bk99.de entertain the web since 1997

bk99.de
RFC · DNSStandard explained

RFC 3490: Internationalised domain names

Summary

RFC 3490 introduced IDNA so that Unicode domain names can be carried over the ASCII-based DNS. RFC 3490 was superseded by RFC 5890. Compatibility layers extend old infrastructure without breaking the protocol.

Ideas

  • Unicode names are converted into compatible ASCII labels.
  • The prefix xn-- marks the Punycode representation.
  • Applications take care of normalisation and display.

Insights

  • Lookalike characters create new opportunities for deception.

Remarks

  • RFC 3490 has the status “Proposed Standard”; current errata and successor documents should also be checked.

Recommendations

  • Use the current IDNA successors instead of RFC 3490.
  • Also show security-critical domains as Punycode where needed.

References

Read the RFC at the RFC Editor

Search the Web Archive

RFC · 1983

RFC 882: DNS: Organising names hierarchically

RFC 882 designs a distributed, hierarchical name database to replace centrally maintained host lists. RFC 882 was superseded by RFC 1034. Delegation scales administration organisationally as well as technically.

RFC · 2018

RFC 8484: DNS over HTTPS

RFC 8484 encapsulates DNS queries in HTTPS and thereby uses existing web transport and authentication mechanisms. DoH makes path-based observation and classic network diagnostics harder at the same time. Choosing the resolver remains a decision of trust.

RFC · 2016

RFC 7858: DNS over TLS

RFC 7858 describes encrypted DNS transport over TLS between a client and a recursive resolver. Transport encryption protects the path, not against the chosen resolver. Encryption can reduce observation and centralise trust.