Limit disclosure and protect the channel
06An opaque identifier can still reveal sensitive information. Ordinary DNSSEC validation does not authenticate this channel signal.
A separate, appropriately configured channel mechanism such as TSIG can provide integrity/authentication. This diagram does not deploy TSIG, encrypt the ID or prove replay resistance of arbitrary payloads.
Source for this drawing: RFC 5001 · Read RFC section 5 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Payload meaning belongs to the server administrator. A maintenance address, real hostname, random value or dynamic value has different disclosure/stability tradeoffs; NSID does not define a universal decoder (RFC5001 §3.1).
- Payload meaning belongs to the server administrator. A maintenance address, real hostname, random value or dynamic value has different disclosure/stability tradeoffs; NSID does not define a universal decoder (RFC5001 §3.1).
- RFC5001 recommends explicit operator choice before exposing an unicast address or arbitrary configured value. A static opaque value is not automatically secret, unguessable, replay-safe or unique.
- NSID channel signaling is outside DNSSEC protection per se. DNSSEC validation of DNS answer records does not by itself establish integrity of this NSID value (RFC5001 §5).
- Applications requiring integrity need channel security, for example TSIG. RFC5001 cites RFC2845, now obsoleted by RFC8945; no signature/encryption scheme for NSID payloads is specified by this guide.
Fictional identifiers and documentation addresses. NSID is an optional, opaque, hop-by-hop debugging signal, not authentication or a DNS transaction ID. Diagrams are schematic; the byte model is not a complete DNS implementation.
Read the RFC section ↗