Open a dedicated TLS transport
01DNS over TLS normally connects to TCP port 853 and begins TLS before DNS messages.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 3.1 ↗
RFC 7858 · § 3.1EXAMPLE
3 / 3
03
Send DNS inside the established TLS connection.
Send DNS inside the established TLS connection.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
No DNS messages are sent before the TLS handshake completes.
- No DNS messages are sent before the TLS handshake completes.
- A dedicated service port differs from opportunistically upgrading a cleartext DNS message.
The drawing is a simplified worked example. Follow the linked RFC and its updates for implementation requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy