Visual RFC.
ALL RFCs / RFC 2782
Read the RFC ↗
RFC 2782 / DNS service location

Keep fallback, caching and trust separate

05

SRV tells a client where to try a service. It does not authenticate that service, continuously measure load, or define a universal discovery policy for every application.

RFC 2782 · Security considerations and usage limitsEXAMPLE
4 / 4
Keep fallback, caching and trust separateSeparate threat case sends forged host and port information from a DNS spoofer toward the client; the data can point to a wrong endpoint. The red record gate emphasizes that SRV alone supplies no identity authentication, confidentiality or authorization.Location, live load and identity are differentClientDNS spooferforged DNS host and portSRV answer ≠ authenticated identityNo certificate, confidentiality or access grantRFC2782 pages 5–7, 9–10 · bounded separate examples
04
Do not authenticate a server with SRV alone

Separate threat view: forged service-location data points elsewhere. A DNS record is not a certificate or permission grant; no authenticated connection is drawn.

Source for this drawing: RFC 2782 · Read RFC source: Security considerations and usage limits ↗

Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
New to this? Start hereA quick picture + helpful background

A message needs an address.

Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.

Helpful first, if these ideas are unfamiliar

These pictures are analogies to help you learn. The linked RFC explains the actual rules.

Related RFCs and changes

“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.

KEY POINT

A service-location answer is a routing hint whose use and trust depend on the application and DNS context.

  • If the generic recommended usage procedure has no matching positive SRV result, it describes an A lookup for the original target domain and use of the application’s service/transport information (pages 6–7). This historical fallback is not permission to ignore a single Target dot, bypass DNS errors indiscriminately or override an application-specific discovery specification.
  • Target MUST have address records and MUST NOT be an alias (page 4). The local teaching validator rejects a selected CNAME target rather than quietly treating it as a compliant SRV endpoint. That local stop does not invent a new DNS error code or cover complete DNS response validation.
  • Weight is intended for static selection information, not dynamic server-load balancing (pages 5–6). Cached records remain subject to DNS TTLs; changing live CPU use does not update a cached weight. A larger weight does not prove lower latency or healthy service.
  • The administrator advice’s 512-byte reply discussion is historical context, not a current universal DNS packet limit. EDNS and TCP behavior belong to their specifications; this guide does not enforce a synthetic 512-byte SRV cutoff or claim to implement truncated-response handling.
  • The security considerations (pages 9–10) note that DNS spoofers can supply false ports as well as names and addresses. An SRV answer does not by itself provide confidentiality, prove server identity or authorize access. Apply the relevant application and DNS security rules; no new mandatory TLS or DNSSEC requirement is invented here.
  • RFC 2782 obsoletes experimental RFC 2052. Its notable naming change adds underscores to service/protocol labels (Changes from RFC 2052, page 9). RFC 6335 and RFC 8553 update naming/registration guidance, while the published SRV selection and field rules remain the subject of this guide.
DETAILS

Four separate boundary examples. Generic fallback and alias rejection are bounded teaching decisions, not a complete DNS resolver, discovery implementation or security validator.

Read the RFC section ↗

All chapters in RFC 2782

Drawing view

Scroll the drawing to see every part. Playback controls stay above it.

RFC 9700 / CHAPTERS

Chapters

For full details, tables, algorithms, and exceptions, read the original RFC.

RFC status and corrections ↗