any further queries for Designated Resolvers using this Unencrypted Resolver for the length of time indicated by the SVCB record's Time to Live (TTL). </ins> If the Designated Resolver and the Unencrypted Resolver share an IP address, clients MAY choose to opportunistically use the Designated 4.3.  <ins> There are situations where Verified Discovery of encrypted DNS </ins> configuration over unencrypted DNS is not possible.  This includes Unencrypted Resolvers on non-public IP addresses such as those defined in RFC1918 whose identity cannot be confirmed using TLS approach (not validating the names presented in the SubjectAlternativeName field of the certificate) as long as the IP address of the Encrypted Resolver does not differ from the IP address  <ins> of the Unencrypted Resolver.  Clients SHOULD use this mode only for resolvers using non-public IP addresses.  This approach can be used for any encrypted DNS protocol that uses TLS. </ins> 5. indicate that "resolver.example.com" supports both DoH and DoT, and that the DoH server indicates a higher priority than the DoT server.  <ins> Clients MUST validate that for any Encrypted Resolver discovered using a known resolver name, the TLS certificate of the resolver contains the known name in a subjectAltName extension.  In the example above, this means that both servers need to have certificates that cover the name "resolver.example.com".  Often, the various supported encrypted DNS protocols will be specified such that the SVCB TargetName matches the known name, as is true in the example above.  However, even when the TargetName is different (for example, if the DoH server had a TargetName of "doh.example.com"), the clients still check for the original known resolver name in the certificate. Note that this resolver validation is not related to the DNS resolver that provided the SVCB answer. As another example, being able to discover a Designated Resolver for a known Encrypted Resolver is useful when a client has a DoT configuration for "foo.resolver.example.com" but is on a network that blocks DoT traffic.  The client can still send a query to any other accessible resolver (either the local network resolver or an accessible DoH server) to discover if there is a designated DoH server for "foo.resolver.example.com". </ins> 6. Operators who choose to forward queries for "resolver.arpa" upstream should note that client behavior is never guaranteed and use of DDR by a resolver does not communicate a requirement for clients to use  <ins> the SVCB record when it cannot be verified. </ins> 6.2.  <ins> Resolver owners that support Verified Discovery will need to list valid referring IP addresses in their TLS certificates.  This may pose challenges for resolvers with a large number of referring IP </ins> addresses. <ins> 6.3. Clients MUST NOT use "resolver.arpa" as the server name either in the TLS Server Name Indication (SNI) (RFC8446) for DoT or DoH connections, or in the URI host for DoH requests. When performing discovery using resolver IP addresses, clients MUST use the IP address as the URI host for DoH requests. Note that since IP addresses are not supported by default in the TLS SNI, resolvers that support discovery using IP addresses will need to be configured to present the appropriate TLS certificate when no SNI is present for both DoT and DoH. </ins> 7. Since clients can receive DNS SVCB answers over unencrypted DNS, on- user queries without the knowledge of the client or network. If the IP address of a Designated Resolver differs from that of an  <ins> Unencrypted Resolver, clients applying Verified Discovery (verified) MUST validate that the IP address of the Unencrypted Resolver is covered by the SubjectAlternativeName of the Designated Resolver's TLS certificate. </ins> Clients using Opportunistic Discovery (opportunistic) MUST be limited to cases where the Unencrypted Resolver and Designated Resolver have the same IP address.  <ins> The constraints on the use of Designated Resolvers specified here </ins> apply specifically to the automatic discovery mechanisms defined in  <ins> this document, which are referred to as Verified Discovery and </ins> Opportunistic Discovery.  Clients MAY use some other mechanism to  <ins> verify and use Designated Resolvers discovered using the DNS SVCB </ins> record.  However, use of such an alternate mechanism needs to take into account the attack scenarios detailed here.


resolver.  "Designated" in this context means that the resolvers are operated by the same entity or cooperating entities; for example, the resolvers are accessible on the same IP address, or there is a <del> certificate that claims ownership over both resolvers. </del>  1.1.

We only require you to check the designated resolver IP so this text is now incorrect.
lgtm
How's this?
lgtm v2

resolver.  "Designated" in this context means that the resolvers are operated by the same entity or cooperating entities; for example, the resolvers are accessible on the same IP address, or there is a  <ins> certificate that claims ownership over the IP address for the original designating resolver. </ins> 1.1.


Resolver without some sort of validation, such as the two methods defined in this document or a future mechanism.  4.2. Verified Discovery is a mechanism that allows automatic use of a

DDR designations, especially for/to non-public IP addresses, will break if cached across networks. Requirements and considerations need to be added to ensure correct behavior.
Closing with PR

Resolver without some sort of validation, such as the two methods defined in this document or a future mechanism. <ins> A client MUST NOT use a Designated Resolver designated by one Unencrypted Resolver in place of another Unencrypted Resolver.  As these are known only by IP address, this means each unique IP address used for unencrypted DNS requires its own designation discovery. This ensures queries are being sent to a party designated by the resolver originally being used. Generally, clients also SHOULD NOT reuse the Designated Resolver discovered from an Unencrypted Resolver over one network connection in place of the same Unencrypted Resolver on another network connection.  Instead, clients SHOULD repeat the discovery process on the other network connection. However, if a given Unencrypted Resolver designates a Designated Resolver that uses a public IP address and can be verified using the mechanism described in verified, it MAY be used on different network connections so long as the subsequent connections over other networks can also be successfully verified using the mechanism described in verified.  This is a tradeoff between performance (by having no delay in establishing an encrypted DNS connection on the new network) and functionality (if the Unencrypted Resolver intends to designate different Designated Resolvers based on the network from which clients connect). </ins> 4.2. Verified Discovery is a mechanism that allows automatic use of a


preference using the priority fields in each SVCB record I-D.ietf- dnsop-svcb-https.  To avoid name lookup deadlock, Designated Resolvers SHOULD follow the guidance in Section 10 of RFC8484 regarding the avoidance of DNS- based references that block the completion of the TLS handshake.

To address
We should clarify that if a client doesn’t understand a mandatory parameter in an SVCB record, it MUST NOT use it as normal DoT/DoH, since it could be misinterpreting the meaning.
Concrete example might be with: "mandatory=foo,dohpath foo=[...] alpn=h2 dohpath=[...]" Where clients which don't know how to handle "foo" must ignore that RR in the RRset, which might also contain other SVCB RRs for just DoH.

preference using the priority fields in each SVCB record I-D.ietf- dnsop-svcb-https. <ins> If the client encounters a mandatory parameter in an SVCB record it does not understand, it MUST NOT use that record to discover a Designated Resolver.  The client can still use others records in the same response if the client can understand all of their mandatory parameters.  This allows future encrypted deployments to simultaneously support protocols even if a given client is not aware of all those protocols.  For example, if the Unencrypted Resolver returns three SVCB records, one for DoH, one for DoT, and one for a yet-to-exist protocol, a client which only supports DoH and DoT should be able to use those records while safely ignoring the third record. </ins> To avoid name lookup deadlock, Designated Resolvers SHOULD follow the guidance in Section 10 of RFC8484 regarding the avoidance of DNS- based references that block the completion of the TLS handshake.


When a client discovers Designated Resolvers, it learns information such as the supported protocols and ports.  This information is <del> provided in Service Binding (SVCB) records for DNS Servers.  The formatting of these records, including the DNS-unique parameters such as "dohpath", are defined by I-D.ietf-add-svcb-dns. </del>  The following is an example of an SVCB record describing a DoH server discovered by querying for "_dns.example.net": record type (64) I-D.ietf-dnsop-svcb-https. Because this query is for an SUDN, which no entity can claim <del> ownership over, the SVCB response MUST NOT use the "." value for the TargetName.  Instead, the domain name used for DoT or used to construct the DoH template MUST be provided. </del>  The following is an example of an SVCB record describing a DoH server discovered by querying for "_dns.resolver.arpa":

Addressing
We should be explicit about AliasMode DDR records and give an example of where they are used. We should also mention the additional client complexity here, and we may wish to require that the unencrypted resolver include both the AliasMode and ServiceMode records in its response (with the latter in the additional section). A common use-case here will be if a network operator is using a managed service to provide a designated resolver service. In these cases it may be preferable to have URL be an AliasMode record to a ServiceMode record managed by the manage service operator.
One small nit, to avoid quasi normative language (may/MAY -> can).

When a client discovers Designated Resolvers, it learns information such as the supported protocols and ports.  This information is  <ins> provided in ServiceMode Service Binding (SVCB) records for DNS Servers, although AliasMode SVCB records can be used to direct clients to the needed ServiceMode SVCB record per I-D.ietf-dnsop- svcb-https.  The formatting of these records, including the DNS- unique parameters such as "dohpath", are defined by I-D.ietf-add- svcb-dns. </ins> The following is an example of an SVCB record describing a DoH server discovered by querying for "_dns.example.net": record type (64) I-D.ietf-dnsop-svcb-https. Because this query is for an SUDN, which no entity can claim  <ins> ownership over, the ServiceMode SVCB response MUST NOT use the "." value for the TargetName.  Instead, the domain name used for DoT or used to construct the DoH template MUST be provided. </ins> The following is an example of an SVCB record describing a DoH server discovered by querying for "_dns.resolver.arpa":


be configured to present the appropriate TLS certificate when no SNI is present for both DoT and DoH.  7. Since clients can receive DNS SVCB answers over unencrypted DNS, on-

From WGLC, Med wrote:
Also, a suggestion to say: use DDR to discover details about all supported encrypted DNS protocols. This situation can arise if a client has been configured to use a given Encrypted Resolver, or if a network provisioning protocol (such as DHCP or IPv6 Router Advertisements) provides a name for an Encrypted Resolver alongside the resolver IP address.

be configured to present the appropriate TLS certificate when no SNI is present for both DoT and DoH. <ins> 6.4. Discovery of network-designated resolvers (DNR, I-D.ietf-add-dnr) allows a network to provide designation of resolvers directly through DHCP RFC2132 RFC8415 and IPv6 Router Advertisement (RA) RFC4861 options.  When such indications are present, clients can suppress queries for "resolver.arpa" to the unencrypted DNS server indicated by the network over DHCP or RAs, and the DNR indications SHOULD take precedence over those discovered using "resolver.arpa" for the same resolver if there is a conflict. The designated resolver information in DNR might not contain a full set of SvcParams needed to connect to an encrypted resolver.  In such a case, the client can use an SVCB query using a resolver name, as described in encrypted, to the authentication-domain-name (ADN). </ins> 7. Since clients can receive DNS SVCB answers over unencrypted DNS, on-


6.4.  Discovery of network-designated resolvers (DNR, I-D.ietf-add-dnr) allows a network to provide designation of resolvers directly through DHCP RFC2132 RFC8415 and IPv6 Router Advertisement (RA) RFC4861 communicate with the Unencrypted Resolver much like "ipv4only.arpa" allows for client-to-middlebox communication.  For more context, see the rationale behind "ipv4only.arpa" in RFC8880.

Addressing
NAME I've bravely stolen some text to meet the additional IANA request.
Resolvers will normally return NXDOMAIN for queries that don't exist, and caches are permitted to treat this as an indication that no records of any type exist at the zone (RFC 8020). That means that it isn't enough for resolvers to synthesize a SVCB response for URL they also have to synthesize a NOERROR response for any other QTYPE on that name. The draft should probably mention that. Credit to NAME for noticing this.
NAME agreed that we could note this, but it's also expected that a client wouldn't be sending out queries for other types on URL, right? In practice, I'm not sure how this would happen.
Yes, but if a cache is shared by multiple clients (be they distinct devices on a network or even distinct apps on a device), a single client could issue a query that causes the shared cache to remember the NXDOMAIN answer. That's a problem whether the source of the query is malicious or just weird.
Fair, so this could be accidental or malicious fallout, not a normal occurrence.
I'd suggest that there should also be a reference to RFC 6303 section 3 - should be considered a "locally resolved domain".
Closed with

6.4. <ins> DNS resolvers that support DDR by responding to queries for _dns.resolver.arpa SHOULD treat resolver.arpa as a locally served zone per RFC6303.  In practice, this means that resolvers SHOULD respond to queries of any type other than SVCB for _dns.resolver.arpa with NODATA and queries of any type for any domain name under resolver.arpa with NODATA. 6.5. </ins> Discovery of network-designated resolvers (DNR, I-D.ietf-add-dnr) allows a network to provide designation of resolvers directly through DHCP RFC2132 RFC8415 and IPv6 Router Advertisement (RA) RFC4861 communicate with the Unencrypted Resolver much like "ipv4only.arpa" allows for client-to-middlebox communication.  For more context, see the rationale behind "ipv4only.arpa" in RFC8880. <ins> IANA is requested to add an entry in "Transport-Independent Locally- Served DNS Zones" registry for 'resolver.arpa.' with the description "DNS Resolver Special-Use Domain", listing this document as the reference. </ins>


field.  A DNS forwarder which already acts as a completely blind forwarder MAY choose to forward these queries when the operator expects that this does not apply, either because the operator knows <del> the upstream resolver does have the forwarder's IP address in its TLS certificate's SAN field or that the operator expects clients of the unencrypted resolver to use the SVCB information opportunistically. </del>  Operators who choose to forward queries for "resolver.arpa" upstream should note that client behavior is never guaranteed and use of DDR

Yeah, we want the trailing dot in official DNS records, but I think it's unnecessary elsewhere (IMO).
I assume the trailing dot is unnecessary for domain names in the non-example text because it can be more human friendly and not exact format? Assuming yes to that, LGTM

field.  A DNS forwarder which already acts as a completely blind forwarder MAY choose to forward these queries when the operator expects that this does not apply, either because the operator knows  <ins> that the upstream resolver does have the forwarder's IP address in its TLS certificate's SAN field or that the operator expects clients of the unencrypted resolver to use the SVCB information opportunistically. </ins> Operators who choose to forward queries for "resolver.arpa" upstream should note that client behavior is never guaranteed and use of DDR


4. When a DNS client is configured with an Unencrypted Resolver IP <del> address, it SHOULD query the resolver for SVCB records for "dns://resolver.arpa" before making other queries.  Specifically, the </del>  client issues a query for "_dns.resolver.arpa" with the SVCB resource record type (64) I-D.ietf-dnsop-svcb-https. If the recursive resolver that receives this query has one or more Designated Resolvers, it will return the corresponding SVCB records. <del> When responding to these special queries for "dns://resolver.arpa", the recursive resolver SHOULD include the A and AAAA records for the name of the Designated Resolver in the Additional Answers section. This will allow the DNS client to make queries over an encrypted </del>  connection without waiting to resolve the Encrypted Resolver name per I-D.ietf-dnsop-svcb-https.  If no A/AAAA records or SVCB IP address hints are included, clients will be forced to delay use of the a mode in which clients do not validate the name of the resolver presented in the certificate.  Opportunistic Privacy similarly applies to DoQ RFC9250.  A client MAY use information from the SVCB <del> record for "dns://resolver.arpa" with this "opportunistic" approach (not validating the names presented in the SubjectAlternativeName field of the certificate) as long as the IP address of the Encrypted Resolver does not differ from the IP address of the Unencrypted Resolver.  Clients SHOULD use this mode only for resolvers using private or local IP addresses.  This approach can be used for any encrypted DNS protocol that uses TLS. </del>  5.

There is no need to use a DNS URI for this. You are only using the name. And you don't cite RFC 4501. It is also incorrect, because you are treating "URL" as the authority, rather than the qname. What you really want is "URL;type=64" or something like that. But the words you have are adequately clear.

4. When a DNS client is configured with an Unencrypted Resolver IP  <ins> address, it SHOULD query the resolver for SVCB records for the name "resolver.arpa" before making other queries.  Specifically, the </ins> client issues a query for "_dns.resolver.arpa" with the SVCB resource record type (64) I-D.ietf-dnsop-svcb-https. If the recursive resolver that receives this query has one or more Designated Resolvers, it will return the corresponding SVCB records.  <ins> When responding to these special queries for "resolver.arpa", the recursive resolver SHOULD include the A and AAAA records for the name of the Designated Resolver in the Additional Answers section.  This will allow the DNS client to make queries over an encrypted </ins> connection without waiting to resolve the Encrypted Resolver name per I-D.ietf-dnsop-svcb-https.  If no A/AAAA records or SVCB IP address hints are included, clients will be forced to delay use of the a mode in which clients do not validate the name of the resolver presented in the certificate.  Opportunistic Privacy similarly applies to DoQ RFC9250.  A client MAY use information from the SVCB  <ins> record for "resolver.arpa" with this "opportunistic" approach (not validating the names presented in the SubjectAlternativeName field of the certificate) as long as the IP address of the Encrypted Resolver does not differ from the IP address of the Unencrypted Resolver. Clients SHOULD use this mode only for resolvers using private or local IP addresses.  This approach can be used for any encrypted DNS protocol that uses TLS. </ins> 5.


configuration over unencrypted DNS is not possible.  This includes Unencrypted Resolvers on private IP addresses RFC1918, Unique Local Addresses (ULAs) RFC4193, and Link Local Addresses RFC3927 RFC4291, <del> whose identity cannot be confirmed using TLS certificates. </del>  Opportunistic Privacy is defined for DoT in Section 4.1 of RFC7858 as a mode in which clients do not validate the name of the resolver

But all bets are off with trust anchors outside of the WebPKI. (Plus a small tweak to the next paragraph.)

configuration over unencrypted DNS is not possible.  This includes Unencrypted Resolvers on private IP addresses RFC1918, Unique Local Addresses (ULAs) RFC4193, and Link Local Addresses RFC3927 RFC4291,  <ins> whose identity cannot be confirmed using TLS certificates under most conditions. </ins> Opportunistic Privacy is defined for DoT in Section 4.1 of RFC7858 as a mode in which clients do not validate the name of the resolver


handshake. In order to be considered a verified Designated Resolver, the TLS <del> certificate presented by the Designated Resolver MUST contain the IP address of the designating Unencrypted Resolver in a subjectAltName extension.  If the certificate can be validated, the client SHOULD use the discovered Designated Resolver for any cases in which it would have otherwise used the Unencrypted Resolver.  If the Designated Resolver has a different IP address than the Unencrypted Resolver and the TLS certificate does not cover the Unencrypted Resolver address, the client MUST NOT automatically use the </del>  discovered Designated Resolver.  Additionally, the client SHOULD suppress any further queries for Designated Resolvers using this Unencrypted Resolver for the length of time indicated by the SVCB

That's it apparently. No mention of RFC 6125(bis). On that basis, a self-signed certificate suffices. This is something that recently came up on the mailing list and apparently current deployments are validating based on WebPKI trust anchors in addition to checking for the iPAddress subjectAltName. So it's not as bad as this allows. Maybe that should be written down. The same problematic text is found in Section 4.2 and Section 5.
NAME do you have a suggestion about the right way to explain the trust anchor use here? Any text we can model after?
s/MUST contain/MUST prove authority over/ ?
I'm not looking to aggressively economize here. I was wrong about 6125. A reference to URL for the IP reference identity might be needed to cover the SAN validation piece. RFC 6125bis doesn't include the IP-ID piece, which is something I'm going to take up with the UTA WG... But it is RFC 5280 that you really want here. describes how you take a certificate and determine if you trust what it says. Start there, then talk about what the certificate needs to say (IP SAN) in order for it to be accepted. (BTW, RFC 9110 doesn't cite Section 6 of RFC 5280. It should, and it is probably my fault that it doesn't. Section 1.2 of RFC 6125bis says "In order to ensure proper authentication, applications need to verify the entire certification path as per ]" but this is a bit weak.) This is about a paragraph all up, which isn't too much to ask.
NAME take a look at the proposed text
LGTM

handshake. In order to be considered a verified Designated Resolver, the TLS  <ins> certificate presented by the Designated Resolver needs to pass the following checks made by the client: The client MUST verify the chain of certificates up to a trust anchor as described in Section 6 of RFC5280.  This SHOULD use the default system or application trust anchors. The client MUST verify that the certificate contains the IP address of the designating Unencrypted Resolver in a subjectAltName extension. If these checks pass, the client SHOULD use the discovered Designated Resolver for any cases in which it would have otherwise used the Unencrypted Resolver. If these checks fail, the client MUST NOT automatically use the </ins> discovered Designated Resolver.  Additionally, the client SHOULD suppress any further queries for Designated Resolvers using this Unencrypted Resolver for the length of time indicated by the SVCB


DoH resolvers that allow discovery using DNS SVCB answers over unencrypted DNS MUST NOT provide differentiated behavior based on the HTTP path alone, since an attacker could modify the "dohpath" <del> parameter. </del>  While the IP address of the Unencrypted Resolver is often provisioned over insecure mechanisms, it can also be provisioned securely, such

NAME please review!!
What does this mean? I'm struggling to work out what this might mean for someone operating a DoH server. Does this mean that rewriting "/doh{?dns}" to "/~attacker/abcdef{dns}URL" is considered something that the DoH resolver needs to identify and recover from? Or, is this more narrow in that a DoH server cannot offer two different services on a referred endpoint with different treatment policies? In the former case, the attacker can deny service by modifying the "dohpath". In the latter case, the attacker gets to choose which of the two services is used. I think that you want to lump the former under the general DoS risk. But the latter implies something very specific in terms of action on the part of the resolver operator. They cannot offer more than one DoH service on the same IP address (where DDR doesn't give them any virtual hosting capabilities via SNI) or hostname (where it does). You might need to be a lot clearer about that.
This is about the latter case — if the resolver offers two very different services on different paths, the attacker would get to choose which service is used. That doesn't mean you can't offer different services on the same resolver IP address, but something else would need to be different other than the path — like, for DDR clients, they'll be using the IP address, but some client that was configured with a specific service might use a specific hostname too.
This is from this: URL
See also: URL
NAME please see
Thanks NAME this is an improvement.LGTM

DoH resolvers that allow discovery using DNS SVCB answers over unencrypted DNS MUST NOT provide differentiated behavior based on the HTTP path alone, since an attacker could modify the "dohpath"  <ins> parameter.  For example, if a DoH resolver provides provides a filtering service for one URI path, and a non-filtered service for another URI path, an attacker could select which of these services is used by modifying the "dohpath" parameter.  These attacks can be mitigated by providing separate resolver IP addresses or hostnames. </ins> While the IP address of the Unencrypted Resolver is often provisioned over insecure mechanisms, it can also be provisioned securely, such


A client MAY additionally use a discovered Designated Resolver without either of these methods, based on implementation-specific policy or user input.  Details of such policy are out of scope of <del> this document.  Clients SHOULD NOT automatically use a Designated </del>  Resolver without some sort of validation, such as the two methods defined in this document or a future mechanism. <del> A client MUST NOT use a Designated Resolver designated by one Unencrypted Resolver in place of another Unencrypted Resolver.  As these are known only by IP address, this means each unique IP address used for unencrypted DNS requires its own designation discovery. This ensures queries are being sent to a party designated by the </del>  resolver originally being used. 4.1.1. <del> Generally, clients also SHOULD NOT reuse the Designated Resolver discovered from an Unencrypted Resolver over one network connection in place of the same Unencrypted Resolver on another network connection.  Instead, clients SHOULD repeat the discovery process on the other network connection. </del>  However, if a given Unencrypted Resolver designates a Designated Resolver that does not use a private or local IP address and can be

Addressing the comments in
Why the following isn't a MUST NOT? Clients SHOULD NOT automatically use a Designated Resolver without some sort of validation, such as the two methods defined in this document or a future mechanism. This bit is puzzling: A client MUST NOT use a Designated Resolver designated by one Unencrypted Resolver in place of another Unencrypted Resolver. There seems to be some context missing to explain why a client should found itself in that position. What I seem to understand from the text that follows: As these are known only by IP address, this means each unique IP address used for unencrypted DNS requires its own designation discovery. This ensures queries are being sent to a party designated by the resolver originally being used. is that clients must go through the designation process when their network attachment changes / they are re-configured WRT their UR. And that's because there is strict administrative coupling between a UR and its DRs that would be subverted otherwise. I am scanning this for the first time and I may be off on a tangent space, but if my reading is correct, then the text could be reorganised a bit to make the context for the requirement clearer. I found this other bit hard to parse: Generally, clients also SHOULD NOT reuse the Designated Resolver discovered from an Unencrypted Resolver over one network connection in place of the same Unencrypted Resolver on another network connection. What about: If a client is configured with the same Unencrypted Resolver's IP address on two different networks n1 and n2, a Designated Resolver that has been discovered on n1 SHOULD NOT be reused on n2 without repeating the discovery process. instead? In the IANA section IANA is requested to add an entry in "Transport-Independent Locally-Served DNS Zones" registry for 'URL' with the description "DNS Resolver Special-Use Domain", listing this document as the reference. Ignorant question: is there an associated delegation of 'URL' needed in the '.arpa.' zone? Or is that not necessary?
NAME could you take a pass at this? (For the .arpa one, we shouldn't do anything to the arpa zone)

A client MAY additionally use a discovered Designated Resolver without either of these methods, based on implementation-specific policy or user input.  Details of such policy are out of scope of  <ins> this document.  Clients MUST NOT automatically use a Designated </ins> Resolver without some sort of validation, such as the two methods defined in this document or a future mechanism.  <ins> A client MUST NOT re-use a designation discovered using the IP address of one Unencrypted Resolver in place of any other Unencrypted Resolver.  Instead, the client SHOULD repeat the discovery process to discover the Designated Resolver of the other Unencrypted Resolver. In other words, designations are per-resolver and MUST NOT be used to configure the client's universal DNS behavior.  This ensures in all cases that queries are being sent to a party designated by the </ins> resolver originally being used. 4.1.1.  <ins> If a client is configured with the same Unencrypted Resolver IP address on multiple different networks, a Designated Resolver that has been discovered on one network SHOULD NOT be reused on any of the other networks without repeating the discovery process for each network. </ins> However, if a given Unencrypted Resolver designates a Designated Resolver that does not use a private or local IP address and can be


default system or application trust anchors. The client MUST verify that the certificate contains the IP <del> address of the designating Unencrypted Resolver in a subjectAltName extension. </del>  If these checks pass, the client SHOULD use the discovered Designated Resolver for any cases in which it would have otherwise used the

Section 4.2 The client MUST verify that the certificate contains the IP address of the designating Unencrypted Resolver in a subjectAltName extension. Consider being more precise by saying: NEW The client MUST verify that the certificate contains the IP address of the designating Unencrypted Resolver in an iPAddress entry of the subjectAltName extension (see 4.2.1.6 of [RFC5280]). Section 5. For these cases, the client simply sends a DNS SVCB query using the known name of the resolver. This query can be issued to the named Encrypted Resolver itself or to any other resolver. Unlike the case of bootstrapping from an Unencrypted Resolver (Section 4), these records SHOULD be available in the public DNS. If there was a limited domain mechanism using DDR, why would these records be in public DNS?

default system or application trust anchors. The client MUST verify that the certificate contains the IP  <ins> address of the designating Unencrypted Resolver in an iPAddress entry of the subjectAltName extension as described in Section 4.2.1.6 of RFC5280. </ins> If these checks pass, the client SHOULD use the discovered Designated Resolver for any cases in which it would have otherwise used the


If the client encounters a mandatory parameter in an SVCB record it does not understand, it MUST NOT use that record to discover a <del> Designated Resolver.  The client can still use others records in the </del>  same response if the client can understand all of their mandatory parameters.  This allows future encrypted deployments to simultaneously support protocols even if a given client is not aware DoH resolvers that allow discovery using DNS SVCB answers over unencrypted DNS MUST NOT provide differentiated behavior based on the HTTP path alone, since an attacker could modify the "dohpath" <del> parameter.  For example, if a DoH resolver provides provides a filtering service for one URI path, and a non-filtered service for another URI path, an attacker could select which of these services is used by modifying the "dohpath" parameter.  These attacks can be mitigated by providing separate resolver IP addresses or hostnames. </del>  While the IP address of the Unencrypted Resolver is often provisioned over insecure mechanisms, it can also be provisioned securely, such This document calls for the addition of "resolver.arpa" to the Special-Use Domain Names (SUDN) registry established by RFC6761. <del> This will allow resolvers to respond to queries directed at themselves rather than a specific domain name.  While this document uses "resolver.arpa" to return SVCB records indicating designated encrypted capability, the name is generic enough to allow future reuse for other purposes where the resolver wishes to provide information about itself to the client. The "resolver.arpa" SUDN is similar to "ipv4only.arpa" in that the querying client is not interested in an answer from the authoritative "arpa" name servers.  The intent of the SUDN is to allow clients to communicate with the Unencrypted Resolver much like "ipv4only.arpa" allows for client-to-middlebox communication.  For more context, see the rationale behind "ipv4only.arpa" in RFC8880. </del> IANA is requested to add an entry in "Transport-Independent Locally- Served DNS Zones" registry for 'resolver.arpa.' with the description

Thanks for the painless read! Just a few trivial comments. Minor: The editorial commentary in the IANA Considerations section seems out of place -- generally IANA Considerations is, well, requests to IANA, not interesting and fun trivia about the resources being requested. But, IANA are smart enough to disregard the superflous material. Nits: , The client can still use others records in the same response s/others/other/ , provides provides s/provides//

If the client encounters a mandatory parameter in an SVCB record it does not understand, it MUST NOT use that record to discover a  <ins> Designated Resolver.  The client can still use other records in the </ins> same response if the client can understand all of their mandatory parameters.  This allows future encrypted deployments to simultaneously support protocols even if a given client is not aware DoH resolvers that allow discovery using DNS SVCB answers over unencrypted DNS MUST NOT provide differentiated behavior based on the HTTP path alone, since an attacker could modify the "dohpath"  <ins> parameter.  For example, if a DoH resolver provides a filtering service for one URI path, and a non-filtered service for another URI path, an attacker could select which of these services is used by modifying the "dohpath" parameter.  These attacks can be mitigated by providing separate resolver IP addresses or hostnames. </ins> While the IP address of the Unencrypted Resolver is often provisioned over insecure mechanisms, it can also be provisioned securely, such This document calls for the addition of "resolver.arpa" to the Special-Use Domain Names (SUDN) registry established by RFC6761.  IANA is requested to add an entry in "Transport-Independent Locally- Served DNS Zones" registry for 'resolver.arpa.' with the description


current mechanisms such as DoH, DoT, and DoQ, as well as future mechanisms. <del> A DNS resolver using TCP or UDP port 53 without encryption. </del>  3. address, it ought to provide an A record for an IPv4 address of the Designated Resolver; similarly, if it is accessible using an IPv6 address, it ought to provide a AAAA record for an IPv6 address of the <del> Designated Resolver.  The Designated Resolver can support more address families than the Unencrypted Resolver, but it ought not to </del>  support fewer.  If this is not done, clients that only have connectivity over one address family might not be able to access the Designated Resolver.

CC NAME I might suggest a slightly less binding wording where port 53 is concerned for the Unencrypted Resolver definition. Perhaps: "A DNS resolver using a transport without encryption, historically TCP or UDP port 53." I'd be in favor of using more RFC 8174 "SHOULD/SHOULD NOT" text in place of "ought [not] to". Specifically, for the text about address family support, consider perhaps something like: OLD: ... The Designated Resolver can support more address families than the Unencrypted Resolver, but it ought not to support fewer. NEW: ... The Designated Resolver MAY support more address families than the Unencrypted Resolver, but it SHOULD NOT support fewer. I wonder if it's good to require that clients MUST NOT/SHOULD NOT accept certificates claiming to be for URL This might be over-specifying things and/or it might be a check against some types of misconfigurations.

current mechanisms such as DoH, DoT, and DoQ, as well as future mechanisms.  <ins> A DNS resolver using a transport without encryption, historically TCP or UDP port 53. </ins> 3. address, it ought to provide an A record for an IPv4 address of the Designated Resolver; similarly, if it is accessible using an IPv6 address, it ought to provide a AAAA record for an IPv6 address of the  <ins> Designated Resolver.  The Designated Resolver MAY support more address families than the Unencrypted Resolver, but it SHOULD NOT </ins> support fewer.  If this is not done, clients that only have connectivity over one address family might not be able to access the Designated Resolver.


resolver.  "Designated" in this context means that the resolvers are operated by the same entity or cooperating entities; for example, the resolvers are accessible on the same IP address, or there is a <del> certificate that claims ownership over the IP address for the original designating resolver. </del>  1.1. configuration over unencrypted DNS is not possible.  This includes Unencrypted Resolvers on private IP addresses RFC1918, Unique Local Addresses (ULAs) RFC4193, and Link Local Addresses RFC3927 RFC4291, <del> whose identity cannot be confirmed using TLS certificates under most conditions. </del>  Opportunistic Privacy is defined for DoT in Section 4.1 of RFC7858 as a mode in which clients do not validate the name of the resolver the certificate) as long as the IP address of the Encrypted Resolver does not differ from the IP address of the Unencrypted Resolver. Clients SHOULD use this mode only for resolvers using private or <del> local IP addresses.  This approach can be used for any encrypted DNS protocol that uses TLS. </del>  5. Unencrypted Resolver, clients applying Verified Discovery (verified) MUST validate that the IP address of the Unencrypted Resolver is covered by the SubjectAlternativeName of the Designated Resolver's <del> TLS certificate. </del>  Clients using Opportunistic Discovery (opportunistic) MUST be limited to cases where the Unencrypted Resolver and Designated Resolver have <del> the same IP address. </del>  The constraints on the use of Designated Resolvers specified here apply specifically to the automatic discovery mechanisms defined in

This review does NOT close the issue; it only addresses the "easier" items. The harder, normative challenging comments may be tackled together with overlapping feedback from other reviewers such as Ben.
Summary: Has issues to address before publication as a Proposed Standard RFC (Note: I reviewed -07, and noticed -08 while entering this review. I've read the diffs, and believe all the below to still be relevant). Issues: RFC 6761 requires explicit discussion of seven categories of consumers of a new SUDN. This document does not yet provide that discussion. There's a lack of discussion of issues around certificate revocation throughout the document. The end of section 4.1.1, for example, cuts off an mitigation opportunity should control of a certificate used by the Designated Resolver be lost. Please add an explanation for why the requirement in the last sentence of the first paragraph of 4.2 exists. As written, it seems out of context, and underspecified (which SVBC result, obtained when, should the client consider the TTL from?). The discussion of providing differentiated behavior over unencrypted DNS is good to call out, but needs more depth. There are many other fields an attacker might modify, even outside the DNS part of the datagram (say, the source IP address) that could give the attacker an advantage if the returned results varied. Nits: In the introduction, please reconsider "claims ownership over the IP addresses". It would be better to simply say "contains the IP addresses in the SubjectAltName. There is tension between the normative SHOULD NOT and SHOULD in the first paragraph of 4.1.1 and the SHOULD in the first paragraph of 4.2. Please clarify the wording in one place or the other so that an implementer isn't forced to violate one of those normative requirements to satisfy the other. The last sentence of the first paragraph of 4.3 is imprecise. It would address my discomfort to replace "cannot be confirmed" with "cannot be safely confirmed", or add a pointer to a description somewhere else about why trying to include such addresses in a certificate is an unworkable idea. At the end of the second paragraph of 4.3, consider future protocols that might use something other than TLS as the security layer. The sentence as is takes a shortcut past the point your are really trying to make. The use of SHOULD in the second paragraph of section 5 is strange. Do you mean "are expected to be"? The other side of this coin (that records are NOT expected to be present) isn't obvious to find in section 4. Consider explicitly calling out what the implementation MUST do if the validation in the 4th paragraph of section 7 fails. (Feel free to ignore this, but): At the 5th paragraph of section 7, consider discussing the risks of an operator running an Unencrypted Resolver at a given IP and not running a Designated Resolver there. This adds an attack point for an adversary to gain enough access to run their own Designated Resolver there, even if they can't gain enough privilege to affect the Unencrypted Resolver. Micro-Nits: Section 3 3rd to last paragraph: s/use others records/use other records/
Major issues already addressed in other PRs, and nits addressed in

resolver.  "Designated" in this context means that the resolvers are operated by the same entity or cooperating entities; for example, the resolvers are accessible on the same IP address, or there is a  <ins> certificate that contains the IP address for the original designating resolver. </ins> 1.1. configuration over unencrypted DNS is not possible.  This includes Unencrypted Resolvers on private IP addresses RFC1918, Unique Local Addresses (ULAs) RFC4193, and Link Local Addresses RFC3927 RFC4291,  <ins> whose identity cannot be safely confirmed using TLS certificates under most conditions. </ins> Opportunistic Privacy is defined for DoT in Section 4.1 of RFC7858 as a mode in which clients do not validate the name of the resolver the certificate) as long as the IP address of the Encrypted Resolver does not differ from the IP address of the Unencrypted Resolver. Clients SHOULD use this mode only for resolvers using private or  <ins> local IP addresses. </ins> 5. Unencrypted Resolver, clients applying Verified Discovery (verified) MUST validate that the IP address of the Unencrypted Resolver is covered by the SubjectAlternativeName of the Designated Resolver's  <ins> TLS certificate.  If that validation fails, the client MUST NOT automatically use the discovered Designated Resolver. </ins> Clients using Opportunistic Discovery (opportunistic) MUST be limited to cases where the Unencrypted Resolver and Designated Resolver have  <ins> the same IP address.  Clients which do not follow Opportunistic Discovery (opportunistic) and instead try to connect without first checking for a designation run the possible risk of being intercepted by an attacker hosting an Encrypted DNS Resolver on an IP address of an Unencrypted DNS Resolver where the attacker has failed to gain control of the Unencrypted DNS Resolver. </ins> The constraints on the use of Designated Resolvers specified here apply specifically to the automatic discovery mechanisms defined in


When a DNS client is configured with an Unencrypted DNS Resolver IP address, it SHOULD query the resolver for SVCB records for the name <del> "resolver.arpa" before making other queries.  Specifically, the client issues a query for "_dns.resolver.arpa" with the SVCB resource record type (64) I-D.ietf-dnsop-svcb-https. </del>  Because this query is for an SUDN, which no entity can claim ownership over, the ServiceMode SVCB response MUST NOT use the "." If the recursive resolver that receives this query has no Designated Resolvers, it SHOULD return NODATA for queries to the "resolver.arpa" <del> SUDN. </del>  4.1. A client MUST NOT re-use a designation discovered using the IP address of one Unencrypted DNS Resolver in place of any other <del> Unencrypted DNS Resolver.  Instead, the client SHOULD repeat the </del>  discovery process to discover the Designated Resolver of the other Unencrypted DNS Resolver.  In other words, designations are per- resolver and MUST NOT be used to configure the client's universal DNS The client MUST verify the chain of certificates up to a trust anchor as described in Section 6 of RFC5280.  This SHOULD use the <del> default system or application trust anchors. </del>  The client MUST verify that the certificate contains the IP address of the designating Unencrypted DNS Resolver in an If these checks pass, the client SHOULD use the discovered Designated Resolver for any cases in which it would have otherwise used the <del> Unencrypted DNS Resolver. </del>  If these checks fail, the client MUST NOT automatically use the discovered Designated Resolver.  Additionally, the client SHOULD suppress any further queries for Designated Resolvers using this Unencrypted DNS Resolver for the length of time indicated by the SVCB <del> record's Time to Live (TTL). </del>  If the Designated Resolver and the Unencrypted DNS Resolver share an IP address, clients MAY choose to opportunistically use the the certificate) as long as the IP address of the Encrypted DNS Resolver does not differ from the IP address of the Unencrypted DNS Resolver.  Clients SHOULD use this mode only for resolvers using <del> private or local IP addresses. </del>  5. known name of the resolver.  This query can be issued to the named Encrypted DNS Resolver itself or to any other resolver.  Unlike the case of bootstrapping from an Unencrypted DNS Resolver <del> (bootstrapping), these records SHOULD be available in the public DNS. </del>  For example, if the client already knows about a DoT server "resolver.example.com", it can issue an SVCB query for queries for "resolver.arpa" to the unencrypted DNS server indicated by the network over DHCP or RAs, and the DNR indications SHOULD take precedence over those discovered using "resolver.arpa" for the same <del> resolver if there is a conflict. </del>  The designated resolver information in DNR might not contain a full set of SvcParams needed to connect to an encrypted DNS resolver.  In

NAME please check!
I think there are way too many bald SHOULDs in this document. Since SHOULD presents an implementer with a choice, it's usually a good idea to describe that choice rather than presenting something that looks like "you really should do this, but it's probably fine if you don't" and moves on. To wit: An example of one that could use improvement is the first one in Section 4, as I've no idea why you would not always do what it says. An example of one that does provide such guidance is the second one in Section 4, where I understand the consequences of not doing what it says.
LGTM!

When a DNS client is configured with an Unencrypted DNS Resolver IP address, it SHOULD query the resolver for SVCB records for the name  <ins> "resolver.arpa" before making other queries, in order to use Encrypted DNS for all other queries, if possible.  Specifically, the client issues a query for "_dns.resolver.arpa." with the SVCB resource record type (64) I-D.ietf-dnsop-svcb-https. </ins> Because this query is for an SUDN, which no entity can claim ownership over, the ServiceMode SVCB response MUST NOT use the "." If the recursive resolver that receives this query has no Designated Resolvers, it SHOULD return NODATA for queries to the "resolver.arpa"  <ins> SUDN, to provide a consistent and accurate signal to clients that it does not have a Designated Resolver. </ins> 4.1. A client MUST NOT re-use a designation discovered using the IP address of one Unencrypted DNS Resolver in place of any other  <ins> Unencrypted DNS Resolver.  Instead, the client needs to repeat the </ins> discovery process to discover the Designated Resolver of the other Unencrypted DNS Resolver.  In other words, designations are per- resolver and MUST NOT be used to configure the client's universal DNS The client MUST verify the chain of certificates up to a trust anchor as described in Section 6 of RFC5280.  This SHOULD use the  <ins> default system or application trust anchors, unless otherwise configured. </ins> The client MUST verify that the certificate contains the IP address of the designating Unencrypted DNS Resolver in an If these checks pass, the client SHOULD use the discovered Designated Resolver for any cases in which it would have otherwise used the  <ins> Unencrypted DNS Resolver, so as to prefer Encrypted DNS whenever possible. </ins> If these checks fail, the client MUST NOT automatically use the discovered Designated Resolver.  Additionally, the client SHOULD suppress any further queries for Designated Resolvers using this Unencrypted DNS Resolver for the length of time indicated by the SVCB  <ins> record's Time to Live (TTL) in order to avoid excessive queries that will lead to further failed validations. </ins> If the Designated Resolver and the Unencrypted DNS Resolver share an IP address, clients MAY choose to opportunistically use the the certificate) as long as the IP address of the Encrypted DNS Resolver does not differ from the IP address of the Unencrypted DNS Resolver.  Clients SHOULD use this mode only for resolvers using  <ins> private or local IP addresses, since resolvers that use other addresses are able to provision TLS certificates for their addresses. </ins> 5. known name of the resolver.  This query can be issued to the named Encrypted DNS Resolver itself or to any other resolver.  Unlike the case of bootstrapping from an Unencrypted DNS Resolver  <ins> (bootstrapping), these records SHOULD be available in the public DNS if the same domain name's A or AAAA records are available in the public DNS to allow using any resolver to discover another resolver's Designated Resolvers.  When the name can only be resolved in private namespaces, these records SHOULD be available to the same audience as the A and AAAA records. </ins> For example, if the client already knows about a DoT server "resolver.example.com", it can issue an SVCB query for queries for "resolver.arpa" to the unencrypted DNS server indicated by the network over DHCP or RAs, and the DNR indications SHOULD take precedence over those discovered using "resolver.arpa" for the same  <ins> resolver if there is a conflict, since DNR is considered a more reliable source. </ins> The designated resolver information in DNR might not contain a full set of SvcParams needed to connect to an encrypted DNS resolver.  In


Requirements for Adaptive DNS Discovery <del> draft-add-requirements-latest </del>  Abstract Adaptive DNS Discovery is chartered to define mechanisms that allow clients to discover and select encrypted DNS resolvers.  This <del> document seeks to provide a set of use cases and requirements that proposed mechanisms should address. </del>  1.  The Adaptive DNS Discovery (ADD) Working Group is chartered to define <del> mechanisms that allow clients to discover and select encrypted DNS resolvers in a wide variety of network environments.  This document seeks to provide a set of use cases and requirements that proposed mechanisms should address.  They can do this either by providing a solution, or by explicitly stating why it is not in scope. Use cases are described between first-usecase and last-usecase.  Each use case contains a narrative and a set of requirements that apply in that case.  Each is identified as "Ra.b" where a is the requirement group number and b is the number within that group.  Both a and b are integers starting with 1.  A summary of all requirements in listed in requirements-summary. </del>  <del> 2. </del>  The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and 14 RFC2119 RFC8174 when, and only when, they appear in all capitals, as shown here.  3. <del> A client may begin with information from the attached networks, and/ or resolvers known from configuration.  This information may be used to then discover one or more associated or equivalent encrypted resolvers.  These are expected to be operated by the same entity that provides the resolver the client started with, but may not have identical behaviour.  For example one entity may offer a set of encrypted resolvers with different levels of filtering or proximity. </del>  3.1. <del> During network attach, networks frequently announce a resolver that they recommend clients should use.  This could be through DHCP, RA, PPP, PCO, or another mechanism.  Historically this is usually a Do53 resolver, declared simply by its IP address.  However it could also be a richer set of information. </del>  3.1.1. benefits of a local caching forwarder with knowledge of the local topology.  3.2. <del> A client with manual configuration directing it to use a particular resolver will generally use that resolver.  However if that communication is unencrypted, it is beneficial for the client to learn which associated resolvers are offered by the same entity and provide the same semantics. </del>  3.3. <del> Narrative required. </del>  4. <del> Narrative required. </del>  4.1. 4.1.1. <del> Narrative required. </del>  4.1.2. 4.1.3. <del> Narrative required. </del>  4.2. <del> Narrative required. </del>  5.  This sections lists the complete set of requirements described above, for ease of reference. <del> 6. </del>  All security considerations relevant to a particular use case are <del> described under that section.  Additional consideration common to all of them are described here. </del>  <del> 7. </del>  This document has no IANA actions.

Authors, please comment.
I’m not sure adding authenticated here is something the group has consensus on as yet. I know this is still in early draft mode, so while I don’t object to including it, we should mark is as an item to be discussed. If we do include it, then some words should be added somewhere in the draft about what “authenticated” in such a context is being proposed to mean as that’s what will be a key discussion item in determining if it get consensus.
Glenn I merged "authenticated" before I read this comment. I added it because it made sense to me; without authentication any encryption is highly weakened. But I take your point that it needs explaining.
Ok, perhaps it can be added in the next rev. Basically I’m suggesting that the aspect of “authenticated” be expanded, discussed, and explained as it does potentially have different notions in different readers perspectives. For example some may say doing a DNSSEC validation of some sort is what is needed, or perhaps some form of PKI, or is it a TLS certificate validation, or mutual exchange? It might even be something as basic as asking special DNS queries and validating the answers received against expectations. Another slice would be authenticating the actual resolver chosen or is it authenticated at the more abstract “service” provided by the operator of the resolver? There is also the consideration of does the authentication means/level vary depending on different environmental threat levels? The bottom line is there is a lot of meanings behind “authentication” and what is being authenticated to declare and discuss as a requirement.
Several possible ways of authenticating the encrypted DNS server are already discussed in our spec URL I don't think the requirements draft should discuss the possible modes of authenticating the server.
How does the client learn the encrypted and unencrypted DNS servers are operated by the same administrative domain ? The client can authenticate the encrypted DNS servers but cannot authenticate the unencrypted DNS server ! Originally posted by NAME in URL
If it is genuinely impossible to prove association between two resolvers when one resolver is unencrypted, then perhaps we should not have the concept at all. But I'm hoping it is not impossible.
draft-pauly-add-deer-00 does this (at least in some circumstances), so it's not impossible.

Requirements for Adaptive DNS Discovery  <ins> draft-box-add-requirements-00 </ins> Abstract Adaptive DNS Discovery is chartered to define mechanisms that allow clients to discover and select encrypted DNS resolvers.  This  <ins> document describes several use cases for discovering DNS resolvers that support encrypted transports, and lists requirements that any proposed discovery and selection mechanisms should address. </ins> 1. <ins> Several protocols for protecting DNS traffic with encrypted transports have been defined, such as DNS-over-TLS (DoT) RFC7858 and DNS-over-HTTPS (DoH) RFC8484.  Encrypted DNS can provide many security and privacy benefits for network clients. While it is possible for clients to hard-code encrypted DNS resolvers to use, dynamic discovery and provisioning of encrypted resolvers can expand the usefulness and applicability of encrypted DNS to many more use cases. </ins> The Adaptive DNS Discovery (ADD) Working Group is chartered to define  <ins> mechanisms that allow clients to automatically discover and select encrypted DNS resolvers in a wide variety of network environments. This document describes several use cases for discovering DNS resolvers that support encrypted transports, and lists requirements that any proposed discovery and selection mechanisms should address. They can do this either by providing a solution, or by explicitly stating why it is not in scope. </ins>  <ins> Use cases are described between associated and cdn-content.  Each use case contains a narrative and a set of requirements that apply in that case.  There are additional common requirements in priv-sec. Each requirement is identified as "Ra.b" where a is the group number and b is the number within that group.  Both a and b are integers starting with 1. A summary of all requirements in listed in requirements-summary. 1.1. </ins> The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and 14 RFC2119 RFC8174 when, and only when, they appear in all capitals, as shown here. <ins> 2. This document makes use of the following terms. Encrypted DNS: DNS-over-HTTPS RFC8484, DNS-over-TLS RFC7858, or any other encrypted DNS technology that the IETF may publish, such as DNS-over-QUIC I-D.ietf-dprive-dnsoquic. Associated resolver: A resolver operated by the same entity that provides the resolver the client started with.  See associated. Equivalent associated resolver: An associated resolver that provides DNS responses that are identical to the ones served by the original unencrypted resolver. Alternative associated resolver: An associated resolver that serves different responses to some queries; see associated for examples. </ins> 3.  <ins> A client may begin with information about unencrypted resolvers from the attached networks (local-network), and/or unencrypted resolvers known from configuration (client-selected).  This information may be used to then discover one or more associated encrypted resolvers. Associated resolvers are defined as resolvers operated by the same entity that provides the resolver the client started with.  Such associated resolvers may come in two forms: Equivalent - these provide DNS responses that are identical to the ones served by the unencrypted resolver. Alternative - these serve different responses to some queries. For example one entity may offer a set of encrypted resolvers with different levels of filtering (none, just malware, or malware & adult content), or different proximity (local or central). The client may wish to select an equivalent associated resolver, or select one of the alternatives. Designs for resolver upgrade mechanisms can either add new parameters to existing provisioning mechanisms (for example, adding necessary information to use DoT or DoH to options in DHCP, RAs, or IKEv2) or else provide a way to communicate with a provisioned unencrypted DNS resolver and discover the associated encrypted DNS resolvers. </ins> 3.1.  <ins> DNS servers are often provisioned by a network as part of DHCP options RFC2132, IPv6 Router Advertisement (RA) options RFC8106, Point-to-Point Protocol (PPP) RFC1877, 3GPP Protocol Configuration Options, or another mechanism.  Historically this is usually one or more DNS resolver IP addresses, to be used for traditional unencrypted DNS.  However it could also be a richer set of information. Using an encrypted and authenticated resolver that is associated to the one provisioned by the network can provide several benefits that are not possible if only unencrypted DNS is used: Prevent other devices on the network from observing client DNS messages Verify that answers come from the selected DNS resolver Authenticate that the DNS resolver is the one provisioned by the network Frequently, network-provisioned resolvers are forwarders running on a local router.  The discovered encrypted resolvers in these cases may either be local forwarders themselves, or an associated resolver that is in the network (thus bypassing the router's DNS forwarder). </ins> 3.1.1. benefits of a local caching forwarder with knowledge of the local topology. <ins> Another benefit occurs with IoT devices.  A common usage pattern for such devices is for it to "call home" to a service that resides on the public Internet, where that service is referenced through a domain name (A or AAAA record).  As discussed in Manufacturer Usage Description Specification RFC8520, because these devices tend to require access to very few sites, all other access should be considered suspect.  However, if the query is not accessible for inspection, it becomes quite difficult for the infrastructure to suspect anything. </ins> 3.2.  <ins> Client devices often allow the device administrator to select a specific DNS resolver to use on certain networks, or on all networks. Historically, this selection was specified only with an IP address. Discovering which equivalent encrypted resolvers are offered by the same entity allows the client to "upgrade" connections to use encrypted DNS.  This can provide several benefits: Prevent devices along the network path to the selected resolver from observing client DNS messages Verify that answers come from the selected DNS resolver Authenticate that the DNS resolver is the one selected by the client In doing so it is critical that the new resolver is an equivalent resolver.  Switching to a non-equivalent alternative resolver would break the expectation of the user who previously selected that resolver. </ins> 3.3.  <ins> Virtual Private Networks (VPNs) also can provision DNS resolvers.  In addition to being able to use DHCP or RAs, VPNs can provision DNS information in an explicit configuration message.  For example, IKEv2 can provision DNS servers using Configuration Attributes RFC7296. VPNs can also configure Split DNS rules to limit the use of the configured resolvers to specific domain names RFC8598. Discovering an encrypted resolver that is provisioned by a VPN can provide the same benefits as doing so for a local network, but applied to the private network.  When using Split DNS, it becomes possible to use one encrypted resolver for private domains, and another for other domains. </ins> 4.  <ins> Similar to how VPN DNS configurations can use Split DNS for private names, other network environments can support resolution of names that are specific to the local environment.  For example, an enterprise-managed Wi-Fi network might be able to access both the Internet and a private intranet.  In such a scenario, the private domains managed by the enterprise might only be resolvable using a specific DNS resolver. Discovering an encrypted resolver for a subset of names allows a client to perform Split DNS while maintaining the benefits of encrypted DNS.  For example, a client could use a client-selected encrypted resolver for public domains, but use a different encrypted resolver for enterprise-private domains. Such domain-specific resolver discovery mechanisms additionally need to provide some information about the applicability and capabilities of encrypted resolvers.  This information can either be provisioned or can be discovered based on clients actively trying to access content. </ins> 4.1. 4.1.1.  <ins> Accessing locally-hosted content can require the use of a specific resolver.  For example, captive networks or networks with walled- garden content like media on airplane Wi-Fi networks can rely on using a resolver hosted on the local network. In cases where a client is using an encrypted resolver provisioned by a network, and that encrypted resolver is able to resolve names of local content, this can fall into the use case described in local- network.  However, it might be necessary to discover a local encrypted resolver along with specific domains if: the network-provisioned encrypted resolver is not able to resolve local-only names, or the client has a more-preferred encrypted resolver for generic traffic, and would otherwise not be able to access local content The first point can occur in a hybrid deployment, e.g. when the local resolver is unencrypted but a central one is encrypted.  Clients choosing the encrypted resolver for most queries will need to be advised to refer to the local one for some names. This case also include accessing content specific to a home network. </ins> 4.1.2. 4.1.3.  <ins> As stated above, an enterprise-managed Wi-Fi network might be able to access both the Internet and a private intranet.  The private domains managed by the enterprise might only be resolvable using a specific DNS resolver, hence use of that resolver is essential for such domains.  However it does not necessarily mean that all queries for all domains have to flow through that resolver. Only sending the necessary queries through the enterprise resolver, and not generic Internet queries, has the privacy benefit of only exposing traffic to the enterprise that fall within a limited set of domains. Using encrypted DNS for private names also opens up the possibility of doing private name resolution outside of the content of a VPN or managed network.  If the DNS resolver authenticates clients, it can offer its resolver for private names on a publicly accessible server, while still limiting the visibility of the DNS traffic. </ins> 4.2.  <ins> Content Delivery Networks (CDNs), and content-providers more broadly, can also provide encrypted DNS resolvers that can be used by clients over the public Internet.  These resolvers can either allow resolution of all public names (like normal recursive resolvers), or be designed to serve a subset of names managed by the content provider (like an authoritative resolver).  Using these resolvers can allow the content provider to directly control how DNS answers are used for load balancing and address selection, which could improve performance of connections to the content provider. Using a content-provider's encrypted resolver can also provide several privacy and security benefits: Prevent devices along the network path to the content-provider's resolver from observing client DNS messages Verify that answers come from the entity that manages the domains being resolved Reduce the number of entities able to monitor the specific names accessed by a client to only the client and the content provider, assuming that the content provider would already see the names upon a secure connection later being made based on the DNS answers (e.g., in the TLS SNI extension) </ins> 5. <ins> Encrypted (and authenticated) DNS improves the privacy and security of DNS queries and answers in the presence of malicious attackers. Such attackers are assumed to interfere with or otherwise impede DNS traffic and corresponding discovery mechanisms.  They may be on-path or off-path between the client and entities with which the client communicates RFC3552.  These attackers can inject, tamper, or otherwise interfere with traffic as needed.  Given these capabilities, an attacker may have a variety of goals, including, though not limited to: Monitor and profile clients by observing unencrypted DNS traffic Modify unencrypted DNS traffic to filter or augment the user experience Block encrypted DNS Clients cannot assume that their network does not have such an attacker unless given some means of authenticating or otherwise trusting the communication with their DNS resolver. Given this type of attacker, resolver discovery mechanisms must be designed carefully to not worsen a client's security or privacy posture.  In particular, attackers must not be able to: Redirect secure DNS traffic to themselves when they would not otherwise handle DNS traffic. Override or interfere with the resolver preferences of a user or administrator. Cause clients to use a discovered resolver which has no authenticated delegation from a client-known entity. Influence automatic discovery mechanisms such that a client uses one or more resolvers that are not otherwise involved with providing service to the client, such as: a network provider, a VPN server, a content provider being accessed, or a server that the client has manually configured. Beyond these requirements, standards describing resolver discovery mechanisms must not place any requirements on clients to select particular resolvers over others. When discovering DNS resolvers on a local network, clients have no mechanism to distinguish between cases where an active attacker with the above capabilities is interfering with discovery, and situations wherein the network has no encrypted resolver.  Absent such a mechanism, an attacker can always succeed in these goals.  Therefore, in such circumstances, viable solutions for local DNS resolver discovery should consider weaker attackers, such as those with only passive eavesdropping capabilities.  It is unknown whether such relaxations represent a realistic attacker in practice.  Thus, local discovery solutions designed around this threat model may have limited value. 5.1. Opportunistic encrypted DNS, when the client cannot authenticate the entity that provides encrypted DNS, does not meet the requirements laid out here for resolver discovery.  While opportunistic encryption can provide some benefits, specifically in reducing the ability for other entities to observe traffic, it is not a viable solution against an on-path attacker. Performing opportunistic encrypted DNS does not require specific discovery mechanisms.  Section 4.1 of RFC7858 already describes how to use DNS-over-TLS opportunistically. 5.2. Even with encrypted DNS resolver discovery in place, clients must be prepared to handle certain scenarios where encrypted DNS cannot be used.  In these scenarios, clients must consider if it is appropriate to fail open by sending the DNS queries without encryption, fail closed by not doing so, or presenting a choice to a user or administrator.  The exact behavior is a local client policy decision. Some networks that use Captive Portals will not allow any Internet connectivity until a client has interacted with the portal I-D.ietf- capport-architecture.  If these networks do not use encrypted DNS for their own resolution, a client will need to perform unencrypted DNS queries in order to get out of captivity.  Many operating systems have specific client code responsible for detecting and interacting with Captive Portals; these system components may be good candidates for failing open, since they do not generally represent user traffic. Other networks may not allow any use of encrypted DNS, or any use of encrypted DNS to resolvers other than a network-provisioned resolver. Clients should not silently fail open in these cases, but if these networks are trusted by or administered by the user, the user may want to specifically follow the network's DNS policy instead of what the client would do on an unknown or untrusted network. 6. </ins> This sections lists the complete set of requirements described above, for ease of reference.  <ins> 7. </ins> All security considerations relevant to a particular use case are  <ins> described under that section.  Additional considerations common to all of them are described in priv-sec. </ins>  <ins> 8. </ins> This document has no IANA actions.