RFC 7858 / START HERE
DNS over TLS, before the details
DNS over TLS
DNS, the Domain Name System, can send its messages inside a TLS-protected connection. TLS means Transport Layer Security.
The idea in one picture
A device has a DNS question
TLS protects the resolver connection
The resolver returns DNS records
A simplified picture of the idea; the chapters explain the actual mechanisms.
Why it exists
An unencrypted DNS connection exposes queries to observers on that path. This transport protects the connection between a client and its resolver.
A familiar example
A device uses an encrypted connection to ask a chosen resolver for a website's address.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Open a dedicated TLS transportDNS over TLS normally connects to TCP port 853 and begins TLS before DNS messages.→
- Authenticate the intended resolverAn encrypted channel must be evaluated together with the chosen authentication profile.→
- Frame DNS messages inside the streamDoT uses the two-octet DNS-over-TCP length prefix inside TLS.→
- Reuse a connection for multiple queriesPersistent connections amortize TCP and TLS establishment and support multiple exchanges.→
- Distinguish transport privacy from DNS data trustDoT protects a particular connection; it does not make a dishonest resolver honest.→
This introduction explains RFC 7858 (2016). Read the original RFC ↗