DNS Zone Transfer over TLS

Metadata

Publisher: IETF
Doc Type: Standard
Pages: 32
Abstract: DNS zone transfers are transmitted in cleartext, which gives attackers the opportunity to collect the content of a zone by eavesdropping on network connections. The DNS Transaction Signature (TSIG) mechanism is specified to restrict direct zone transfer to authorized clients only, but it does not add confidentiality. This document specifies the use of TLS, rather than cleartext, to prevent zone content collection via passive monitoring of zone transfers: XFR over TLS (XoT). Additionally, this specification updates RFC 1995 and RFC 5936 with respect to efficient use of TCP connections and RFC 7766 with respect to the recommended number of connections between a client and server for each transport.
Publication Date: 2021-08-01
Status Note: Proposed Standard
DOI: 10.17487/RFC9103
Link: https://doi.org/10.17487/RFC9103
Author(s): Willem Toorop
Sara Dickinson
Shivan Kaul Sahib
Pallavi Aras
Allison Mankin
Keyword(s): DNS, Operations, Privacy

Latest version of IETF RFC 9103

Document Versions — IETF RFC 9103

▶ IETF RFC 9103 (2021-08-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

IANA, "TLS Application-Layer Protocol Negotiation (ALPN) Protocol IDs", <https://www.iana.org/assignments/tls-extensiontype-values/>. EXTERNAL
IETF RFC 1034 [Active*]
IETF RFC 1035 [Active, Amended*]
IETF RFC 1995 [Active*]
IETF RFC 1996 [Active*]
IETF RFC 2119 [Active*]
IETF RFC 2931 [Active*]
IETF RFC 5936 [Active*]
IETF RFC 6973 [Active*]
IETF RFC 7766 [Active*]
RFC7828 — RFC7828 EXTERNAL
RFC7858 — RFC7858 EXTERNAL
IETF RFC 8174 [Active*]
RFC8310 — RFC8310 EXTERNAL
IETF RFC 8446 [Superseded*]
IETF RFC 8499 [Superseded*]
RFC8914 — RFC8914 EXTERNAL
IETF RFC 8945 [Active*]

Bibliographic Reference(s)

IETF.draft-ietf-dprive-dnsoquic-03 — I-D.ietf-dprive-dnsoquic EXTERNAL
IETF.draft-ietf-tls-esni-13 — I-D.ietf-tls-esni EXTERNAL
IETF.draft-vcelak-nsec5-08 — I-D.vcelak-nsec5 EXTERNAL
NIST.SP.800-81-2 — NIST-GUIDE EXTERNAL
NLnet Labs, "NSD 4.3.6", <https://www.nlnetlabs.nl/projects/nsd/about/>. EXTERNAL
ISC, "BIND 9.16.16", <https://www.isc.org/bind/>. EXTERNAL
Goldberg, S., Naor, N., Papadopoulos, D., Reyzin, L., Vasant, S., and A. Ziv, "Stretching NSEC3 to the Limit: Efficient Zone Enumeration Attacks on NSEC3 Variants", February 2015, <https://www.cs.bu.edu/~goldbe/papers/nsec3attacks.pdf>. EXTERNAL
IETF RFC 1982 [Active*]
RFC5155 — RFC5155 EXTERNAL
IETF RFC 6891 [Active*]
RFC8484 — RFC8484 EXTERNAL
RFC8976 — RFC8976 EXTERNAL
RFC9076 — RFC9076 EXTERNAL

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC9103.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 9103, DNS Zone Transfer over TLS. Available at https://doi.org/10.17487/RFC9103

Snippet:

IETF RFC 9103, DNS Zone Transfer over TLS. Available at https://doi.org/10.17487/RFC9103

HTML (ISO 690 compliant)

Preview:

IETF RFC 9103, DNS Zone Transfer over TLS. Available at https://doi.org/10.17487/RFC9103

Snippet:

<span class="citation"><cite>IETF RFC 9103</cite>, DNS Zone Transfer over TLS. Available at <a href="https://doi.org/10.17487/RFC9103" target="_blank" rel="noopener">https://doi.org/10.17487/RFC9103</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 9103, DNS Zone Transfer over TLS
doi: 10.17487/RFC9103
url: https://doi.org/10.17487/RFC9103

Snippet:

<li>
<cite id="bib-rfc9103">IETF RFC 9103</cite>, DNS Zone Transfer over TLS
<span class="doi">10.17487/RFC9103</span>
</li>

Referenced By

IETF RFC 9499 [Active*]