Areas / DNS

DNS

Names to addresses: resolvers, zones, DNSSEC.

411 RFCs · 411 with AI ELI5 · 0 summaries · 0 index pages

With AI ELI5 411

RFC 1035 DNS Implementation Domain Names - Implementation and Specification The wire format, resource records, and transport details that make DNS work RFC 1034 DNS Concepts Domain Names - Concepts and Facilities The hierarchical naming system that maps human-readable names to IP addresses RFC 4035 DNSSEC Protocol Protocol Modifications for the DNS Security Extensions The rules that make signed DNS data servable, cacheable and checkable, from zone signing to the chain of trust. RFC 4034 DNSSEC Records Resource Records for the DNS Security Extensions The four record types that let DNS answers carry proof of where they came from. RFC 4033 DNSSEC Introduction DNS Security Introduction and Requirements The overview of how DNS answers get digital signatures, and what those signatures can and cannot promise. RFC 2308 DNS Negative Caching Negative Caching of DNS Queries How a resolver remembers that a name or record does not exist, and for how long. RFC 5155 NSEC3 DNS Security (DNSSEC) Hashed Authenticated Denial of Existence A DNSSEC record that proves a name does not exist without handing out a list of every name in the zone. RFC 2782 DNS SRV A DNS RR for specifying the location of services (DNS SRV) Locating network services by name, protocol, and domain using DNS RFC 2136 Dynamic DNS Dynamic Updates in the Domain Name System (DNS UPDATE) How to add and delete DNS records in a live zone with a single, conditional, all-or-nothing message. RFC 3597 Unknown DNS RRs Handling of Unknown DNS Resource Record (RR) Types How DNS software should store and pass along record types it does not recognize, so new types need no server upgrades. RFC 6891 EDNS(0) Extension Mechanisms for DNS (EDNS(0)) How DNS grew past its 512-byte limit without breaking the servers that never heard of it. RFC 6698 DANE TLSA The DNS-Based Authentication of Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA How a domain publishes, in DNSSEC-signed DNS, which certificate or key its TLS servers must use. RFC 3596 DNS AAAA Record DNS Extensions to Support IP Version 6 The AAAA record and IP6.ARPA domain that let DNS store and look up IPv6 addresses. RFC 5731 EPP Domain Mapping Extensible Provisioning Protocol (EPP) Domain Name Mapping How EPP commands apply to domain names: checking, registering, renewing, transferring and updating them in a registry. RFC 7766 DNS over TCP DNS Transport over TCP - Implementation Requirements Why every general-purpose DNS implementation must speak TCP, and how to make DNS over TCP nearly as quick as UDP. RFC 7344 CDS / CDNSKEY Automating DNSSEC Delegation Trust Maintenance Two DNS record types that let a signed child zone tell its parent which DS records it wants. RFC 7858 DNS over TLS Specification for DNS over Transport Layer Security (TLS) How DNS queries get wrapped in TLS on port 853 so eavesdroppers cannot read them. RFC 9083 RDAP JSON JSON Responses for the Registration Data Access Protocol (RDAP) The JSON shapes that registries use to answer 'who holds this domain, IP block or AS number?' RFC 6763 DNS-SD DNS-Based Service Discovery How ordinary DNS records can list the printers, web pages and other services on a network, with no new DNS features. RFC 5011 DNSSEC Anchor Updates Automated Updates of DNS Security (DNSSEC) Trust Anchors How a DNSSEC validating resolver can safely accept new trust anchors, and drop old ones, without a human editing its configuration. RFC 9082 RDAP Queries Registration Data Access Protocol (RDAP) Query Format The URL patterns clients use to look up who holds an IP network, AS number, domain, nameserver or contact. RFC 8945 TSIG Secret Key Transaction Authentication for DNS (TSIG) Authenticate DNS requests and responses with a shared secret and a keyed hash, appended as a TSIG record. RFC 1183 DNS RR Types New DNS RR Definitions Five experimental DNS record types: AFS server locations, a responsible person, X.25 and ISDN addresses, and route-through bindings. RFC 3225 DNSSEC DO bit Indicating Resolver Support of DNSSEC A single flag bit in the EDNS0 header lets a resolver tell a DNS server it can accept DNSSEC records. RFC 3492 Punycode Punycode: A Bootstring encoding of Unicode for Internationalized Domain Names in Applications (IDNA) How a domain label in any script is squeezed into letters, digits and hyphens. RFC 5890 IDNA2008 Internationalized Domain Names for Applications (IDNA): Definitions and Document Framework The vocabulary and road map for the second generation of internationalized domain names, IDNA2008. RFC 3958 DDDS SRV Application Domain-Based Application Service Location Using SRV RRs and the Dynamic Delegation Discovery Service (DDDS) How a client turns a domain, a service name and a protocol into a server and port, using NAPTR and SRV records. RFC 2874 DNS A6 Records DNS Extensions to Support IPv6 Address Aggregation and Renumbering A Historic scheme that stored IPv6 addresses as chains of prefix records so networks could be renumbered easily. RFC 8553 DNS Attrleaf Fixes DNS Attrleaf Changes: Fixing Specifications That Use Underscored Node Names Updates dozens of older specifications so their underscored DNS names fit into the single IANA registry created by RFC 8552. RFC 5892 IDNA2008 The Unicode Code Points and Internationalized Domain Names for Applications (IDNA) The rulebook that decides which Unicode characters may appear in an internationalized domain name. RFC 3403 DDDS DNS database Dynamic Delegation Discovery System (DDDS) Part Three: The Domain Name System (DNS) Database How the DNS stores delegation rules as NAPTR records, so a string can be rewritten step by step into a domain name. RFC 9224 RDAP Bootstrap Finding the Authoritative Registration Data Access Protocol (RDAP) Service How an RDAP client looks up which server to ask about a domain, an IP address or an AS number. RFC 952 HOSTS.TXT DoD Internet host table specification The text-file format that listed every network, gateway and host name with its address, before DNS took over that job. RFC 2930 TKEY Secret Key Establishment for DNS (TKEY RR) How a DNS resolver and server agree on a shared secret key, so later messages can be authenticated with TSIG. RFC 3110 DNSSEC RSA RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS) How DNS stores RSA public keys and RSA/SHA-1 signatures, replacing the weaker MD5-based scheme. RFC 5891 IDNA2008 Internationalized Domain Names in Applications (IDNA): Protocol The protocol that lets non-ASCII domain names work on today's DNS by encoding them as plain ASCII labels. RFC 8198 Aggressive NSEC Aggressive Use of DNSSEC-Validated Cache Let validating DNS resolvers answer 'no such name' for a whole range of names from one cached proof. RFC 6147 DNS64 DNS64: DNS Extensions for Network Address Translation from IPv6 Clients to IPv4 Servers How a DNS server invents IPv6 addresses for IPv4-only servers so IPv6-only clients can still reach them by name. RFC 8078 CDS/CDNSKEY Managing DS Records from the Parent via CDS/CDNSKEY How a child zone can ask its parent to add, change or remove DS records, including turning DNSSEC on and off. RFC 3226 DNSSEC and IPv6 A6 aware server/resolver message size requirements DNS software that supports DNSSEC or A6 records must also support EDNS0 so larger answers need not fall back to TCP. RFC 3007 Secure DNS Update Secure Domain Name System (DNS) Dynamic Update How a DNS server decides who may change a zone: sign the update request, then check the signer against policy. RFC 1995 DNS IXFR Incremental Zone Transfer in DNS How a secondary DNS server can fetch only the changes to a zone instead of copying the whole thing. RFC 8484 DNS over HTTPS DNS Queries over HTTPS (DoH) Carrying every DNS question and answer inside an ordinary HTTPS request RFC 7873 DNS Cookies Domain Name System (DNS) Cookies A small token in each DNS message that lets servers and clients spot forged traffic from attackers who cannot see the conversation. RFC 9499 DNS terminology DNS Terminology One place to look up what DNS terms mean today, from labels and zones to resolvers and DNSSEC states. RFC 1982 Serial Number Arithmetic How to compare and increment wrapping counters, such as the DNS SOA serial number, when the numbers loop back to zero. RFC 2536 DSA in DNS DSA KEYs and SIGs in the Domain Name System (DNS) How DNS stores a DSA public key and a DSA signature, using the KEY and SIG record types. RFC 5936 AXFR DNS Zone Transfer Protocol (AXFR) How a DNS server hands a complete copy of a zone to another server over TCP, written down the way it really works. RFC 1536 DNS Errors Common DNS Implementation Errors and Suggested Fixes A catalogue of recurring DNS software bugs that flooded the network with traffic, and how to fix them. RFC 6762 mDNS Multicast DNS Zero-configuration DNS resolution on local networks using multicast RFC 5625 DNS proxy guidelines DNS Proxy Implementation Guidelines How home-router DNS proxies should pass queries along without breaking modern DNS. RFC 5702 RSA/SHA-2 DNSSEC Use of SHA-2 Algorithms with RSA in DNSKEY and RRSIG Resource Records for DNSSEC How DNSSEC keys and signatures are made with RSA and the SHA-256 and SHA-512 hash functions. RFC 6303 Locally Served DNS Zones Locally Served DNS Zones Resolvers should answer reverse lookups for private and special addresses themselves, instead of sending them to the public Internet. RFC 7477 CSYNC Child-to-Parent Synchronization in DNS A DNS record that lets a child zone tell its parent to copy updated NS and glue records. RFC 2931 SIG(0) DNS Request and Transaction Signatures ( SIG(0)s ) How a DNS message can carry a public-key signature that proves who sent a request or answered it. RFC 2163 MCGAM in DNS Using the Internet DNS to Distribute MIXER Conformant Global Address Mapping (MCGAM) How to publish X.400 and RFC 822 address mapping rules in the DNS instead of in hand-distributed tables. RFC 4398 DNS CERT Record Storing Certificates in the Domain Name System (DNS) The CERT record: a DNS resource record type for storing certificates and revocation lists. RFC 9460 SVCB and HTTPS records Service Binding and Parameter Specification via the DNS (SVCB and HTTPS Resource Records) DNS records that tell a client how to reach a service, with protocols, ports and aliases, before it connects. RFC 2317 Classless in-addr.arpa Classless IN-ADDR.ARPA delegation How to hand a small block of addresses its own reverse DNS zone using CNAME records. RFC 9364 DNSSEC DNS Security Extensions (DNSSEC) A roadmap to the many RFCs that make up DNSSEC, and a statement that using it is best current practice. RFC 1996 DNS NOTIFY A Mechanism for Prompt Notification of Zone Changes (DNS NOTIFY) How a DNS primary server taps its secondaries on the shoulder the moment a zone changes. RFC 3646 DNS Configuration options for Dynamic Host Configuration Protocol for IPv6 (DHCPv6) Two DHCPv6 options that tell a client which DNS servers to ask and which domains to search. RFC 6116 ENUM The E.164 to Uniform Resource Identifiers (URI) Dynamic Delegation Discovery System (DDDS) Application (ENUM) How a telephone number becomes a DNS name, and DNS records turn that name into URIs for reaching the person. RFC 5893 IDNA Bidi Right-to-Left Scripts for Internationalized Domain Names for Applications (IDNA) The six-part Bidi rule that decides which right-to-left domain labels are safe to display in IDNA2008. RFC 6761 Special-use domain names Special-Use Domain Names When a domain name may be reserved for special handling, how to ask for it, and the first names on the list. RFC 3363 IPv6 addresses in DNS Representing Internet Protocol version 6 (IPv6) Addresses in the Domain Name System (DNS) The IETF settles the AAAA versus A6 argument: AAAA for production, A6 and bit labels demoted to experiments. RFC 5452 Measures for Making DNS More Resilient against Forged Answers Rules that make a caching DNS resolver far harder to fool with fake answers, without changing the DNS protocol. RFC 5910 DNSSEC EPP Domain Name System (DNS) Security Extensions Mapping for the Extensible Provisioning Protocol (EPP) How a registrar tells a domain registry about a domain's DNSSEC keys, using an extension to the EPP domain mapping. RFC 6781 DNSSEC operations v2 DNSSEC Operational Practices, Version 2 Practical advice for zone administrators on running DNSSEC: key roles, key rollovers, signature timing and NSEC or NSEC3. RFC 1591 DNS Structure Domain Name System Structure and Delegation Who runs which part of the DNS name tree, what the original top-level domains were for, and the rules for handing a domain to a manager. RFC 3833 DNS Threat Analysis Threat Analysis of the Domain Name System (DNS) The list of attacks on DNS that DNSSEC was meant to defend against, written down a decade late. RFC 8914 Extended DNS Errors Extended DNS Errors A way for DNS servers to say why a query failed, not just that it failed. RFC 881 Domain Names Plan Domain names plan and schedule The 1983 plan and dated schedule for moving the ARPA Internet from one host table to domain style names. RFC 2539 DH in DNS Storage of Diffie-Hellman Keys in the Domain Name System (DNS) How DNS stores the public part of a Diffie-Hellman key in a KEY record, including two well-known prime groups. RFC 4701 DHCID RR A DNS Resource Record (RR) for Encoding Dynamic Host Configuration Protocol (DHCP) Information (DHCID RR) A DNS record that stores a hashed DHCP client identity next to a name, so updaters can tell whose name it is. RFC 5679 802.21 DNS Discovery Locating IEEE 802.21 Mobility Services Using DNS How a mobile device uses DNS NAPTR and SRV records to find IEEE 802.21 handover servers. RFC 5864 AFS SRV Records DNS SRV Resource Records for AFS How AFS clients find a cell's database servers with DNS SRV records instead of the old AFSDB record. RFC 8145 Trust Anchor Signaling Signaling Trust Anchor Knowledge in DNS Security Extensions (DNSSEC) How a DNSSEC validating resolver can tell a server which trust anchor keys it uses, so key rollovers can be watched. RFC 8552 Underscored DNS Names Scoped Interpretation of DNS Resource Records through "Underscored" Naming of Attribute Leaves How DNS names that start with an underscore scope a record to its parent domain, and the IANA registry that keeps them from colliding. RFC 6672 DNAME DNAME Redirection in the DNS A DNS record that redirects a whole subtree of names to another part of the name tree. RFC 9156 QNAME Minimisation DNS Query Name Minimisation to Improve Privacy Resolvers stop telling every server in the DNS hierarchy the full name they are looking up. RFC 4697 DNS resolver misbehavior Observed DNS Resolution Misbehavior What the authors of RFC 4697 saw DNS resolvers doing wrong at the root and com/net servers, and how to stop it. RFC 4848 U-NAPTR Domain-Based Application Service Location Using URIs and the Dynamic Delegation Discovery Service (DDDS) A small extension to S-NAPTR that lets DNS records point straight at a URI for a domain's service. RFC 8310 DoT/DoDTLS Profiles Usage Profiles for DNS over TLS and DNS over DTLS Two usage profiles, Strict and Opportunistic, and the ways a DNS client can check it is really talking to its encrypted DNS server. RFC 9904 DNSSEC algo updates DNSSEC Cryptographic Algorithm Recommendation Update Process DNSSEC algorithm advice moves out of a fixed RFC and into the IANA registries, so it can change without a new document. RFC 897 DNS schedule Domain name system implementation schedule The 1984 timetable for moving every host from flat names to hierarchical domain-style names. RFC 4470 Minimally covering NSEC Minimally Covering NSEC Records and DNSSEC On-line Signing Signing tiny, on-demand NSEC records so DNSSEC zones cannot be listed by zone walking. RFC 4592 DNS wildcards The Role of Wildcards in the Domain Name System Clears up when a DNS wildcard answers a query, and fixes how wildcards and CNAME records interact. RFC 4704 DHCPv6 FQDN option The Dynamic Host Configuration Protocol for IPv6 (DHCPv6) Client Fully Qualified Domain Name (FQDN) Option How a DHCPv6 client and server agree on the client's DNS name and on who updates the DNS records. RFC 7830 EDNS(0) Padding The EDNS(0) Padding Option A DNS option that lets clients and servers add filler bytes so encrypted messages reveal less through their size. RFC 8020 NXDOMAIN NXDOMAIN: There Really Is Nothing Underneath If a DNS name does not exist, nothing underneath it exists either, and resolvers should cache it that way. RFC 9103 XFR over TLS DNS Zone Transfer over TLS Encrypting DNS zone transfers (AXFR and IXFR) with TLS 1.3 so eavesdroppers cannot collect a zone's contents. RFC 9463 DNR DHCP and Router Advertisement Options for the Discovery of Network-designated Resolvers (DNR) DHCP and IPv6 Router Advertisement options that let a network tell hosts where its encrypted DNS resolvers are. RFC 7720 DNS Root Name Service Protocol and Deployment Requirements The short list of protocol and deployment rules every DNS root name service must follow. RFC 2535 DNSSEC Domain Name System Security Extensions The first full design for signing DNS answers, so a resolver can tell real data from forged data. RFC 4702 DHCPv4 FQDN option The Dynamic Host Configuration Protocol (DHCP) Client Fully Qualified Domain Name (FQDN) Option How a DHCPv4 client and server agree on the client's name and on who updates its DNS records. RFC 7671 DANE Updates The DNS-Based Authentication of Named Entities (DANE) Protocol: Updates and Operational Guidance Clarifies how to use DANE TLSA records safely: which record types to publish, how to roll keys, and how clients should check them. RFC 8490 DSO DNS Stateful Operations A new DNS message type that lets a client and server keep one connection open, agree on timeouts and send each other messages. RFC 9462 DDR Discovery of Designated Resolvers How a device that only knows a DNS server's IP address can find out whether that server offers encrypted DNS, and verify it. RFC 9615 DNSSEC bootstrapping Automatic DNSSEC Bootstrapping Using Authenticated Signals from the Zone's Operator How a DNS operator can publish signed hints that let a parent zone safely switch on DNSSEC for a new delegation. RFC 8005 HIP DNS Extension Host Identity Protocol (HIP) Domain Name System (DNS) Extension A DNS record type that publishes a HIP host's public key, its tag and its rendezvous servers. RFC 3743 JET IDN Guidelines Joint Engineering Team (JET) Guidelines for Internationalized Domain Names (IDN) Registration and Administration for Chinese, Japanese, and Korean How registries can reserve and group look-alike Chinese, Japanese and Korean domain labels so one owner holds them all. RFC 5855 Reverse DNS Nameservers Nameservers for IPv4 and IPv6 Reverse Zones Stable, dedicated names for the servers that answer reverse DNS lookups for IPv4 and IPv6. RFC 7871 EDNS Client Subnet Client Subnet in DNS Queries How a DNS resolver can pass part of your network address to a server so it can pick a nearby answer. RFC 8521 RDAP Object Tagging Registration Data Access Protocol (RDAP) Object Tagging A hyphen and a short provider tag on the end of an RDAP handle tell clients which server to ask. RFC 9276 NSEC3 Guidance Guidance for NSEC3 Parameter Settings Keep NSEC3 simple: zero extra iterations, no salt, and resolvers that refuse costly settings. RFC 920 Domain requirements The 1984 policy that said who may create a domain, and named the first handful of top level domains. RFC 1706 DNS NSAP records DNS NSAP Resource Records How the DNS was taught to store OSI network addresses (NSAPs) under a domain name, and to look them up in reverse. RFC 4025 IPSECKEY A Method for Storing IPsec Keying Material in DNS A DNS record type that publishes the public key, and optionally the gateway, for setting up an IPsec tunnel. RFC 4255 SSHFP Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints Publish a fingerprint of an SSH server's key in DNS, signed with DNSSEC, so clients can check it instead of trusting blindly. RFC 4509 SHA-256 in DS records Use of SHA-256 in DNSSEC Delegation Signer (DS) Resource Records (RRs) How DNSSEC parent zones can publish a SHA-256 fingerprint of a child zone's key instead of only a SHA-1 one. RFC 4703 DHCP FQDN conflicts Resolution of Fully Qualified Domain Name (FQDN) Conflicts among Dynamic Host Configuration Protocol (DHCP) Clients How DHCP clients and servers use a DHCID record in the DNS to tell whose hostname is whose. RFC 5001 DNS NSID DNS Name Server Identifier (NSID) Option A DNS option that lets a name server say which one of many identical-looking servers answered. RFC 7828 edns-tcp-keepalive The edns-tcp-keepalive EDNS0 Option A DNS option that lets a server tell clients how long an idle TCP connection may stay open. RFC 8590 EPP Change Poll Change Poll Extension for the Extensible Provisioning Protocol (EPP) How an EPP server tells a registrar what changed on its objects, by whom and why, when the registrar did not make the change. RFC 9250 DoQ DNS over Dedicated QUIC Connections How to carry DNS queries and answers over QUIC, one stream per question, with TLS-style privacy and low latency. RFC 2826 Unique DNS root IAB Technical Comment on the Unique DNS Root Why the public DNS can have only one root, and what that means for anyone proposing alternatives. RFC 5894 IDNA2008 Internationalized Domain Names for Applications (IDNA): Background, Explanation, and Rationale The reasoning behind IDNA2008: why the rules for non-ASCII domain names were rebuilt, and what changed from IDNA2003. RFC 1535 A Security Problem and Proposed Correction With Widely Deployed DNS Software Resolver search lists could send a partial name to an unintended host outside the local administration. RFC 2182 Secondary DNS Servers Selection and Operation of Secondary DNS Servers How many backup DNS servers a zone needs, where to put them, and how to fix a broken zone serial number. RFC 5358 Preventing Use of Recursive Nameservers in Reflector Attacks How to stop open DNS resolvers from being turned into amplifiers for denial of service attacks. RFC 5782 DNSBL DNS Blacklists and Whitelists Shared DNS lookups to check if an IP or domain is listed as a blacklist or whitelist entry. RFC 5933 GOST DNSSEC Use of GOST Signature Algorithms in DNSKEY and RRSIG Resource Records for DNSSEC How to sign DNS data and make DS digests with the Russian GOST algorithms in DNSSEC. RFC 7583 DNSSEC Key Rollover DNSSEC Key Rollover Timing Considerations How to time the replacement of DNSSEC keys so no part of a signed zone ever fails validation. RFC 9210 DNS Transport over TCP - Operational Requirements Why blocking DNS over TCP breaks things, and why operators must allow it alongside UDP. RFC 8806 Local root server copy Running a Root Server Local to a Resolver How a DNS resolver can keep its own copy of the root zone, safely, and fall back when it goes stale. RFC 6605 ECDSA for DNSSEC Elliptic Curve Digital Signature Algorithm (DSA) for DNSSEC Defines ECDSA with the P-256 and P-384 curves as DNSSEC signing algorithms, plus SHA-384 DS records. RFC 7673 DANE with SRV Using DNS-Based Authentication of Named Entities (DANE) TLSA Records with SRV Records How a client finds and checks TLSA records when it locates a TLS server through SRV records. RFC 8765 DNS Push Notifications DNS Push Notifications Lets a DNS client subscribe to record changes over a long-lived TLS connection instead of polling for them. RFC 8767 Serve-stale DNS Serving Stale Data to Improve DNS Resiliency Lets DNS resolvers answer with expired records when the authoritative servers cannot be reached. RFC 9077 NSEC TTLs NSEC and NSEC3: TTLs and Aggressive Use Fixes the TTL rules for NSEC and NSEC3 records so that cached 'this name does not exist' proofs expire when the zone operator intended. RFC 9461 SVCB for DNS servers Service Binding Mapping for DNS Servers How a named DNS server can advertise encrypted transports such as DoT, DoH and DoQ using SVCB records. RFC 9471 DNS glue requirements DNS Glue Requirements in Referral Responses When a DNS referral cannot fit all the in-domain glue, the server must say so with the TC flag. RFC 9953 DNS over CoAP DNS over CoAP (DoC) How tiny Internet of Things devices can look up names by carrying DNS messages inside CoAP. RFC 2694 DNS_ALG DNS extensions to Network Address Translators (DNS_ALG) How DNS names map to addresses when NAT hides private networks RFC 3364 IPv6 DNS tradeoffs Tradeoffs in Domain Name System (DNS) Support for Internet Protocol version 6 (IPv6) A side-by-side look at two competing ways to store IPv6 addresses in the DNS, and when each one makes sense. RFC 4290 IDN registration Suggested Practices for Registration of Internationalized Domain Names (IDN) Rules for preventing confusion and fraud in internationalized domain names. RFC 4690 IDN review Review and Recommendations for Internationalized Domain Names (IDNs) The IAB takes stock of problems with internationalized domain names and proposes how the IETF and ICANN should respond. RFC 921 DNS schedule (revised) Domain name system implementation schedule - revised A dated plan for moving the Internet from one flat host table to hierarchical domain names and name servers. RFC 1033 Domain Administrators Operations Guide A hands-on guide to running a domain name server and keeping your zone files in good order. RFC 1480 US Domain The US Domain How the .us domain is organized by state and locality, and how names are registered and delegated under it. RFC 9076 DNS Privacy DNS Privacy Considerations Where a DNS lookup leaks information about you, from your device to the root servers. RFC 9609 DNS priming queries Initializing a DNS Resolver with Priming Queries The first question a DNS resolver asks to learn where the root servers are, and how to ask it safely. RFC 10001 DNS in mixed IPv4/IPv6 Operational Guidelines for DNS Transport in Mixed IPv4/IPv6 Environments How to keep DNS working when some networks speak only IPv4 and others only IPv6. RFC 2845 TSIG Secret Key Transaction Authentication for DNS (TSIG) A lightweight way for DNS clients and servers to authenticate each message with a shared secret and a keyed hash. RFC 1032 Domain administrators guide A practical guide to registering a domain with the NIC and running it as a domain administrator. RFC 1101 DNS Network Names DNS encoding of network names and other types DNS extension for looking up networks by name and for general identifier-to-number mappings. RFC 3645 GSS-TSIG Generic Security Service Algorithm for Secret Key Transaction Authentication for DNS (GSS-TSIG) How DNS clients and servers use GSS-API security mechanisms such as Kerberos to sign their messages with TSIG. RFC 6452 IDNA Unicode 6.0 The Unicode Code Points and Internationalized Domain Names for Applications (IDNA) - Unicode 6.0 Unicode 6.0 changes do not require IDNA rule updates. RFC 6764 CalDAV/CardDAV discovery Locating Services for Calendaring Extensions to WebDAV (CalDAV) and vCard Extensions to WebDAV (CardDAV) How a calendar or contacts app can find a CalDAV or CardDAV server from just an address and password. RFC 7686 .onion The ".onion" Special-Use Domain Name Reserves .onion as a special name that belongs to Tor services and must never be resolved through ordinary DNS. RFC 8749 Retire DLV Moving DNSSEC Lookaside Validation (DLV) to Historic Status The official retirement of DNSSEC Lookaside Validation, a stopgap from when the DNS root was still unsigned. RFC 8753 IDNA Unicode review Internationalized Domain Names for Applications (IDNA) Review for New Unicode Versions How each new Unicode version gets checked so internationalized domain names keep working. RFC 8766 Discovery Proxy Discovery Proxy for Multicast DNS-Based Service Discovery A proxy that answers ordinary DNS queries by asking Multicast DNS on the local link, so service discovery works across networks. RFC 8880 ipv4only.arpa Special Use Domain Name 'ipv4only.arpa' Why the name ipv4only.arpa is officially special, and what resolvers and DNS64 servers must do with it. RFC 8976 ZONEMD Message Digest for DNS Zones A digest of a whole DNS zone, stored inside the zone, so anyone holding a copy can check it is complete and unaltered. RFC 9476 .alt TLD The .alt Special-Use Top-Level Domain A reserved top-level label that says: this name is not in the global DNS, so do not look it up there. RFC 9520 DNS failure caching Negative Caching of DNS Resolution Failures Resolvers must remember that a lookup failed, so they stop hammering servers that cannot answer. RFC 9536 RDAP reverse search Registration Data Access Protocol (RDAP) Reverse Search How an RDAP server can answer 'which domains are tied to this person or handle?' instead of only the reverse. RFC 9567 DNS error reporting DNS Error Reporting How a validating resolver tells an authoritative server's operator about DNS failures by sending one specially named query. RFC 6742 ILNP DNS records DNS Resource Records for the Identifier-Locator Network Protocol (ILNP) DNS records that separate a node's identity from its location. RFC 8094 DNS over DTLS DNS over Datagram Transport Layer Security (DTLS) Wrapping DNS queries in DTLS over UDP port 853 so eavesdroppers cannot read them, as an experimental backup to DNS over TLS. RFC 3258 Distributing Authoritative Name Servers via Shared Unicast Addresses Distributing DNS servers across the network using shared unicast addresses for better performance. RFC 8244 Special-Use Names Special-Use Domain Names Problem Statement When a process for reserving special domain names breaks down RFC 8901 Multi-Signer DNSSEC Models How to run DNSSEC when two or more DNS providers each sign the same zone with their own keys. RFC 8906 A Common Operational Problem in DNS Servers: Failure to Communicate Why DNS servers must answer every well-formed query, and how to test whether yours does. RFC 8932 DNS Privacy Operators Recommendations for DNS Privacy Service Operators What to do, and what to promise users, when you run a DNS resolver that offers privacy. RFC 1912 DNS Errors Common DNS Operational and Configuration Errors A practical checklist of the mistakes people most often make in DNS zone data and in running nameservers. RFC 7534 AS112 Operations AS112 Nameserver Operations How volunteers run a shared anycast sink that answers misdirected reverse-DNS queries for private addresses. RFC 819 The Domain Naming Convention for Internet User Applications Building a hierarchical naming system for interconnected networks RFC 1794 DNS Load Balancing DNS Support for Load Balancing Using DNS to distribute traffic across multiple servers. RFC 4713 Chinese domain names Registration and Administration Recommendations for Chinese Domain Names Registering Chinese domain names that have variants in both Simplified and Traditional forms RFC 4795 LLMNR Link-local Multicast Name Resolution (LLMNR) Name resolution on local networks when DNS is unavailable. RFC 4892 Requirements for a Mechanism Identifying a Name Server Instance Identifying which DNS server answered a query in anycast deployments RFC 5507 DNS extension choices Design Choices When Expanding the DNS Why a new resource record type is the best way to add data to the DNS. RFC 5895 IDNA2008 mapping Mapping Characters for Internationalized Domain Names in Applications (IDNA) 2008 How to normalize user-typed domain names before they reach the IDNA2008 protocol. RFC 7553 URI DNS Record The Uniform Resource Identifier (URI) DNS Resource Record A DNS record type that maps a service name under a domain straight to one or more full URIs. RFC 7646 DNSSEC NTA Definition and Use of DNSSEC Negative Trust Anchors A temporary, local switch that lets a resolver skip DNSSEC validation for one broken domain without turning validation off everywhere. RFC 8764 Apple DNS LLQ Apple's DNS Long-Lived Queries Protocol Apple's old way for DNS servers to tell clients about changes instead of making them poll, now replaced by DNS Push Notifications. RFC 2181 DNS Clarifications Clarifications to the DNS Specification Fixes the spots in the original DNS specs that implementers kept reading differently. RFC 799 Internet name domains A 1981 proposal to split the flat list of internet host names into name domains, with mail forwarders that know each domain's hosts. RFC 1031 MILNET name domain transition The plan for moving MILNET hosts from a central host table to domain-style names. RFC 3425 Obsoleting IQUERY Obsoleting IQUERY Declaring the DNS IQUERY operation obsolete and no longer recommended RFC 4955 DNSSEC Experiments DNS Security (DNSSEC) Experiments A recipe for testing non-backwards-compatible DNSSEC ideas on real zones without breaking standard resolvers. RFC 5158 6to4 Reverse DNS Delegation Specification How a 6to4 site asks for DNS servers to be delegated for its own reverse lookup zone, with its source address as the proof. RFC 6641 NFSv4 DNS SRV Using DNS SRV to Specify a Global File Namespace with NFS Version 4 Using a DNS SRV record to find the root of an organization's NFSv4 file tree. RFC 6731 DNS server selection Improved Recursive DNS Server Selection for Multi-Interfaced Nodes How a device on several networks picks which DNS server to ask, using new DHCP options. RFC 6975 Signaling Cryptographic Algorithm Understanding in DNS Security Extensions (DNSSEC) How a DNSSEC validating resolver tells servers which signature and hash algorithms it understands. RFC 7216 LIS Discovery Location Information Server (LIS) Discovery Using IP Addresses and Reverse DNS How a device behind a home router can find its Location Information Server by turning its IP address into reverse DNS names. RFC 7218 Adding Acronyms to Simplify Conversations about DNS-Based Authentication of Named Entities (DANE) Short names for the three numeric fields of a TLSA record, added to the IANA DANE registries. RFC 8334 EPP launch phase Launch Phase Mapping for the Extensible Provisioning Protocol (EPP) How a domain registry's EPP interface handles sunrise, landrush and trademark claims periods at launch. RFC 8375 home.arpa Special-Use Domain 'home.arpa.' A reserved DNS name that home networks can use for local names without colliding with the public internet. RFC 8482 Minimal ANY Providing Minimal-Sized Responses to DNS Queries That Have QTYPE=ANY How a DNS server can answer an ANY query with one small record instead of everything it knows. RFC 8543 EPP Organization Mapping Extensible Provisioning Protocol (EPP) Organization Mapping A new EPP object type so registries can record registrars, resellers, privacy proxies and DNS operators as organizations. RFC 8777 AMTRELAY DNS record DNS Reverse IP Automatic Multicast Tunneling (AMT) Discovery A DNS record, looked up by the multicast sender's address, that tells AMT gateways which relays can deliver that sender's traffic. RFC 8917 The LoST-Validation Straightforward-Naming Authority PoinTeR (S-NAPTR) Application Service Tag A new DNS service tag that lets emergency-location software find the servers that check addresses, separate from the ones that route calls. RFC 8977 RDAP Sort and Paging Registration Data Access Protocol (RDAP) Query Parameters for Result Sorting and Paging Query parameters that let RDAP clients count, sort and page through large search results. RFC 8982 RDAP Partial Registration Data Access Protocol (RDAP) Partial Response How an RDAP client can ask for a trimmed-down answer instead of every field the server holds. RFC 9018 DNS Server Cookies Interoperable Domain Name System (DNS) Server Cookies A single recipe for DNS Server Cookies so servers from different vendors can validate each other's cookies. RFC 9038 EPP Unhandled Namespaces Extensible Provisioning Protocol (EPP) Unhandled Namespaces How an EPP server can hand a client data it cannot normally send, by tucking it into extValue elements. RFC 9537 RDAP redaction Redacted Fields in the Registration Data Access Protocol (RDAP) Response How an RDAP server tells you which fields it hid, and how, instead of leaving you guessing. RFC 9619 DNS QDCOUNT In the DNS, QDCOUNT Is (Usually) One A DNS query message carries at most one question, and anything else gets a FORMERR reply. RFC 9664 DNS Update Leases An EDNS(0) Option to Negotiate Leases on DNS Updates A DNS Update extension that gives records an expiry date, so abandoned ones get cleaned up. RFC 9665 SRP for DNS-SD Service Registration Protocol for DNS-Based Service Discovery How devices register their services with a DNS server over plain unicast, with no multicast needed. RFC 9803 EPP TTL mapping Extensible Provisioning Protocol (EPP) Mapping for DNS Time-to-Live (TTL) Values How a domain registrar can set the DNS cache lifetime of delegation records through EPP. RFC 9859 Generalized DNS NOTIFY Generalized DNS Notifications Extends DNS NOTIFY beyond zone transfers so a child zone can nudge its parent to check for new DS or NS data right away. RFC 9873 EPP additional email Additional Email Address Extension for the Extensible Provisioning Protocol (EPP) An EPP extension that lets a contact object carry a second email address, ASCII or internationalized. RFC 9877 RDAP geofeed Registration Data Access Protocol (RDAP) Extension for Geofeed Data How an RDAP server points to the geofeed file for an IP network, using a new link type and extension. RFC 9886 DETs in DNS DRIP Entity Tags (DETs) in the Domain Name System How drone identity tags are looked up in the DNS, using the IPv6 reverse tree as a registry. RFC 10029 DNS multiple QTYPEs DNS Multiple QTYPEs An EDNS option that lets a DNS client ask for several record types in one query and get them in one response. RFC 10037 RDAP DNS TTL extension Registration Data Access Protocol (RDAP) Extension for DNS Time-to-Live (TTL) Values An RDAP extension that lets registries show the configured DNS TTL values for a domain or nameserver. RFC 1886 DNS IPv6 Extensions DNS Extensions to Support IP Version 6 How the Domain Name System first learned to store and look up IPv6 addresses. RFC 3755 Legacy Resolver Compatibility for Delegation Signer (DS) How DNSSEC got new record types so old resolvers would stop hiding unsigned delegations. RFC 3490 IDNA Internationalizing Domain Names in Applications (IDNA) How applications can use non-ASCII characters in domain names while the DNS keeps seeing plain ASCII. RFC 3761 ENUM The E.164 to Uniform Resource Identifiers (URI) Dynamic Delegation Discovery System (DDDS) Application (ENUM) How a telephone number is turned into a DNS name and used to find the services reachable at that number. RFC 1383 An Experiment in DNS Based IP Routing Using the Domain Name System to carry routing information. RFC 8467 EDNS Padding Policies Padding Policies for Extension Mechanisms for DNS (EDNS(0)) How much should a DNS message be padded? Block lengths of 128 bytes for queries and 468 for responses. RFC 9230 ODoH Oblivious DNS over HTTPS Hide DNS queries from resolvers using a privacy-preserving relay. RFC 8499 DNS Terminology DNS Terminology A single reference that gives the current meaning of the many terms used to describe the Domain Name System. RFC 2672 DNAME Non-Terminal DNS Name Redirection A DNS record that redirects a whole subtree of names to another domain, not just one name. RFC 2146 .GOV Domain U.S. Government Internet Domain Names The Federal Networking Council's rules for who may register a name directly under .GOV: one agency, one name. RFC 2352 Legal Names as Domains A Convention For Using Legal Names as Domain Names A proposal to hang company and trademark names under country domains so the law, not the registry, settles who owns a name. RFC 3832 SLP via DNS SRV Remote Service Discovery in the Service Location Protocol (SLP) via DNS SRV Using DNS SRV records to find SLP Directory Agents in other domains so services there can be discovered. RFC 9718 Root Zone Trust Anchors DNSSEC Trust Anchor Publication for the Root Zone How IANA publishes the DNSSEC trust anchors for the DNS root zone, as an XML file with signed delivery options. RFC 883 DNS (1983) Domain names: Implementation specification The 1983 draft design for DNS name servers, resolvers, message formats and zone maintenance, later replaced by RFC 1034 and RFC 1035. RFC 882 DNS (1983) Domain names: Concepts and facilities The 1983 concept paper that proposed replacing one central host table with a distributed, tree-shaped database of domain names. RFC 3491 Nameprep Nameprep: A Stringprep Profile for Internationalized Domain Names (IDN) The rulebook for cleaning up internationalized domain name labels so look-alike inputs compare as equal. RFC 8624 DNSSEC Algorithms Algorithm Implementation Requirements and Usage Guidance for DNSSEC Which signing and digest algorithms DNSSEC software must, should or must not support. RFC 3008 Domain Name System Security (DNSSEC) Signing Authority A tighter rule for which DNSSEC keys count as authorized to sign DNS data. RFC 606 Host names on-line A proposal for one official, machine-readable host name file kept on-line by the NIC. RFC 4431 DLV The DNSSEC Lookaside Validation (DLV) DNS Resource Record An alternative way to establish trust in DNS validation RFC 5074 DLV DNSSEC Lookaside Validation (DLV) A side table in the DNS that let resolvers find DNSSEC trust anchors for zones whose parents were not signed. RFC 2065 DNSSEC (Original) Domain Name System Security Extensions The first DNS security extensions: signed records, stored public keys and authenticated denial of existence. RFC 2168 URI Resolution via DNS Resolution of Uniform Resource Identifiers using the Domain Name System An experimental way to use DNS records to find the server that can resolve a URN or URL. RFC 3658 DS record Delegation Signer (DS) Resource Record (RR) A record placed at the parent side of a DNS delegation that vouches for the child zone's signing key. RFC 2219 DNS Aliases for Services Use of DNS Aliases for Network Services Why the web server is called www: the folklore of service nicknames in DNS, written down as a best current practice. RFC 2230 KX Record Key Exchange Delegation Record for the DNS A DNS record that names which host may negotiate security keys on behalf of another host. RFC 2671 EDNS0 Original Extension Mechanisms for DNS (EDNS0) The original way to let DNS messages grow past their fixed limits, built around one optional OPT record. RFC 3467 Role of the Domain Name System (DNS) Rethinking DNS as its original purpose overextends RFC 3681 Delegation of E.F.F.3.IP6.ARPA Asks IANA to hand the reverse-DNS zone for 6bone addresses over to the 6bone itself. RFC 4074 AAAA Query Misbehavior Common Misbehavior Against DNS Queries for IPv6 Addresses How some DNS servers answer IPv6 address queries wrongly, and why that can break IPv4 connections. RFC 4472 IPv6 DNS operations Operational Considerations and Issues with IPv6 DNS Practical guidance for deploying DNS in IPv6 networks, for operators experienced with IPv4. RFC 4986 Trust Anchor Rollover Requirements Related to DNS Security (DNSSEC) Trust Anchor Rollover The checklist any automated method for updating DNSSEC trust anchors must satisfy. RFC 5526 Infrastructure ENUM The E.164 to Uniform Resource Identifiers (URI) Dynamic Delegation Discovery System (DDDS) Application for Infrastructure ENUM A separate namespace for carriers to publish phone number routing information. RFC 5564 Arabic domain guidelines Linguistic Guidelines for the Use of the Arabic Language in Internet Domains Technical rules and linguistic guidance for registering domain names in Arabic. RFC 6055 IAB Thoughts on Encodings for Internationalized Domain Names Why domain names with non-ASCII characters break when applications and resolvers disagree on how to encode them. RFC 6394 DANE use cases Use Cases and Requirements for DNS-Based Authentication of Named Entities (DANE) The scenarios and requirements for letting DNSSEC-signed DNS back up the certificates that TLS clients check. RFC 6841 DNSSEC DP and DPS A Framework for DNSSEC Policies and DNSSEC Practice Statements A checklist of topics for writing a DNSSEC Policy or Practice Statement, so zone operators can show how they manage keys and signing. RFC 6912 Principles for Unicode Code Point Inclusion in Labels in the DNS Guidelines for deciding which Unicode characters are safe in domain names RFC 7479 Ed25519 in SSHFP Using Ed25519 in SSHFP Resource Records Gives Ed25519 SSH host keys a number in the SSHFP DNS record so their fingerprints can be published. RFC 7535 AS112 via DNAME AS112 Redirection Using DNAME How a single DNAME record lets any zone owner send junk queries to the AS112 sink without asking its operators. RFC 7558 Requirements for Scalable DNS-Based Service Discovery (DNS-SD) / Multicast DNS (mDNS) Extensions Scaling service discovery beyond a single network link RFC 8027 DNSSEC Roadblocks DNSSEC Roadblock Avoidance How a DNSSEC validator can test the network and resolvers it depends on, and work around the ones that break DNSSEC. RFC 8427 DNS in JSON Representing DNS Messages in JSON Representing DNS messages in a human-readable JSON format. RFC 9120 arpa nameservers Nameservers for the Address and Routing Parameter Area ("arpa") Domain How the arpa domain gets its own nameserver names, separate from the DNS root servers. RFC 9715 DNS Frag Avoidance IP Fragmentation Avoidance in DNS over UDP Practical rules for keeping DNS answers small enough that UDP never has to split them into IP fragments. RFC 9726 DNS for IoT Devices Operational Considerations for Use of DNS in Internet of Things (IoT) Devices How IoT makers should use DNS names so that network firewalls driven by MUD files can actually enforce them. RFC 9874 EPP deletion practices Best Practices for Deletion of Domain and Host Objects in the Extensible Provisioning Protocol (EPP) How registrars can delete domains and name server hosts in EPP without breaking DNS or opening the door to hijackers. RFC 10026 DS automation Operational Recommendations for DNSSEC Delegation Signer (DS) Automation How registries and registrars should handle automatic DS updates so DNSSEC stays working and nobody is surprised. RFC 2673 Binary Labels Binary Labels in the Domain Name System A DNS label type that packs a run of single-bit labels together, so names can be split at any bit boundary. RFC 2870 Root server operations Root Name Server Operational Requirements The operating rules the DNS root name servers were expected to follow in 2000: capacity, security and coordination. RFC 3152 IP6.ARPA Delegation of IP6.ARPA Why IPv6 reverse lookups moved from IP6.INT to IP6.ARPA, and who runs the new zone. RFC 2916 ENUM (E.164 in DNS) E.164 number and DNS Turn a telephone number into a DNS name, then look up the Internet services that reach that number. RFC 2540 Detached Domain Name System (DNS) Information A format for storing DNS answers offline with timestamps. RFC 2915 NAPTR The Naming Authority Pointer (NAPTR) DNS Resource Record A DNS resource record type that stores regular expression rewrite rules to transform one string into another. RFC 4956 DNSSEC Opt-In DNS Security (DNSSEC) Opt-In An experiment that lets big DNSSEC zones leave unsigned delegations out of the NSEC chain. RFC 6944 Applicability Statement: DNS Security (DNSSEC) DNSKEY Algorithm Implementation Status One table saying which DNSSEC signing algorithms software must, should, may or must not implement. RFC 7929 DANE for OpenPGP DNS-Based Authentication of Named Entities (DANE) Bindings for OpenPGP Publish OpenPGP public keys in DNS for automatic email encryption. RFC 8162 SMIMEA Using Secure DNS to Associate Certificates with Domain Names for S/MIME A DNS record type that publishes a person's S/MIME certificate under their email address, protected by DNSSEC. RFC 9526 Homenet public names Simple Provisioning of Public Names for Residential Networks Let home networks publish device names and addresses in public DNS. RFC 3731 Extensible Provisioning Protocol (EPP) Domain Name Mapping How to provision and manage domain names using EPP. RFC 6840 DNSSEC Clarifications Clarifications and Implementation Notes for DNS Security (DNSSEC) Errata and implementation advice for DNSSEC, sorted from security-critical fixes down to small corrections. RFC 3445 DNS KEY RR scope Limiting the Scope of the KEY Resource Record (RR) Limit the DNS KEY record to DNSSEC keys only, removing application keys. RFC 3757 Domain Name System KEY (DNSKEY) Resource Record (RR) Secure Entry Point (SEP) Flag A flag in DNS keys to mark which ones anchor signed zones to their parents. RFC 6014 Cryptographic Algorithm Identifier Allocation for DNSSEC Loosens the requirement for new DNSSEC cryptographic algorithms to be documented in any RFC, not just standards-track ones. RFC 830 Distributed system for Internet name service An early proposal for a distributed name service architecture for the Internet. RFC 1611 DNS Server MIB DNS Server MIB Extensions Gauges and controls that let system administrators watch and manage how a DNS server is performing. RFC 1612 DNS Resolver MIB DNS Resolver MIB Extensions Management tools for monitoring DNS lookups on client computers. RFC 4501 DNS URIs Domain Name System Uniform Resource Identifiers A dns: URI scheme for naming a piece of DNS data by its name, class and type. RFC 6594 SSHFP SHA-256 and ECDSA Use of the SHA-256 Algorithm with RSA, Digital Signature Algorithm (DSA), and Elliptic Curve DSA (ECDSA) in SSHFP Resource Records Two new numbers for SSHFP DNS records: one for ECDSA keys and one for SHA-256 fingerprints. RFC 8056 EPP-RDAP Status Mapping Extensible Provisioning Protocol (EPP) and Registration Data Access Protocol (RDAP) Status Mapping A lookup table that makes sure every domain registry status in EPP has a matching label in RDAP. RFC 8063 EPP Key Relay Key Relay Mapping for the Extensible Provisioning Protocol How DNS operators hand DNSSEC keys to each other through the registry's EPP poll queue. RFC 8509 DNSSEC Sentinel A Root Key Trust Anchor Sentinel for DNSSEC Special DNS names let anyone test whether a validating resolver already trusts a new root key. RFC 8544 Organization Extension for the Extensible Provisioning Protocol (EPP) An EPP extension that attaches organizations, such as a reseller or privacy proxy, to domains, hosts and contacts. RFC 8618 C-DNS Compacted-DNS (C-DNS): A Format for DNS Packet Capture A compact binary file format for storing huge captures of DNS queries and responses without keeping every raw packet. RFC 8807 EPP login security Login Security Extension for the Extensible Provisioning Protocol (EPP) An EPP extension that lifts the 16-character password cap and lets servers send security warnings at login. RFC 9022 DNRD Escrow Domain Name Registration Data (DNRD) Objects Mapping A standard layout for the backup copy a domain registry hands to an escrow agent, in either XML or CSV form. RFC 9108 YANG DNS Types YANG Types for DNS Classes and Resource Record Types Two DNS registries, DNS CLASSes and RR TYPEs, translated into reusable YANG types. RFC 9154 EPP Transfer Auth Extensible Provisioning Protocol (EPP) Secure Authorization Information for Transfer A way to move a domain between registrars using short-lived, random, hashed transfer codes instead of long-lived passwords. RFC 9233 IDNA2008 Unicode 12 Internationalized Domain Names for Applications 2008 (IDNA2008) and Unicode 12.0.0 Why moving internationalized domain names from Unicode 6.0.0 to 12.0.0 needed no new exceptions, and what changed along the way. RFC 9373 EdDSA for IPSECKEY EdDSA Value for IPSECKEY Registers a value so EdDSA public keys can be stored in IPSECKEY DNS records. RFC 9432 DNS Catalog Zones DNS Catalog Zones How a list of zones, published as an ordinary DNS zone, lets secondary name servers set themselves up automatically. RFC 9527 DHCPv6 for HNA DHCPv6 Options for the Homenet Naming Authority DHCPv6 options that let an ISP tell a home router which domain and DNS managers to use for the home network's public names. RFC 9560 RDAP OpenID Connect Federated Authentication for the Registration Data Access Protocol (RDAP) Using OpenID Connect One login at a trusted identity provider, usable with many RDAP servers, so registries can decide who sees what. RFC 9606 DNS resolver information DNS Resolver Information A new DNS record type, RESINFO, lets a resolver describe its own features to the clients that use it. RFC 9660 DNS ZONEVERSION The DNS Zone Version (ZONEVERSION) Option A way for a DNS answer to say which version of the zone it came from. RFC 9704 Local DNS Authority Establishing Local DNS Authority in Validated Split-Horizon Environments How a domain owner can vouch for a network's local DNS resolver, so clients use it only for the names it is allowed to answer. RFC 9824 Compact DNSSEC denial Compact Denial of Existence in DNSSEC How a DNSSEC server can prove a name does not exist by pretending it exists with no data, using one small signed record. RFC 2538 CERT RR Storing Certificates in the Domain Name System (DNS) A DNS resource record type for storing cryptographic certificates and revocation lists. RFC 7626 DNS Privacy Considerations Understanding what your DNS queries reveal about you RFC 7719 DNS Terminology DNS Terminology A glossary of DNS terms clarified after decades of shifting definitions. RFC 6895 Domain Name System (DNS) IANA Considerations The rulebook for who may add new record types, classes, opcodes and error codes to the DNS registries. RFC 4931 EPP Domain Extensible Provisioning Protocol (EPP) Domain Name Mapping Using EPP to manage domain names in a registry system RFC 9157 Revised IANA Considerations for DNSSEC DNSSEC digest and NSEC3 hash algorithms now need only an RFC, not a Standards Action, to get IANA identifiers. RFC 8109 DNS Priming Initializing a DNS Resolver with Priming Queries How resolvers find the root servers when they start. RFC 810 DoD Internet host table specification Specifies the format for a central host table to map network names and addresses. RFC 5205 HIP DNS Host Identity Protocol (HIP) Domain Name System (DNS) Extensions DNS extensions for finding and authenticating Host Identity Protocol nodes RFC 2137 Secure DNS Update Secure Domain Name System Dynamic Update Using digital signatures to control who can change DNS data dynamically. RFC 2537 RSA/MD5 in DNS RSA/MD5 KEYs and SIGs in the Domain Name System (DNS) How to store cryptographic keys and signatures in the DNS. RFC 4343 DNS Case Insensitivity Domain Name System (DNS) Case Insensitivity Clarification The exact rules for how DNS treats uppercase and lowercase letters as equivalent. RFC 3915 EPP Grace Period Domain Registry Grace Period Mapping for the Extensible Provisioning Protocol (EPP) How registrars restore a deleted domain name during the redemption grace period, and how grace periods show up in EPP. RFC 4932 EPP Host Extensible Provisioning Protocol (EPP) Host Mapping Using EPP to manage host objects in a domain registry RFC 7816 QNAME Minimisation DNS Query Name Minimisation to Improve Privacy A DNS privacy technique that limits information leakage to authoritative servers. RFC 1537 Common DNS Data File Configuration Errors Common mistakes system administrators make when writing DNS zone files. RFC 6304 AS112 AS112 Nameserver Operations A distributed nameserver service that handles reverse DNS queries for private IP addresses. RFC 4641 DNSSEC operations DNSSEC Operational Practices How to safely run and maintain DNS zones with security extensions. RFC 9975 CDS/CSYNC consistency Clarifications on CDS/CDNSKEY and CSYNC Consistency Parents must check that every nameserver of a child agrees before acting on CDS, CDNSKEY or CSYNC records. RFC 608 Host names on-line Keeping computers findable with an online list of host names and addresses RFC 973 Domain system changes and observations Updates and lessons learned from early DNS implementation. RFC 3845 NSEC Type Bit Map DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format A bigger checklist of which record types exist in DNSSEC. RFC 4635 HMAC-SHA TSIG IDs HMAC SHA (Hashed Message Authentication Code, Secure Hash Algorithm) TSIG Algorithm Identifiers Add identifiers for stronger hash algorithms in DNS TSIG. RFC 3901 DNS IPv6 Transport DNS IPv6 Transport Operational Guidelines How to operate DNS when queries travel over both IPv4 and IPv6 networks. RFC 1816 .gov Domain Names U.S. Government Internet Domain Names Registration policies for U.S. government Internet domain names. RFC 2052 DNS SRV (Experimental) A DNS RR for specifying the location of services (DNS SRV) DNS records for locating services by protocol and domain. RFC 1637 DNS NSAP RR DNS NSAP Resource Records Adding a new DNS record type to map domain names to OSI NSAP addresses RFC 2541 DNS Security Operational Considerations How to generate, protect, and rotate the cryptographic keys that secure DNS. RFC 4159 Deprecation of "ip6.int" Switch from ip6.int to ip6.arpa for IPv6 reverse DNS lookups RFC 811 Hostnames Server A simple text query service on the SRI-NIC machine that handed out the internet host name and address table. RFC 2832 NSI RRP NSI Registry Registrar Protocol (RRP) Version 1.1.0 How registrars tell the DNS registry about new domains and name servers. RFC 3655 Redefinition of DNS Authenticated Data (AD) bit Clarifying what the DNS Authenticated Data bit actually means. RFC 4310 DNSSEC EPP Domain Name System (DNS) Security Extensions Mapping for the Extensible Provisioning Protocol (EPP) Managing DNS security keys through the domain provisioning protocol. RFC 5966 DNS over TCP DNS Transport over TCP - Implementation Requirements Why DNS implementations must support TCP in addition to UDP. RFC 9905 SHA-1 in DNSSEC Deprecating the Use of SHA-1 in DNSSEC Signature Algorithms Declares SHA-1 cryptography unsafe for DNS security signing. RFC 1348 DNS NSAP RRs DNS NSAP RRs DNS records to store and look up addresses from non-IP networks. RFC 6604 xNAME RCODE and Status Bits Clarification Clarifies how response codes and status bits work when DNS names are redirected RFC 8909 RDE Registry Data Escrow Specification A standardized format for domain registries to back up their data safely. RFC 1401 Correspondence between the IAB and DISA on the use of DNS Letters on adopting the Domain Name System across the entire Internet RFC 1713 Tools for DNS debugging A guide to practical tools for finding and fixing DNS problems RFC 1956 MIL Domain Registration Registration in the MIL Domain Rules for military organizations to register under the .mil domain. RFC 2053 AM Domain The AM (Armenia) Domain The Internet country-code top-level domain for the Republic of Armenia. RFC 2517 WWWSeeker Building Directories from DNS: Experiences from WWWSeeker How to build a directory of companies and their web sites from domain registries RFC 2825 I18N and domain names A Tangled Web: Issues of I18N, Domain Names, and the Other Internet protocols The architectural challenges of putting languages into web addresses. RFC 3071 DNS Domain Categories Reflections on the DNS, RFC 1591, and Categories of Domains Reconsideration of domain allocation policies in a post-web internet. RFC 3197 Applicability Statement for DNS MIB Extensions Why DNS management tools were never actually used. RFC 4027 DNS Media Types Domain Name System Media Types MIME types for DNS data in binary and text formats RFC 4183 A Suggested Scheme for DNS Resolution of Networks and Gateways Using DNS to find the network containing an IP address and its first-hop routers. RFC 4185 National and Local Characters for DNS Top Level Domain (TLD) Names Letting people in other countries type domain names in their own alphabets. RFC 4339 IPv6 DNS Config IPv6 Host Configuration of DNS Server Information Approaches Three ways IPv6 hosts learn which DNS servers to use. RFC 4367 What's in a Name: False Assumptions about DNS Names Why domain names don't reliably predict what services run on them RFC 5992 Internationalized Domain Names Registration and Administration Guidelines for European Languages Using Cyrillic Character and variant guidelines for domain names written in Cyrillic RFC 6168 Requirements for Management of Name Servers for the DNS A requirements roadmap for unified DNS name server management systems. RFC 6563 A6 to Historic Moving A6 to Historic Status Moving the A6 DNS record type to Historic status and explaining why. RFC 6927 Variants in Second-Level Names Registered in Top-Level Domains How registries handle internationalized domain names that look the same. RFC 6950 Architectural Considerations on Application Features in the DNS When should applications use DNS as a database, and when should they use something else? RFC 7043 EUI48/EUI64 RRs Resource Records for EUI-48 and EUI-64 Addresses in the DNS DNS slots for storing hardware device addresses, with serious privacy warnings. RFC 7085 Top-Level Domains That Are Already Dotless A catalog of DNS top-level domains with address records RFC 7108 A Summary of Various Mechanisms Deployed at L-Root for the Identification of Anycast Nodes Methods for identifying which L-Root DNS node answers your query. RFC 7129 DNSSEC denial Authenticated Denial of Existence in the DNS How DNSSEC proves that a domain name or record type does not exist. RFC 7304 A Method for Mitigating Namespace Collisions Outlines a discouraged approach to resolving DNS name collisions. RFC 7393 Using the Port Control Protocol (PCP) to Update Dynamic DNS How to update DNS when addresses and ports are shared during IPv6 transition. RFC 7745 Reverse DNS XML Schemas XML Schemas for Reverse DNS Management Standard format for updating reverse DNS through a web service RFC 8222 DNS-SD Labels Selecting Labels for Use with Conventional DNS and Other Resolution Systems in DNS-Based Service Discovery How to choose names that work across DNS and mDNS without confusion. RFC 8228 LGR Variant Guidance Guidance on Designing Label Generation Rulesets (LGRs) Supporting Variant Labels Designing rules for variant labels in internationalized domain names. RFC 8324 DNS rethink DNS Privacy, Authorization, Special Uses, Encoding, Characters, Matching, and Root Structure: Time for Another Look? Can the 30-year-old domain name system be redesigned, or should its scope be limited? RFC 8483 Yeti DNS Yeti DNS Testbed A global testbed for experimenting with DNS root server changes safely. RFC 8501 Reverse DNS in IPv6 for Internet Service Providers Practical approaches for Internet Service Providers to manage reverse DNS lookups in IPv6 networks. RFC 8567 Customer Management DNS Resource Records Four joke DNS record types for storing customer secrets in the public internet phone book. RFC 8882 DNS-Based Service Discovery (DNS-SD) Privacy and Security Requirements What privacy and security features DNS-based service discovery needs to protect users on public networks. RFC 9095 EPP Strict Bundling Extensible Provisioning Protocol (EPP) Domain Name Mapping Extension for Strict Bundling Registration Provisioning related domain names as an atomic group through EPP RFC 9199 Considerations for Large Authoritative DNS Server Operators Research-backed advice for operating large DNS server networks RFC 9267 DNS RR Anti-Patterns Common Implementation Anti-Patterns Related to Domain Name System (DNS) Resource Record (RR) Processing Common mistakes in DNS implementations that lead to crashes or attacks. RFC 9498 GNU Name System The GNU Name System Decentralized, censorship-resistant DNS alternative using key blinding and cryptographic zone management. RFC 10023 _for-sale DNS name The "_for-sale" Underscored and Globally Scoped DNS Node Name A simple DNS record to advertise that a domain name is for sale. RFC 1386 The US Domain How the United States domain space is organized by geography RFC 1811 .gov Domain Names U.S. Government Internet Domain Names The registration policies and eligibility rules for the .gov top-level domain. RFC 2010 Root Server Criteria Operational Criteria for Root Name Servers The rules for running a bulletproof DNS root name server. RFC 7706 Root on Loopback Decreasing Access Time to Root Servers by Running One on Loopback How a resolver can keep its own copy of the DNS root zone on a loopback address, and why the RFC warns against doing it lightly. RFC 7958 Root DNSSEC Trust Anchor DNSSEC Trust Anchor Publication for the Root Zone The formats and download locations IANA used to publish the DNSSEC trust anchor for the DNS root zone. RFC 6305 PRISONER.IANA.ORG I'm Being Attacked by PRISONER.IANA.ORG! Why a firewall may log traffic from PRISONER.IANA.ORG, and why it is usually not an attack. RFC 6725 DNSKEY algorithm updates DNS Security (DNSSEC) DNSKEY Algorithm IANA Registry Updates Three unused DNSSEC algorithm numbers become Reserved, and the registry's references are brought up to date. RFC 9906 ECC-GOST in DNSSEC Deprecate Usage of ECC-GOST within DNSSEC Removes support for deprecated GOST algorithms from DNSSEC. RFC 9910 RDAP RIR search Registration Data Access Protocol (RDAP) Regional Internet Registry (RIR) Search How to search for IP address and autonomous system registrations using the standard RDAP protocol. RFC 1664 Using the Internet DNS to Distribute RFC1327 Mail Address Mapping Tables Using DNS to store email address translation between two mail systems RFC 5006 RA DNS Option IPv6 Router Advertisement Option for DNS Configuration Routers advertise DNS server addresses alongside IPv6 network configuration. RFC 1788 ICMP Domain Names ICMP Domain Name Messages Two ICMP messages that ask an IP address directly for its own domain name. RFC 3632 RRP VeriSign Registry Registrar Protocol (RRP) Version 2.0.0 Updates to the protocol registrars use to manage domain names with a registry. RFC 7793 Shared Address Space DNS Adding 100.64.0.0/10 Prefixes to the IPv4 Locally-Served DNS Zones Registry Keeping private reverse DNS queries out of the global system. RFC 3090 DNS Security Extension Clarification on Zone Status How to define whether a DNS zone is secured by DNSSEC. RFC 5395 Domain Name System (DNS) IANA Considerations The rulebook IANA follows when it hands out new DNS record types, classes, opcodes and error codes. RFC 6195 DNS IANA Domain Name System (DNS) IANA Considerations How IANA allocates DNS parameter registry values RFC 1464 Using the Domain Name System To Store Arbitrary String Attributes Using DNS TXT records to store arbitrary text attributes alongside domain names. RFC 1712 DNS GPOS DNS Encoding of Geographical Location A DNS record type for storing where on Earth a computer is located. RFC 1876 DNS LOC A Means for Expressing Location Information in the Domain Name System Putting location coordinates into the Domain Name System RFC 2345 Domain Names and Company Name Retrieval A simple way to find company websites by looking up company names RFC 3123 DNS APL A DNS RR Type for Lists of Address Prefixes (APL RR) A DNS record type for publishing lists of IPv4 and IPv6 address prefixes. RFC 4471 DNS name neighbors Derivation of DNS Name Predecessor and Successor Computing the canonically-ordered predecessor and successor of a DNS name. RFC 6593 Service Undiscovery Service Undiscovery Using Hide-and-Go-Seek for the Domain Pseudonym System (DPS) An April Fools' hide-and-seek game for DNS services. RFC 7314 EDNS EXPIRE Extension Mechanisms for DNS (EDNS) EXPIRE Option Track how long DNS secondaries have been out of touch with the primary. RFC 7901 DNS CHAIN Query CHAIN Query Requests in DNS Get the full validation chain in one query instead of many. RFC 9539 Opportunistic DNS crypto Unilateral Opportunistic Deployment of Encrypted Recursive-to-Authoritative DNS Encrypt DNS queries between resolvers and authoritative servers without prior coordination. RFC 2929 Domain Name System (DNS) IANA Considerations Rules for registering new DNS protocol codes RFC 5509 SIP IM/presence SRV Internet Assigned Numbers Authority (IANA) Registration of Instant Messaging and Presence DNS SRV RRs for the Session Initiation Protocol (SIP) Registers the _sip label so im: and pres: addresses can be resolved to SIP servers through DNS. RFC 8495 EPP Allocation Token Allocation Token Extension for the Extensible Provisioning Protocol (EPP) A credential extension for authorizing allocation of objects in domain registries. RFC 8748 EPP fee extension Registry Fee Extension for the Extensible Provisioning Protocol (EPP) Let registries tell clients what domain operations will cost. RFC 9167 EPP Maintenance Registry Maintenance Notification for the Extensible Provisioning Protocol (EPP) How registry servers notify registrars about scheduled maintenance events. RFC 2240 Domain allocation A Legal Basis for Domain Name Allocation A proposal to allocate domain names fairly using legal company registration. RFC 623 Comments on on-line host name service Suggestions for implementing a network-wide host name directory service RFC 625 On-line hostnames service Where to find a network computer's address by its name. RFC 627 ASCII text file of hostnames The official list of ARPANET computers and their addresses. RFC 849 Suggestions for improved host table distribution A request for comments on how to improve the distribution and updating of host name tables across the Internet. RFC 6804 DISCOVER opcode DISCOVER: Supporting Multicast DNS Queries An experimental DNS opcode for multicast resource discovery in disconnected networks.