Specification for DNS over Transport Layer Security (TLS)
Metadata
- Publisher
- IETF
- Doc Type
- Standard
- Pages
- 19
- Abstract
- This document describes the use of Transport Layer Security (TLS) to provide privacy for DNS. Encryption provided by TLS eliminates opportunities for eavesdropping and on-path tampering with DNS queries in the network, such as discussed in RFC 7626. In addition, this document specifies two usage profiles for DNS over TLS and provides advice on performance considerations to minimize overhead from using TCP and TLS with DNS. This document focuses on securing stub-to-recursive traffic, as per the charter of the DPRIVE Working Group. It does not prevent future applications of the protocol to recursive-to-authoritative traffic.
- Publication Date
- 2016-05-01
- Status Note
- Proposed Standard
- DOI
10.17487/RFC7858- Link
- https://doi.org/10.17487/RFC7858
- Author(s)
- Zi HuLiang ZhuJohn HeidemannAllison MankinDuane WesselsPaul E. Hoffman
- Keyword(s)
- DNS Privacy
Latest version of IETF RFC 7858
Document Versions — IETF RFC 7858
-
▶ IETF RFC 7858 (2016-05-01)THIS DOC [ACTIVE] [LATEST VERSION]
Normative Reference(s)
- IETF RFC 1034 [Active*]
- IETF RFC 1035 [Active, Amended*]
- IETF RFC 2119 [Active*]
- IETF RFC 4648 [Active*]
- IETF RFC 5077 [Superseded*]
- IETF RFC 5246 [Superseded*]
- IETF RFC 6234 [Active*]
- IETF RFC 6335 [Active*]
- IETF RFC 7120 [Active*]
- IETF RFC 7469 [Active*]
- IETF RFC 7525 [Superseded*]
- IETF RFC 7766 [Active*]
Bibliographic Reference(s)
- 10.1109-SP.2015.18 — Connection-Oriented-DNS EXTERNAL
- IETF draft-dempsky-dnscurve-01 [Active*]
- IETF.draft-ietf-dprive-dnsodtls-06 — DNSoD EXTERNAL
- IETF.draft-ietf-dprive-dtls-and-tls-profiles-01 — TLS-DTLS-PROFILES EXTERNAL
- IETF.draft-ietf-tls-falsestart-02 — TLS-FALSESTART EXTERNAL
- IETF.draft-osterweil-dane-ipsec-03 — IPSECA EXTERNAL
- IETF.draft-wijngaards-dnsop-confidentialdns-03 — CONFIDENTIAL-DNS EXTERNAL
- NLnet Labs, "Dnssec-Trigger", May 2014, < https://www.nlnetlabs.nl/projects/dnssec-trigger/ >. EXTERNAL
- Denis, F., "DNSCrypt", December 2015, < https://www.dnscrypt.org/ >. EXTERNAL
- IETF RFC 3234 [Active*]
- IETF RFC 3646 [Active*]
- IETF RFC 4033 [Active*]
- IETF RFC 7258 [Active*]
- IETF RFC 7413 [Active*]
- IETF RFC 7435 [Active*]
- IETF RFC 7626 [Superseded*]
- IETF RFC 7828 [Active*]
- IETF RFC 7830 [Active*]
Source Data (JSON)
Full registry record with provenance metadata. Open directly: /api/doc/RFC7858.json
Amended by:
IETF RFC 8310 [Active*]
Reference Tree
Explore all references and references to this document, as a navigable tree.
Open Reference TreeReference this Doc
Plain text (ISO 690 compliant)
Preview:
IETF RFC 7858, Specification for DNS over Transport Layer Security (TLS). Available at https://doi.org/10.17487/RFC7858
Snippet:
IETF RFC 7858, Specification for DNS over Transport Layer Security (TLS). Available at https://doi.org/10.17487/RFC7858
HTML (ISO 690 compliant)
Preview:
IETF RFC 7858, Specification for DNS over Transport Layer Security (TLS). Available at https://doi.org/10.17487/RFC7858
Snippet:
<span class="citation"><cite>IETF RFC 7858</cite>, Specification for DNS over Transport Layer Security (TLS). Available at <a href="https://doi.org/10.17487/RFC7858" target="_blank" rel="noopener">https://doi.org/10.17487/RFC7858</a></span>
SMPTE's HTML Pub
Preview:
IETF RFC 7858, Specification for DNS over Transport Layer Security (TLS)
doi: 10.17487/RFC7858
url: https://doi.org/10.17487/RFC7858
doi: 10.17487/RFC7858
url: https://doi.org/10.17487/RFC7858
Snippet:
<li> <cite id="bib-rfc7858">IETF RFC 7858</cite>, Specification for DNS over Transport Layer Security (TLS) <span class="doi">10.17487/RFC7858</span> </li>
Referenced By
- IETF draft-arkko-iab-data-minimization-principle-05 [Active*]
- IETF RFC 10001 [Active*]
- IETF RFC 7901 [Active*]
- IETF RFC 7929 [Active*]
- IETF RFC 8094 [Active*]
- IETF RFC 8310 [Active*]
- IETF RFC 8324 [Active*]
- IETF RFC 8467 [Active*]
- IETF RFC 8484 [Active*]
- IETF RFC 8490 [Active*]
- IETF RFC 8499 [Superseded*]
- IETF RFC 8618 [Active*]
- IETF RFC 8683 [Active*]
- IETF RFC 8777 [Active*]
- IETF RFC 8781 [Active*]
- IETF RFC 8881 [Active*]
- IETF RFC 8901 [Active*]
- IETF RFC 8932 [Active*]
- IETF RFC 9076 [Active*]
- IETF RFC 9103 [Active*]
- IETF RFC 9132 [Active*]
- IETF RFC 9210 [Active*]
- IETF RFC 9250 [Active*]
- IETF RFC 9460 [Active*]
- IETF RFC 9461 [Active*]
- IETF RFC 9499 [Active*]
- IETF RFC 9520 [Active*]
- IETF RFC 9525 [Active*]
- IETF RFC 9849 [Active*]
- IETF RFC 9989 [Active*]