On Wed, Sep 16, 2026 at 12:42 PM Jim Mozley <[email protected]> wrote: ... > > On the content: It seems like the main potential benefit of this > > proposal is to fail faster in certain cases, by skipping HTTP requests > > that would return a 404 response. For this to work, the SvcParam > > needs to be specified as an exhaustive list of all .well-known/ > > endpoints on the host. (Otherwise, absence from the list does not > > allow the client to skip the HTTP request.) However, many HTTP > > origins have a large number* of resources available in .well-known, > > which would result in bloated HTTPS records. > > Having a fixed list seems impractical as DNS server implementors would need > to keep up with changes to registered well-known suffixes.
I don't understand what you mean by "a fixed list". > One of the benefits we wanted to highlight is effectively saying these > well-known suffixes are present, rather than a client trying one or more > speculatively. OK, but in the current draft, if the suffix is absent from the SvcParamValue, the desired resource might still be present at the origin, so the client cannot safely skip the "speculative" request. The client makes the same request either way, so the SvcParam doesn't change the client's behavior at all. ... > > There are also operational friction concerns: adding and removing > > .well-known resources now requires updating two different systems, and > > errors may occur when they disagree. > > That could also be said of ipv4hints, services might change IPs due to > availability. Yes. ipv4hint is an optional optimization with two key properties: (1) it improves performance under a specific set of assumptions, and (2) it never impairs availability if the SvcParamValue is incorrect or outdated. This specification does not appear to meet both of these criteria (at least not simultaneously). ... > > Given these issues, and the obvious security concerns, > > Can you be specific with these concerns? We have some thoughts in the > Security Considerations section of the draft, were you referring to these or > something else? From the current Security Considerations, I'm still not able to discern what clients are allowed to do with this SvcParam. For example, if clients use this SvcParam to skip fetches of desired .well-known resources because it infers that they are absent, then this allows a DNS attacker to cause the client to misunderstand the status of those origins. --Ben _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
