I have reviewed this document as part of the Operational directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written with the intent of improving the operational aspects of the IETF drafts. Comments that are not addressed in last call may be included in AD reviews during the IESG review.  Document editors and WG chairs should treat these comments  just like any other last call comments.

 

Status of the document: good to go from the operational point of view.

 

This experimental I-D specifies DNS over DTLS mainly to ensure privacy of the information on the path. It complements RFC 7858 (DNS over TLS) with the lightweight nature of UDP.

 

The document is clearly marked experimental and takes care of the co-existence of 'normal' DNS server by probing on a different port before the DTLS session (and will retry at a slow rate). The DTLS negotiation is only done once between the DNS client and its resolving/recursive DNS server (so the overhead is not that important on the long term). DNS over DTLS is only done between clients and servers supporting this protocol, it does not impact existing/legacy DNS clients and servers.

 

The DNS operator still sees the DNS requests so it can still do analytics. The only case when this protocol hides information from a ISP is when the server is not operated by the ISP, then ISP is then blinded (but using a VPN will have the same effect).

 

 

-éric