IETF RFC 8932
[ACTIVE]
Recommendations for DNS Privacy Service Operators
Metadata
- Publisher
- IETF
- Doc Type
- Best Practice
- Pages
- 34
- Abstract
- This document presents operational, policy, and security considerations for DNS recursive resolver operators who choose to offer DNS privacy services. With these recommendations, the operator can make deliberate decisions regarding which services to provide, as well as understanding how those decisions and the alternatives impact the privacy of users. This document also presents a non-normative framework to assist writers of a Recursive operator Privacy Statement, analogous to DNS Security Extensions (DNSSEC) Policies and DNSSEC Practice Statements described in RFC 6841.
- Publication Date
- 2020-10-01
- Status Note
- Best Current Practice
- DOI
10.17487/RFC8932- Link
- https://doi.org/10.17487/RFC8932
- Author(s)
- Sara DickinsonBenno OvereinderRoland van Rijswijk-DeijAllison Mankin
- Keyword(s)
- DNS
Latest version of IETF RFC 8932
Document Versions — IETF RFC 8932
-
▶ IETF RFC 8932 (2020-10-01)THIS DOC [ACTIVE] [LATEST VERSION]
Normative Reference(s)
- IETF RFC 2119 [Active*]
- IETF RFC 4033 [Active*]
- IETF RFC 5280 [Active, Amended*]
- IETF RFC 6973 [Active*]
- IETF RFC 7457 [Active*]
- IETF RFC 7525 [Superseded*]
- IETF RFC 7766 [Active*]
- IETF RFC 7816 [Superseded*]
- IETF RFC 7828 [Active*]
- IETF RFC 7830 [Active*]
- IETF RFC 7858 [Active*]
- IETF RFC 7871 [Active*]
- IETF RFC 8020 [Active*]
- IETF RFC 8174 [Active*]
- IETF RFC 8198 [Active*]
- IETF RFC 8310 [Active*]
- IETF RFC 8467 [Active*]
- IETF RFC 8484 [Active*]
- IETF RFC 8490 [Active*]
- IETF RFC 8499 [Superseded*]
- IETF RFC 8806 [Active*]
Bibliographic Reference(s)
- 10.1016-j.comnet.2004.03.033 — Xu-et-al EXTERNAL
- 10.1109-NOMS.2006.1687580 — Harvan EXTERNAL
- 10.1109-TNET.2006.890128 — Ramaswamy-and-Wolf EXTERNAL
- 10.1145-2665943.2665959 — Pitfalls-of-DNS-Encryption EXTERNAL
- 10.1145-3182660 — van-Dijkhuizen-et-al EXTERNAL
- 10.23919-TMA.2018.8506536 — Passive-Observations-of-a-Large-DNS EXTERNAL
- GITHUB.PowerDNS.ipcipher — ipcipher2 EXTERNAL
- GITHUB.veorq.ipcrypt — ipcrypt EXTERNAL
- IETF.draft-bellis-dnsop-xpf-04 — I-D.bellis-dnsop-xpf EXTERNAL
- IETF.draft-ietf-dnsop-dns-tcp-requirements-06 — I-D.ietf-dnsop-dns-tcp-requirements EXTERNAL
- IETF.draft-ietf-httpbis-bcp56bis-09 — I-D.ietf-httpbis-bcp56bis EXTERNAL
- Internet.nl, "Internet.nl Is Your Internet Up To Date?", 2019, <https://internet.nl>. EXTERNAL
- Conversion Works, "Anonymize IP Geolocation Accuracy Impact Assessment", 19 May 2017, <https://www.conversionworks.co.uk/blog/2017/05/19/anonymize-ip-geo-impact-test/>. EXTERNAL
- Brekne, T. and A. Årnes, "Circumventing IP-address pseudonymization", Communications and Computer Networks, 2005, <https://pdfs.semanticscholar.org/7b34/12c951cebe71cd2cddac5fda164fb2138a44.pdf>. EXTERNAL
- Hubert, B., "On IP address encryption: security analysis with respect for privacy", Medium, 7 May 2017, <https://medium.com/@bert.hubert/on-ip-address-encryption-security-analysis-with-respect-for-privacy-dabe1201b476>. EXTERNAL
- Hubert, B., "Embedding MAC address in DNS requests for selective filtering", DNS-OARC mailing list, 25 January 2016, <https://lists.dns-oarc.net/pipermail/dns-operations/2016-January/014143.html>. EXTERNAL
- "dnstap", <https://dnstap.info>. EXTERNAL
- Ipsilon Networks, Inc., "TCPDRIV - Program for Eliminating Confidential Information from Traces", 2004, <http://fly.isti.cnr.it/software/tcpdpriv/>. EXTERNAL
- Dickinson, S., "Comparison of policy and privacy statements 2019", DNS Privacy Project, 18 December 2019, <https://dnsprivacy.org/wiki/display/DP/Comparison+of+policy+and+privacy+statements+2019>. EXTERNAL
- Goldlust, S. and C. Almond, "DNS Cache snooping - should I be concerned?", ISC Knowledge Database, 15 October 2018, <https://kb.isc.org/docs/aa-00482>. EXTERNAL
- "HAProxy - The Reliable, High Performance TCP/HTTP Load Balancer", <https://www.haproxy.org/>. EXTERNAL
- Mozilla, "Security/DOH-resolver-policy", 2019, <https://wiki.mozilla.org/Security/DOH-resolver-policy>. EXTERNAL
- Baartmans, C., van Wynsberghe, A., van Rijswijk-Deij, R., and F. Jorna, "SURFnet Data Sharing Policy", June 2016, <https://surf.nl/datasharing>. EXTERNAL
- The Tcpdump Group, "Tcpdump & Libpcap", 2020, <https://www.tcpdump.org/>. EXTERNAL
- Aumasson, J-P., "Subject: Re: [Cfrg] Analysis of ipcrypt?", message to the Cfrg mailing list, 22 February 2018, <https://mailarchive.ietf.org/arch/msg/cfrg/cFx5WJo48ZEN-a5cj_LlyrdN8-0/>. EXTERNAL
- "DNSCrypt - Official Project Home Page", <https://www.dnscrypt.org>. EXTERNAL
- PowerDNS, "dnsdist Overview", <https://dnsdist.org>. EXTERNAL
- IANA, "Transport Layer Security (TLS) Extensions: TLS Application-Layer Protocol Negotiation (ALPN) Protocol IDs", <https://www.iana.org/assignments/tls-extensiontype-values>. EXTERNAL
- Google, "IP Anonymization in Analytics", 2019, <https://support.google.com/analytics/answer/2763052?hl=en>. EXTERNAL
- van Rijswijk-Deij, R., Rijnders, G., Bomhoff, M., and L. Allodi, "Privacy-Conscious Threat Intelligence Using DNSBLOOM", IFIP/IEEE International Symposium on Integrated Network Management (IM2019), 2019, <http://dl.ifip.org/db/conf/im/im2019/189282.pdf>. EXTERNAL
- nginx.org, "nginx news", 2019, <https://nginx.org/>. EXTERNAL
- SSL Labs, "SSL Server Test", 2019, <https://www.ssllabs.com/ssltest/>. EXTERNAL
- Goldlust, S., Almond, C., and F. Dupont, "DNS over TLS", ISC Knowledge Database", 1 November 2018, <https://kb.isc.org/article/AA-01386/0/DNS-over-TLS.html>. EXTERNAL
- Silby, S., Juarez, M., Vallina-Rodriguez, N., and C. Troncoso, "DNS Privacy not so private: the traffic analysis perspective.", Privacy Enhancing Technologies Symposium, 2018, <https://petsymposium.org/2018/files/hotpets/4-siby.pdf>. EXTERNAL
- CESNET, "Crypto-PAn", commit 636b237, March 2015, <https://github.com/CESNET/ipfixcol/tree/master/base/src/intermediate/anonymization/Crypto-PAn>. EXTERNAL
- PowerDNS, "dnswasher", commit 050e687, 24 April 2020, <https://github.com/PowerDNS/pdns/blob/master/pdns/dnswasher.cc>. EXTERNAL
- IETF RFC 4034 [Active*]
- IETF RFC 4035 [Active*]
- IETF RFC 5077 [Superseded*]
- IETF RFC 6147 [Active*]
- IETF RFC 6235 [Active*]
- IETF RFC 6265 [Active*]
- IETF RFC 7626 [Superseded*]
- IETF RFC 7873 [Active*]
- IETF RFC 8027 [Active*]
- IETF RFC 8094 [Active*]
- RFC8404 — RFC8404 EXTERNAL
- IETF RFC 8446 [Superseded*]
- IETF RFC 8555 [Active*]
- IETF RFC 8618 [Active*]
Source Data (JSON)
Full registry record with provenance metadata. Open directly: /api/doc/RFC8932.json
Reference Tree
Explore all references and references to this document, as a navigable tree.
Open Reference TreeReference this Doc
Plain text (ISO 690 compliant)
Preview:
IETF RFC 8932, Recommendations for DNS Privacy Service Operators. Available at https://doi.org/10.17487/RFC8932
Snippet:
IETF RFC 8932, Recommendations for DNS Privacy Service Operators. Available at https://doi.org/10.17487/RFC8932
HTML (ISO 690 compliant)
Preview:
IETF RFC 8932, Recommendations for DNS Privacy Service Operators. Available at https://doi.org/10.17487/RFC8932
Snippet:
<span class="citation"><cite>IETF RFC 8932</cite>, Recommendations for DNS Privacy Service Operators. Available at <a href="https://doi.org/10.17487/RFC8932" target="_blank" rel="noopener">https://doi.org/10.17487/RFC8932</a></span>
SMPTE's HTML Pub
Preview:
IETF RFC 8932, Recommendations for DNS Privacy Service Operators
doi: 10.17487/RFC8932
url: https://doi.org/10.17487/RFC8932
doi: 10.17487/RFC8932
url: https://doi.org/10.17487/RFC8932
Snippet:
<li> <cite id="bib-rfc8932">IETF RFC 8932</cite>, Recommendations for DNS Privacy Service Operators <span class="doi">10.17487/RFC8932</span> </li>
Referenced By
- IETF RFC 9076 [Active*]
- IETF RFC 9210 [Active*]
- IETF RFC 9250 [Active*]