DNS Transport over TCP - Operational Requirements

Metadata

Publisher: IETF
Doc Type: Best Practice
Pages: 29
Abstract: This document updates RFCs 1123 and 1536. This document requires the operational practice of permitting DNS messages to be carried over TCP on the Internet as a Best Current Practice. This operational requirement is aligned with the implementation requirements in RFC 7766. The use of TCP includes both DNS over unencrypted TCP as well as over an encrypted TLS session. The document also considers the consequences of this form of DNS communication and the potential operational issues that can arise when this Best Current Practice is not upheld.
Publication Date: 2022-03-01
Status Note: Best Current Practice
DOI: 10.17487/RFC9210
Link: https://doi.org/10.17487/RFC9210
Author(s): John Kristoff
Duane Wessels
Keyword(s): DNS, TCP

Latest version of IETF RFC 9210

Document Versions — IETF RFC 9210

▶ IETF RFC 9210 (2022-03-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

IETF RFC 1035 [Active, Amended*]
IETF RFC 2119 [Active*]
IETF RFC 2181 [Active*]
IETF RFC 6891 [Active*]
IETF RFC 7766 [Active*]
RFC7828 — RFC7828 EXTERNAL
RFC7873 — RFC7873 EXTERNAL
IETF RFC 8174 [Active*]

Bibliographic Reference(s)

10.1007-978-3-642-12365-8_1 — CASTRO2010 EXTERNAL
10.1109-SP.2015.18 — Connection-Oriented-DNS EXTERNAL
10.1145-1879141.1879173 — NETALYZR EXTERNAL
10.1145-2831347.2831350 — ECDSA EXTERNAL
10.1145-3355369.3355570 — ROLL_YOUR_ROOT EXTERNAL
10.1145-3472305.3472884 — DAI21 EXTERNAL
IETF.draft-ietf-dnsop-avoid-fragmentation-06 — I-D.ietf-dnsop-avoid-fragmentation EXTERNAL
DNS-OARC, "DNSCAP", February 2014, <https://www.dns-oarc.net/tools/dnscap>. EXTERNAL
Grant, D., "Economical With The Truth: Making DNSSEC Answers Cheap", June 2016, <https://blog.cloudflare.com/black-lies/>. EXTERNAL
ICANN, "Root Zone KSK Rollover Plan", March 2016, <https://www.iana.org/reports/2016/root-ksk-rollover-design-20160307.pdf>. EXTERNAL
"dnstap", <https://dnstap.info>. EXTERNAL
Toyama, K., Ishibashi, K., Toyono, T., Ishino, M., Yoshimura, C., and K. Fujiwara, "DNS Anomalies and Their Impacts on DNS Cache Servers", NANOG 32, October 2004. EXTERNAL
Internet Systems Consortium, "BIND 9", <https://www.isc.org/bind/>. EXTERNAL
Vixie, P. and V. Schryver, "DNS Response Rate Limiting (DNS RRL)", ISC-TN-2012-1-Draft1, April 2012. EXTERNAL
The Tcpdump Group, "Tcpdump and Libpcap", <https://www.tcpdump.org>. EXTERNAL
horizon, "Defeating Sniffers and Intrusion Detection Systems", Phrack Magazine, December 1998, <http://phrack.org/issues/54/10.html>. EXTERNAL
Huston, G., "Dealing with IPv6 fragmentation in the DNS", August 2017, <https://blog.apnic.net/2017/08/22/dealing-ipv6-fragmentation-dns/>. EXTERNAL
Cheswick, W. and S. Bellovin, "Firewalls and Internet Security: Repelling the Wily Hacker", First Edition, 1994. EXTERNAL
Lewis, E., "2017 DNSSEC KSK Rollover", RIPE 74, May 2017, <https://ripe74.ripe.net/presentations/25-RIPE74-lewis-submission.pdf>. EXTERNAL
DNS Software and Service Providers, "DNS Flag Day 2020", October 2020, <https://dnsflagday.net/2020/>. EXTERNAL
ICANN, "KSK Rollover List Archives", January 2019, <https://mm.icann.org/pipermail/ksk-rollover/2019-January/date.html>. EXTERNAL
Thomas, M. and D. Wessels, "An Analysis of TCP Traffic in Root Server DITL Data", DNS-OARC 2014 Fall Workshop, October 2014. EXTERNAL
Huston, G., "DNS XL", October 2020, <https://labs.apnic.net/?p=1380>. EXTERNAL
Herzberg, A. and H. Shulman, "Fragmentation Considered Poisonous", May 2012, <https://arxiv.org/pdf/1205.4011.pdf>. EXTERNAL
Bernstein, D., "When are TCP queries sent?", November 2002, <https://cr.yp.to/djbdns/tcp.html#why>. EXTERNAL
Wikipedia, "TCP Fast Open", February 2022, <https://en.wikipedia.org/w/index.php?title=TCP_Fast_Open&oldid=1071397204>. EXTERNAL
FreeBSD, "FreeBSD accept_filter(9)", June 2000, <https://www.freebsd.org/cgi/man.cgi?query=accept_filter>. EXTERNAL
IETF RFC 768 [Active*]
IETF RFC 793 [Superseded*]
IETF RFC 883 [Superseded*]
IETF RFC 1034 [Active*]
IETF RFC 1123 [Active*]
IETF RFC 1536 [Active*]
IETF RFC 1995 [Active*]
IETF RFC 1996 [Active*]
IETF RFC 2136 [Active*]
IETF RFC 2541 [Superseded*]
IETF RFC 2671 [Superseded*]
IETF RFC 2694 [Active*]
IETF RFC 3022 [Active*]
IETF RFC 3225 [Active*]
IETF RFC 3226 [Active*]
IETF RFC 4472 [Active*]
RFC4953 — RFC4953 EXTERNAL
RFC4987 — RFC4987 EXTERNAL
IETF RFC 5358 [Active*]
IETF RFC 5452 [Active*]
RFC5507 — RFC5507 EXTERNAL
RFC5625 — RFC5625 EXTERNAL
IETF RFC 5927 [Active*]
IETF RFC 5936 [Active*]
RFC5961 — RFC5961 EXTERNAL
IETF RFC 5966 [Superseded*]
IETF RFC 6298 [Active*]
IETF RFC 6762 [Active*]
IETF RFC 6781 [Active*]
RFC6950 — RFC6950 EXTERNAL
IETF RFC 7413 [Active*]
RFC7477 — RFC7477 EXTERNAL
RFC7534 — RFC7534 EXTERNAL
RFC7720 — RFC7720 EXTERNAL
RFC7858 — RFC7858 EXTERNAL
RFC7901 — RFC7901 EXTERNAL
RFC7918 — RFC7918 EXTERNAL
RFC8027 — RFC8027 EXTERNAL
RFC8094 — RFC8094 EXTERNAL
RFC8162 — RFC8162 EXTERNAL
IETF RFC 8200 [Active*]
RFC8324 — RFC8324 EXTERNAL
IETF RFC 8446 [Superseded*]
RFC8467 — RFC8467 EXTERNAL
IETF RFC 8482 [Active*]
RFC8483 — RFC8483 EXTERNAL
RFC8484 — RFC8484 EXTERNAL
IETF RFC 8490 [Active*]
RFC8501 — RFC8501 EXTERNAL
RFC8806 — RFC8806 EXTERNAL
RFC8906 — RFC8906 EXTERNAL
RFC8932 — RFC8932 EXTERNAL
IETF RFC 8945 [Active*]

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC9210.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 9210, DNS Transport over TCP - Operational Requirements. Available at https://doi.org/10.17487/RFC9210

Snippet:

IETF RFC 9210, DNS Transport over TCP - Operational Requirements. Available at https://doi.org/10.17487/RFC9210

HTML (ISO 690 compliant)

Preview:

IETF RFC 9210, DNS Transport over TCP - Operational Requirements. Available at https://doi.org/10.17487/RFC9210

Snippet:

<span class="citation"><cite>IETF RFC 9210</cite>, DNS Transport over TCP - Operational Requirements. Available at <a href="https://doi.org/10.17487/RFC9210" target="_blank" rel="noopener">https://doi.org/10.17487/RFC9210</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 9210, DNS Transport over TCP - Operational Requirements
doi: 10.17487/RFC9210
url: https://doi.org/10.17487/RFC9210

Snippet:

<li>
<cite id="bib-rfc9210">IETF RFC 9210</cite>, DNS Transport over TCP - Operational Requirements
<span class="doi">10.17487/RFC9210</span>
</li>

Referenced By

IETF RFC 10001 [Active*]