RFC 7858 / PROTOCOL MECHANISMS

Frame DNS messages inside the stream

DoT uses the two-octet DNS-over-TCP length prefix inside TLS.

Related RFCs and changes

“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.

RFC 7858 · § 3.3EXAMPLE

3 / 3

The receiver reads the length, then that complete DNS message.

The receiver reads the length, then that complete DNS message.

Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references

KEY POINT

TLS records and DNS message boundaries need not coincide.

TLS records and DNS message boundaries need not coincide.
Clients and servers should support pipelining and match responses using the DNS rules.

DETAILS

The drawing is a simplified worked example. Follow the linked RFC and its updates for implementation requirements.

Diagrams simplify the RFC. Read the linked sections for complete requirements.

All chapters in this RFC