[Bug 308181]

[Tdulcet]

> Keep in mind though that local dns resolvers on your local cpe might
already get the data via dot&doh. Don' tie these requirements together
too strictly.

The problem is that many ISP provided DNS servers do not support DNSSEC, so directly supporting either DoH or DoT would be required for Thunderbird to validate the DNSSEC for those users. For example, if I try to make a DNS request using my default DNS resolver and `delv`, which attempts to validate the DNSSEC, I just get errors:
```
$ delv +short example.com
;; broken trust chain resolving 'example.com/DS/IN': 10.255.255.254#53
;; broken trust chain resolving 'example.com/DNSKEY/IN': 10.255.255.254#53
;; broken trust chain resolving 'example.com/A/IN': 10.255.255.254#53
;; resolution failed: broken trust chain
```
However, if I instead use CloudFlare's DNS resolver, it works as expected:
```
$ delv @1.1.1.1 +short example.com
23.192.228.80
...
```
Therefore, if Thunderbird were to support local DNSSEC validation without private DNS, it would be somewhat useless for many users. The good news is that Mozilla has already implemented DoH support in Firefox, so it would just need to be copied over to Thunderbird and enabled (partly bug 1757761). Thunderbird would also need the UI that was added to Firefox in bug 1610741/bug 1596847. My script uses Mozilla's CloudFlare DoH endpoint by default for the DNS record lookups and per the standard, it also shows if it found the configuration using an insecure method (the DNS records were not signed with DNSSEC).

---

What is really ironic is that Thunderbird's new [Thundermail e-mail service](https://thundermail.com/) actually supports RFC 6186, but this could only be used by other clients:
```
$ delv @1.1.1.1 +short _imaps._tcp.tb.pro SRV
0 1 993 mail.tb.pro.
$ delv @1.1.1.1 +short _pop3s._tcp.tb.pro SRV
0 1 995 mail.tb.pro.
$ delv @1.1.1.1 +short _submissions._tcp.tb.pro SRV
0 1 465 mail.tb.pro.
```

-- 
You received this bug notification because you are a member of Mozilla
Bugs, which is subscribed to Mozilla.
https://bugs.launchpad.net/bugs/308181

Title:
  xmpp4moz doesn't read SRV DNS records

To manage notifications about this bug go to:
https://bugs.launchpad.net/sameplace/+bug/308181/+subscriptions