Draft: draft-ietf-add-ddr

Commentary: Added some text to address and reference to SVCB draft with regards to hints explained why resolvers should provide hints clients MUST subject resolved IP addresses to the same security requirements as other IP address 
 I think we should invert this advice . We should recommend not including IP hints , and instead instruct recursive resolvers to append the relevant A and AAAA records in the Additional Section . The IP hints are strictly a performance hack when using a legacy non - SVCB - aware recursive resolver . This text is specifically applicable only to SVCB - aware recursive resolvers , so we can tell them to do it the right way instead . 
 's suggestion sounds good to me . Let 's emphasize that the addresses should come in the same response as the SVCB record , with a preference for Additional Section . 
 I reviewed the draft on the git and came with a similar comment . preventing the use of ipv4hint My first comment is that we should favor IPv6 over IPv4 in our example . My second comment is that the first example uses a local target that is using a hint mentioned as SHOULD NOT in the svcb specification . The scenario I see that might be useful are : From the IP address of the unencrypted resolver : when the encrypted resolver has a different IP address than the one advertised . From the name of encrypted resolvers . Duplication of the IP address adds operational complexity and is a source of misconfiguration and makes updates harder . This may result in the resolver being unreachable and I do not think we should take that path even with a low probability . If I try to balance this with the potential outcomes , it at most reduces the connectivity of an additional round trip . Firstly , this does not sound - at least to me - as a big issue . Then it seems to me the same results can be achieved safely using additional data RRSets . If the additional round trip is performed , it is also likely that resolutions will prefetch the first connection performed by the end user . In any case , I do not see the benefit provided by the ip hint to compete with its disadvantages . 
 I have updated the text accordingly . The description of the need for an additional name resolution still mentions this will result if there are no A / AAAA or IP hints included because it 's true , but the SHOULD is for the A / AAAA . I have also removed the IP hints from the examples altogether . 
 This PR also address the duplicate issue regarding adding ipv6 hints . 
 sure , thanks for the update . 
 We should make sure that any examples including an ipv4hint also include an ipv6hint or only include an ipv6hint . ( per ) 
 Address this then trivialized this by simply not including IP hint in the first place . 
 Migrated from original DEER issue : 
 From  : Strictly speaking , a compliant SVCB client is expected to perform the additional lookups anyway . The hints just avoid a delay while those queries complete . If you think it 's important to " skip " those followup queries , we would have to make a deeper change . Otherwise , you could say " avoid waiting for DNS lookup ... " . 
 From Eliot Lear : The draft currently reads : When responding to these special queries for " " , the SVCB records SHOULD contain at least one " ipv4hint " and/or " ipv6hint " keys . What happens when neither hint is present ? The client should just query the local infrastructure , right ? You almost say that , but not quite . 
 This is an interesting case . There are threat model implications to always querying the template name elsewhere . I will draft up something to address that includes a commentary on the implications for the client .
If the recursive resolver that receives this query has one or more
Designated Resolvers, it will return the corresponding SVCB records.
When responding to these special queries for "dns://resolver.arpa",
the SVCB records SHOULD contain at least one "ipv4hint" and/or
"ipv6hint" keys.  These address hints indicate the address on which
the corresponding Encrypted Resolver can be reached and avoid
additional DNS lookup for the A and AAAA records of the Encrypted
Resolver name.
If the recursive resolver that receives this query has one or more
Designated Resolvers, it will return the corresponding SVCB records.
When responding to these special queries for "dns://resolver.arpa",
the recursive resolver SHOULD include the A and AAAA records for the
name of the Designated Resolver in the Additional Answers section.
This will allow the DNS client to make queries over an encrypted
connection without waiting to resolve the Encrypted Resolver name per
I-D.ietf-dnsop-svcb-https.  If no A/AAAA records or SVCB IP address
hints are included, clients will be forced to delay use of the
Encrypted Resolver until an additional DNS lookup for the A and AAAA
records can be made to the Unencrypted Resolver (or some other
resolver the DNS client has been configured to use).
If resolving the name of an Encrypted Resolver from an SVCB record
yields an IP address that was not presented in the Additional Answers
section or ipv4hint or ipv6hint fields of the original SVCB query,
the connection made to that IP address MUST pass the same TLS
certificate checks before being allowed to replace a previously known
and validated IP address for the same Encrypted Resolver name.