bk99.de entertain the web since 1997

bk99.de
RFC · DNSStandard explained

RFC 8484: DNS over HTTPS

Summary

RFC 8484 encapsulates DNS queries in HTTPS and thereby uses existing web transport and authentication mechanisms. DoH makes path-based observation and classic network diagnostics harder at the same time. Choosing the resolver remains a decision of trust.

Ideas

  • DNS messages travel as HTTP requests and responses.
  • TLS protects content and server identity.
  • HTTP/2 can bundle several queries efficiently.

Remarks

  • RFC 8484 has the status “Proposed Standard”; current errata and successor documents should also be checked.

Recommendations

  • Document DoH endpoints and failure behaviour.
  • Prevent uncontrolled bypassing of operational DNS security functions.

References

Read the RFC at the RFC Editor

Search the Web Archive

RFC · 2016

RFC 7858: DNS over TLS

RFC 7858 describes encrypted DNS transport over TLS between a client and a recursive resolver. Transport encryption protects the path, not against the chosen resolver. Encryption can reduce observation and centralise trust.

RFC · 2003

RFC 3490: Internationalised domain names

RFC 3490 introduced IDNA so that Unicode domain names can be carried over the ASCII-based DNS. RFC 3490 was superseded by RFC 5890. Compatibility layers extend old infrastructure without breaking the protocol.

RFC · 1987

RFC 1034: DNS concepts and delegation

RFC 1034 explains the architecture, namespace, zones, resolvers and caching of the modern Domain Name System. DNS scales because responsibility is distributed and answers are cached. Faulty delegations have effects across organisational boundaries.