Distinguish transport privacy from DNS data trust
05DoT protects a particular connection; it does not make a dishonest resolver honest.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 8 ↗
RFC 7858 · § 8EXAMPLE
3 / 3
03
Use DNSSEC validation separately when authenticating DNS data.
Use DNSSEC validation separately when authenticating DNS data.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
The selected resolver still sees the queries.
- The selected resolver still sees the queries.
- DNSSEC data authentication and TLS channel protection cover different boundaries.
The drawing is a simplified worked example. Follow the linked RFC and its updates for implementation requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy