Keep fallback, caching and trust separate
05SRV tells a client where to try a service. It does not authenticate that service, continuously measure load, or define a universal discovery policy for every application.
Separate threat view: forged service-location data points elsewhere. A DNS record is not a certificate or permission grant; no authenticated connection is drawn.
Source for this drawing: RFC 2782 · Read RFC source: Security considerations and usage limits ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
A service-location answer is a routing hint whose use and trust depend on the application and DNS context.
- If the generic recommended usage procedure has no matching positive SRV result, it describes an A lookup for the original target domain and use of the application’s service/transport information (pages 6–7). This historical fallback is not permission to ignore a single Target dot, bypass DNS errors indiscriminately or override an application-specific discovery specification.
- Target MUST have address records and MUST NOT be an alias (page 4). The local teaching validator rejects a selected CNAME target rather than quietly treating it as a compliant SRV endpoint. That local stop does not invent a new DNS error code or cover complete DNS response validation.
- Weight is intended for static selection information, not dynamic server-load balancing (pages 5–6). Cached records remain subject to DNS TTLs; changing live CPU use does not update a cached weight. A larger weight does not prove lower latency or healthy service.
- The administrator advice’s 512-byte reply discussion is historical context, not a current universal DNS packet limit. EDNS and TCP behavior belong to their specifications; this guide does not enforce a synthetic 512-byte SRV cutoff or claim to implement truncated-response handling.
- The security considerations (pages 9–10) note that DNS spoofers can supply false ports as well as names and addresses. An SRV answer does not by itself provide confidentiality, prove server identity or authorize access. Apply the relevant application and DNS security rules; no new mandatory TLS or DNSSEC requirement is invented here.
- RFC 2782 obsoletes experimental RFC 2052. Its notable naming change adds underscores to service/protocol labels (Changes from RFC 2052, page 9). RFC 6335 and RFC 8553 update naming/registration guidance, while the published SRV selection and field rules remain the subject of this guide.
Four separate boundary examples. Generic fallback and alias rejection are bounded teaching decisions, not a complete DNS resolver, discovery implementation or security validator.
Read the RFC section ↗