<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 03/06/2017 01:59 PM, Phillip Hallam-Baker wrote:<br>
<blockquote
cite="mid:CAMm+LwjkBq4O-bQRJHAJ2vLct2OV5iG25bZLQ5ARSUw08X4f_A@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_default" style="font-size:small"><br>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Mon, Mar 6, 2017 at 3:33 AM, Marat
Khalili <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:mkh@rqc.ru" target="_blank">mkh@rqc.ru</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
<p><span class=""> </span></p>
<blockquote type="cite">
<div style="font-size:small">There are two issues,
both of which I brought up at the start of DPRIV:</div>
<div style="font-size:small"><br>
</div>
<div style="font-size:small">1) Must be supported by
browsers.</div>
<div style="font-size:small">2) Protocol MUST be
entirely state free</div>
<div style="font-size:small"><br>
</div>
<div style="font-size:small">If you want a protocol to
be deployed, you need to solicit input from the
people who you need for deployment and take notice
of it. DNS over anything TCP is not going to measure
up.</div>
</blockquote>
DNS-over-TLS in public resolvers would be very useful
for small-scale DNS repeaters in corporations and ISPs.
They usually connect to few public resolvers and can
easily keep these connections alive. Persistent TCP
connections place much lighter burden on firewalls than
UDP requests, so there might be overall performance gain
on both sides.<br>
<p>QUIK, SCTP and similar future technologies can be
even better, but are obviously not ready for
deployment here and now. TLS is.</p>
</div>
</blockquote>
<div>
<div class="gmail_default" style="font-size:small">No.
TLS is not ready for deployment because the protocol
model for TLS (and for that matter DTLS) is not
compatible with running a large public resolver.</div>
<div class="gmail_default" style="font-size:small"><br>
</div>
</div>
</div>
</div>
</div>
</blockquote>
Hello,<br>
<br>
If providers running large resolvers today are unwilling to use the
extra resources that dns-over-tls will require then maybe they
should stop running large resolvers. This is no different from the
people who used to complain loudly that HTTPS will never work large
scale. Of course it will, we might have to throw some more hardware
at it though, but more likely said hardware will have been naturally
replaced with newer hardware before we reach high adoption of
dns-over-tls. Adoption will not happen overnight.<br>
<br>
I applaud dns-over-tls and I have much more faith in it than say
dnscrypt for the simple fact that it is standardised. I am running
dns-over-tls with nginx which is in no way built to serve DNS - only
possible because it's all standard TLS. Lovely.<br>
<br>
I'll let the list know if I start seeing problems with load because
of dns-over-tls, but I wouldn't hold my breath.<br>
<br>
:)<br>
<br>
/Thomas<br>
<br>
</body>
</html>