Visual RFC.
ALL RFCs / RFC 7828
Read the RFC ↗
RFC 7828 / SIGNAL DNS IDLE TIME

Respect transport and resource boundaries

05

The option applies to a TCP session. UDP handling, intermediaries, routing changes and abusive clients limit how much persistence can be expected.

DIAGRAMRead RFC section 3.2.1 ↗
RFC 7828 · § 3.2.1EXAMPLE
4 / 4
Respect transport and resource boundariesFirst, a client gate stops adding keepalive to a UDP query. Then two explicitly separate receive cases ignore code 11 in a UDP query at the server or a UDP response at the client, without rejecting the whole message merely for this option. A TCP-terminating intermediary has distinct client-facing C1 and server-facing C2 connections. Finally a separate abusive C1 is closed by the server and its resources freed; an advertised timeout is not guaranteed retention. No DSO, anycast implementation or real network traffic is simulated.Transport and resource boundariesSeparate case: abusive behavior detectedServer SHOULD close immediatelyServer resource managementC1 closed: no more traffic on this sessionConnection state: freedEarlier timeout does not force retention
04
Close and free resources when abuse is detected.

In a separate abusive-connection example, the server immediately closes C1 and releases its state. A previous timeout advertisement does not compel it to retain the connection.

Source for this drawing: RFC 7828 · Read RFC section 3.2.1 ↗

Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
New to this? Start hereA quick picture + helpful background

A message needs an address.

Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.

Helpful first, if these ideas are unfamiliar

RFC 7766 DNS over TCP RFC 6891 EDNS

These pictures are analogies to help you learn. The linked RFC explains the actual rules.

Related RFCs and changes

“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.

KEY POINT

Interpret the signal within its connection and transport.

  • Clients MUST NOT include this option in UDP queries. A server receiving it in a UDP query and a client receiving it in a UDP response MUST ignore the option.
  • TCP-terminating DNS intermediaries are RECOMMENDED to implement the option. Each terminated connection needs its own handling; anycast routing changes may still disrupt a longer-lived session.
  • A fallback strategy like RFC 6891 §6.2.2 SHOULD address paths that interfere with EDNS. Required security functionality must be preserved. When abusive behavior is detected, the server SHOULD immediately close the connection and free its resources.
DETAILS

The examples use ordinary DNS TCP sessions. RFC 8490 §7.1.2 is related guidance, not a metadata Updates relationship: a DSO-capable client/server pair MUST NOT use this option after DSO (DNS Stateful Operations) session establishment. A client sending a DSO establishment message MUST stop using it from that point; receiving it after establishment is a fatal error requiring immediate abort. Plain TCP and this timeout signal add no DNS confidentiality or authentication. No intermediary, anycast or DSO implementation is simulated.

Read the RFC section ↗

All chapters in RFC 7828

Drawing view

Scroll the drawing to see every part. Playback controls stay above it.

RFC 9700 / CHAPTERS

Chapters

For full details, tables, algorithms, and exceptions, read the original RFC.

RFC status and corrections ↗