Show each server only the name it needs
01A resolver can send shorter names to higher servers while still keeping the original request.
The final authoritative server can receive MX a.b.example.org. Name minimisation does not hide the request from the recursive resolver or that final server, and it supplies no encryption.
Source for this drawing: RFC 9156 · Read RFC section 2 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DNS means Domain Name System. QNAME is the queried domain name; QTYPE is the kind of record requested. A stub resolver asks a recursive resolver to do the work. QNAME minimisation changes the recursive resolver’s outgoing questions, not the DNS message protocol (§§1–2).
- DNS means Domain Name System. QNAME is the queried domain name; QTYPE is the kind of record requested. A stub resolver asks a recursive resolver to do the work. QNAME minimisation changes the recursive resolver’s outgoing questions, not the DNS message protocol (§§1–2).
- The full original name and type are needed at the server authoritative for the requested record. Higher servers only need enough of the name to return the next delegation. A delegation transfers responsibility for part of the DNS name tree (§2).
- For the RFC’s MX request a.b.example.org., the selected minimising QTYPE in this guide is A. MX asks for mail-exchange records; A asks for IPv4 address records. Root receives A org.; org receives A example.org. Later probes locate any deeper delegation (§4). The full sequence appears in the next chapter.
- The recursive resolver still receives the full original request from the stub, and the eventual authoritative server can receive the full original name and type. This is less disclosure to intermediate authoritative servers, not encryption, anonymity, or protection against that recursive resolver (§6).
- Stub and forwarding resolvers MAY minimise too, but all information eventually reaches their upstream resolver anyway. Without finding and caching zone cuts, this can drastically increase outgoing queries (§2.4). A zone cut is a delegation boundary, not every dot.
Documentation-domain examples. Suffixes, supplied response events and label budgets are bounded teaching models, not a DNS wire codec, validating resolver or live privacy measurement.
Read the RFC section ↗