bk99.de entertain the web since 1997

bk99.de
RFC · DNSStandard explained

RFC 7858: DNS over TLS

Summary

RFC 7858 describes encrypted DNS transport over TLS between a client and a recursive resolver. Transport encryption protects the path, not against the chosen resolver. Encryption can reduce observation and centralise trust.

Ideas

  • TLS protects queries against passive eavesdropping and tampering on the path.
  • A dedicated port separates DoT from classic DNS.
  • Persistent connections save repeated handshakes.

Remarks

  • RFC 7858 has the status “Proposed Standard”; current errata and successor documents should also be checked.

Recommendations

  • Choose resolvers by privacy and operating model.
  • Monitor certificates, latency and fallback behaviour.

References

Read the RFC at the RFC Editor

Search the Web Archive

RFC · 2018

RFC 8484: DNS over HTTPS

RFC 8484 encapsulates DNS queries in HTTPS and thereby uses existing web transport and authentication mechanisms. DoH makes path-based observation and classic network diagnostics harder at the same time. Choosing the resolver remains a decision of trust.

RFC · 2003

RFC 3490: Internationalised domain names

RFC 3490 introduced IDNA so that Unicode domain names can be carried over the ASCII-based DNS. RFC 3490 was superseded by RFC 5890. Compatibility layers extend old infrastructure without breaking the protocol.

RFC · 1987

RFC 1034: DNS concepts and delegation

RFC 1034 explains the architecture, namespace, zones, resolvers and caching of the modern Domain Name System. DNS scales because responsibility is distributed and answers are cached. Faulty delegations have effects across organisational boundaries.