Hacker News new | past | comments | ask | show | jobs | submit
Bender | on: Quad9 to exit France
I am curious if a large number of people stood up their own DoH/DoT servers:

- Would France go after each one, even if they were not operating servers physically in France? It only takes a few minutes to configure Unbound+LetsEncrypt to accept DoH+DoT internet traffic. A few minutes longer to compile support for DoQ.

- Could they realistically expect individual operators of small DoH/DoT/DoQ open servers to block domains at their behest?

drdexebtjl | parent
DNS needs a way to say “unavailable for legal reasons” so your system just picks a different resolver or resolves recursively.
Bender | root | parent
DNS needs a way to say “unavailable for legal reasons” so your system just picks a different resolver or resolves recursively.

As far as I know there is no way to reliably:

- let the user see this error. The client would need to surface the DNS EDE error. Stub resolvers and browsers overwhelmingly ignore EDE.

- geo-fence the client. Unbound does not have native Geo support and will not let one set custom per-zone EDE text even if that was a thing AFAIK.

This might be possible by putting dnsdist in front of Unbound with client IP rules + Lua + MaxMind but there again the client won't know what to do with this.

- custom views only trigger off client IP's and only control resolution views, not error messages.

I think it's probably best that if people wish to run their own DNS instances, they do not geo-block anything. France has no jurisdiction in other countries and can't really do anything to "Alice and Bob's Public DNS". It's up to the people in France to find a way to tunnel their traffic out of their country to bypass any border filters should that ever become a thing. I am still waiting for a lawyer to challenge my thinking on this part.

drdexebtjl | root | parent
I don’t want the user to see the error, I just want the browser/the operating system’s resolver to not be a stub resolver, and actually ask the authoritative servers when something like this fails on a non-authoritative response.

Public DNS like Quad9 should be a cache (because recursing is pretty slow) and, at most, a way to find the IPs of the root name servers.

Courts asking non-authoritative resolvers not to resolve a name should have no effect on clients successfully resolving that name, such that they wouldn’t even have a reason to go after Quad9 or Alice and Bob, and would have to go after the TLD registry (likely in a different jurisdiction).

Bender | root | parent
The only thing I know of that operates somewhat like you are asking is Unbound itself, when it is not the server doing the root/tld lookups. One can configure Unbound with a series of Upstream DoT servers and it can retry each of them and cache which ones answered, answered fastest, so if the upstream just refused to answer that would cause it to move to another upstream resolver and eventually retry the one that refused but once it gets another refusal it would avoid that one again for some time. Clunky but it would sortof work.

Beyond that I think you are asking for behavioral and RFC changes to everyone's workstations, cell phones, tablets, TV's, and DNS resolvers.

drdexebtjl | root | parent
Yes, I use Unbound :)

It’s configured exactly like I mentioned: it tries a couple of resolvers, and if they all fail, tries authoritative servers starting from the root. That last part, missing from your suggested configuration, is the key: it’s what ensures courts have to actually go after the parties responsible for the domain, and not just random DNS resolvers.

> Beyond that I think you are asking for behavioral and RFC changes to everyone's workstations, cell phones, tablets, TV's, and DNS resolvers.

We did it once for DoH/DoT, we could do it again.