RFC 7858: Specification for DNS over Transport Layer Security (TLS)

This document describes the use of Transport Layer Security (TLS) to provide privacy for DNS. Encryption provided by TLS eliminates opportunities for…

Read RFC 7858 on the RFC Editor

Outgoing relationships (20 related RFCs)

Normative reference — RFC 2119: Key words for use in RFCs to Indicate Requirement Levels
Normative reference — RFC 5246: The Transport Layer Security (TLS) Protocol Version 1.2
Normative reference — RFC 1035: Domain names - implementation and specification
Normative reference — RFC 1034: Domain names - concepts and facilities
Normative reference — RFC 4648: The Base16, Base32, and Base64 Data Encodings
Normative reference — RFC 6234: US Secure Hash Algorithms (SHA and SHA-based HMAC and HKDF)
Normative reference — RFC 6335: Internet Assigned Numbers Authority (IANA) Procedures for the Management of the Service Name and Transport Protocol Port Number Registry
Normative reference — RFC 5077: Transport Layer Security (TLS) Session Resumption without Server-Side State
Normative reference — RFC 7120: Early IANA Allocation of Standards Track Code Points
Normative reference — RFC 7766: DNS Transport over TCP - Implementation Requirements
Normative reference — RFC 7469: Public Key Pinning Extension for HTTP
Informative reference — RFC 4033: DNS Security Introduction and Requirements
Informative reference — RFC 7258: Pervasive Monitoring Is an Attack
Informative reference — RFC 3234: Middleboxes: Taxonomy and Issues
Informative reference — RFC 7413: TCP Fast Open
Informative reference — RFC 3646: DNS Configuration options for Dynamic Host Configuration Protocol for IPv6 (DHCPv6)
Informative reference — RFC 7435: Opportunistic Security: Some Protection Most of the Time
Informative reference — RFC 7626: DNS Privacy Considerations
Informative reference — RFC 7828: The edns-tcp-keepalive EDNS0 Option
Informative reference — RFC 7830: The EDNS(0) Padding Option

Incoming relationships (39 related RFCs)

Updated by — RFC 8310: Usage Profiles for DNS over TLS and DNS over DTLS
Normatively referenced by — RFC 9460: Service Binding and Parameter Specification via the DNS (SVCB and HTTPS Resource Records)
Normatively referenced by — RFC 9462: Discovery of Designated Resolvers
Normatively referenced by — RFC 8765: DNS Push Notifications
Normatively referenced by — RFC 8881: Network File System (NFS) Version 4 Minor Version 1 Protocol
Normatively referenced by — RFC 9103: DNS Zone Transfer over TLS
Normatively referenced by — RFC 7901: CHAIN Query Requests in DNS
Normatively referenced by — RFC 9526: Simple Provisioning of Public Names for Residential Networks
Normatively referenced by — RFC 9527: DHCPv6 Options for the Homenet Naming Authority
Normatively referenced by — RFC 9665: Service Registration Protocol for DNS-Based Service Discovery
Normatively referenced by — RFC 8932: Recommendations for DNS Privacy Service Operators
Normatively referenced by — RFC 9102: TLS DNSSEC Chain Extension
Informatively referenced by — RFC 9499: DNS Terminology
Informatively referenced by — RFC 8094: DNS over Datagram Transport Layer Security (DTLS)
Informatively referenced by — RFC 9463: DHCP and Router Advertisement Options for the Discovery of Network-designated Resolvers (DNR)
Informatively referenced by — RFC 9525: Service Identity in TLS
Informatively referenced by — RFC 8404: Effects of Pervasive Encryption on Operators
Informatively referenced by — RFC 9461: Service Binding Mapping for DNS Servers
Informatively referenced by — RFC 8901: Multi-Signer DNSSEC Models
Informatively referenced by — RFC 7929: DNS-Based Authentication of Named Entities (DANE) Bindings for OpenPGP
Informatively referenced by — RFC 8744: Issues and Requirements for Server Name Identification (SNI) Encryption in TLS
Informatively referenced by — RFC 8782: Distributed Denial-of-Service Open Threat Signaling (DOTS) Signal Channel Specification
Informatively referenced by — RFC 8683: Additional Deployment Guidelines for NAT64/464XLAT in Operator and Enterprise Networks
Informatively referenced by — RFC 9849: TLS Encrypted Client Hello
Informatively referenced by — RFC 8280: Research into Human Rights Protocol Considerations
Informatively referenced by — RFC 8973: DDoS Open Threat Signaling (DOTS) Agent Discovery
Informatively referenced by — RFC 9464: Internet Key Exchange Protocol Version 2 (IKEv2) Configuration for Encrypted DNS
Informatively referenced by — RFC 9520: Negative Caching of DNS Resolution Failures
Informatively referenced by — RFC 9953: DNS over CoAP (DoC)
Informatively referenced by — RFC 8686: Application-Layer Traffic Optimization (ALTO) Cross-Domain Server Discovery
Informatively referenced by — RFC 9267: Common Implementation Anti-Patterns Related to Domain Name System (DNS) Resource Record (RR) Processing
Informatively referenced by — RFC 9445: RADIUS Extensions for DHCP-Configured Services
Informatively referenced by — RFC 9505: A Survey of Worldwide Censorship Techniques
Informatively referenced by — RFC 9606: DNS Resolver Information
Informatively referenced by — RFC 9704: Establishing Local DNS Authority in Validated Split-Horizon Environments
Informatively referenced by — RFC 9726: Operational Considerations for Use of DNS in Internet of Things (IoT) Devices
Informatively referenced by — RFC 9761: Manufacturer Usage Description (MUD) for TLS and DTLS Profiles for Internet of Things (IoT) Devices
Informatively referenced by — RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)
Informatively referenced by — RFC 10001: Operational Guidelines for DNS Transport in Mixed IPv4/IPv6 Environments