Draft: draft-ietf-doh-dns-over-https-latest

Commentary: Describe how GET ( not POST ) is used with server push . This will ensure that you answer the bigger question : what do you do with a server push from an arbitrary server ? I assume that this wo n't be privileged in any way , and only the configured DNS API server will have its answers routed to the DNS stack , but that needs to be explicit . 
 Server push in a request - response protocol like DNS would take a lot of designing . It is n't really needed in DNS because the server can always slap in additional answers in the Additional section of a request . I propose we close this by saying " HTTP server push is not defined for this protocol , but might be defined in a future version " . If someone wants to define an EDNS0 or session - signal extension for it , that should be just fine . 
 HTTP already has server push , so I would prefer something closer to " this protocol does not alter the semantics of HTTP server push " . 
 I think is closer to what I 'm thinking .. ( though I do n't really think that needs to be stated beyond other clarifications that this document just uses http in a particular manner , it does not define it . ) additionally RR 's do n't quite address the same use case by the way as push can operate in more of a pub - sub fashion if you like where an additional RR is definitely a poll model . 
 Of course this protocol does not alter the semantics of server push , but what does it mean for a DNS client ? In the DNS protocol , the only thing even vaguely like server - initiated information is stuff in the Additional section of an answer , and even then , there are pretty strict rules about ignoring it if it is at all smelly . 
 an often times misunderstood part of push is that a server pushes both a response and the request that it is responding to . ( like dns , http is always a request / response pair , so if the client does n't provide the request the server needs to ) . So that 's what it means - its an answer to a particular question and you can cache it or not depending on whether that 's a request you would have asked / trusted the peer to handle . That 's pretty much the same rule for dns and traditional http clients . A client who would rather not have things pushed at them has existing protocol mechanisms to disable that ( SETTINGS ) which doh does n't need to specify . I think all of this gets at what was originally commenting on - you need to make a decision on whether or not you trust the server for the query / response being pushed ( i.e is this your dns api server otherwise do n't accept ) before processing it .. this is already true for anything pushed via http but a sentence making it explicit is fine .
Paragraph (version B):
Before using DOH response data for DNS resolution, the client MUST
establish that the HTTP request URI is a trusted service for the DOH
query.  For HTTP requests initiated by the DNS API client this trust
is implicit in the selection of URI.  For HTTP server push (RFC7540
Section 8.2) extra care must be taken to ensure that the pushed URI
is one that the client would have directed the same query to if the
client had initiated the request.  This specification does not extend
DNS resolution privileges to URIs that are not recognized by the
client as trusted DNS API servers.