RFC 8094
DNS over Datagram Transport Layer Security (DTLS)
RFC 8094: DNS over Datagram Transport Layer Security (DTLS) ✨
okay bestie, here's the title block, the important stuff first 🎀
- RFC number: 8094
- Title: DNS over Datagram Transport Layer Security (DTLS)
- Authors: T. Reddy, D. Wing, and P. Patil, all from Cisco 💅
- Category: Experimental 🧪
- ISSN: 2070-1721
- Date: February 2017 📅
- Obsoletes / Updates: the header doesn't list any RFCs that it obsoletes or updates 🌸
- Stream: IETF (Internet Engineering Task Force) 🦋
Abstract 🦋
okay so DNS queries and responses are visible to network elements sitting on the path between the DNS client and its server 👀 and those messages can carry privacy-sensitive info, which is seriously worth protecting 🔒
this doc proposes using Datagram Transport Layer Security (DTLS) for DNS 🛡️ to guard against passive listeners and certain active attacks. latency is everything for DNS, so the proposal also talks about ways to cut down on DTLS round trips and shrink the DTLS handshake size ⚡ the whole mechanism runs over port 853 🧚
Status of This Memo ✨
this one is not an Internet Standards Track spec. it's been published so people can examine it, try it out in experimental implementations, and evaluate it 🧪
it defines an Experimental Protocol for the Internet community 🌈 it's a product of the IETF, it represents the consensus of the IETF community, and it went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). not every IESG-approved document is a candidate for any level of Internet Standard, though. see Section 2 of RFC 7841 for the details 📚
for the current status, any errata, and how to send feedback, check http://www.rfc-editor.org/info/rfc8094 🔗
Copyright Notice 💜
Copyright (c) 2017 IETF Trust and the persons identified as the document authors. All rights reserved.
this doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stand on the publication date. please actually read them, because they spell out your rights and restrictions 🧾 any Code Components pulled out of this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, as the Simplified BSD License describes 🫶
Table of Contents 🗂️
1. Introduction ....................................................3
1.1. Relationship to TCP Queries and to DNSSEC ..................3
1.2. Document Status ............................................4
2. Terminology .....................................................4
3. Establishing and Managing DNS over DTLS Sessions ................5
3.1. Session Initiation .........................................5
3.2. DTLS Handshake and Authentication ..........................5
3.3. Established Sessions .......................................6
4. Performance Considerations ......................................7
5. Path MTU (PMTU) Issues ..........................................7
6. Anycast .........................................................8
7. Usage ...........................................................9
8. IANA Considerations .............................................9
9. Security Considerations .........................................9
10. References ....................................................10
10.1. Normative References .....................................10
10.2. Informative References ...................................11
Acknowledgements ..................................................13
Authors' Addresses ................................................131. Introduction 🌸
so the Domain Name System is specified in [RFC1034] and [RFC1035] 📖 the big problem is that DNS queries and responses usually travel unencrypted, which means they're open to eavesdropping 👂 an eavesdropper can learn which domain a host is trying to reach, and that's a privacy leak 😬 the DNS privacy problem gets a deeper dive in [RFC7626] 🔍
this document defines DNS over DTLS, which gives confidential DNS communication between stub resolvers and recursive resolvers, between stub resolvers and forwarders, and between forwarders and recursive resolvers 🔐 the catch is that DNS over DTLS adds extra computational load on servers 🥵 the biggest privacy win comes from protecting the link between the DNS client (the end user's machine) and its caching resolver 💖
DNS over DTLS might also work between recursive clients and authoritative servers, but that use is out of scope for the DNS PRIVate Exchange (DPRIVE) working group, per its current charter 🙅♀️ and one more thing: this document does not change the format of DNS messages 🎀
the motivations for proposing DNS over DTLS are:
- TCP suffers from network head-of-line blocking. a lost packet stops all the other TCP segments from reaching the application until that lost packet gets retransmitted 😭 DNS over DTLS uses UDP, so it doesn't suffer from network head-of-line blocking 🦋
- DTLS session resumption costs one round trip, whereas TLS session resumption can only start once the TCP handshake is complete 🏃♀️ however, with TCP Fast Open [RFC7413], an implementation can reach the same RTT efficiency as DTLS ⚡
Note: DNS over DTLS is an experimental update to DNS. the experiment wraps up once the spec gets evaluated through implementations and interoperability testing 🧪
1.1. Relationship to TCP Queries and to DNSSEC 🧚
DNS queries can go over UDP or TCP, but the scope of this document is only UDP 🎯 DNS over TCP can be protected with TLS, as described in [RFC7858] 🔒 DNS over DTLS alone can't guarantee privacy for DNS messages in every circumstance, specifically when the DTLS record size is larger than the path MTU 💀 in those situations, the DNS server responds with a truncated response (see Section 5) ✂️
so DNS clients and servers that implement DNS over DTLS MUST also implement DNS over TLS, so that clients who want Strict Privacy (as described in [DTLS]) can get it 🫶
DNS Security Extensions (DNSSEC) [RFC4033] give object integrity for DNS resource records, so end users (or their resolver) can verify that responses are legit ✅ but DNSSEC doesn't give privacy for DNS requests or responses 🙈 DNS over DTLS works alongside DNSSEC, but it doesn't replace the need for or the value of DNSSEC 💅
1.2. Document Status 🌈
this is an Experimental RFC. the big question is whether the approach is usable at scale, and the answer comes from watching uptake, usability, and operational behavior in large, real-life deployments 👀
the DPRIVE working group considered this DTLS solution as an option, in case the TLS-based approach from [RFC7858] runs into trouble once it's deployed 🛟 right now, [RFC7858] is what's expected to get deployed, so this spec is mainly meant as a backup 🩹
when you benchmark DNS over DTLS, keep these guidelines in mind:
- DNS over DTLS can recover from packet loss and reordering, and it doesn't suffer from network head-of-line blocking 🙌 compared with DNS over TLS, its performance may be better on lossy networks 🌧️
- the number of round trips to send the first DNS query over DNS over DTLS is less than the number of round trips to send the first DNS query over TLS 🏎️ even with TCP Fast Open, it only works for subsequent TCP connections between the DNS client and server (Section 3 in [RFC7413]) 🥲
- if the DTLS 1.3 protocol [DTLS13] is used for DNS over DTLS, it brings critical latency improvements for connection establishment over DTLS 1.2 🚀
2. Terminology 📝
okay the capitalized key words in this doc are the ones that carry the spec's force, and they get read the way [RFC2119] describes 🤓 the list is: "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" (as described in [RFC2119]) 📚
3. Establishing and Managing DNS over DTLS Sessions 🌸
3.1. Session Initiation 🧚
by default, DNS over DTLS MUST run over standard UDP port 853 as defined in Section 8 💖 the one exception is if the DNS server has a mutual agreement with its clients to use a different port for DNS over DTLS. to use a port other than 853, both clients and servers would need a configuration option in their software ⚙️
the DNS client should figure out whether the DNS server supports DNS over DTLS by sending a DTLS ClientHello message to port 853 on the server 👋 that's true unless it has a mutual agreement with its server to use a port other than port 853 for DNS over DTLS. such another port MUST NOT be port 53, but it MAY come from the "first-come, first-served" port range (User Ports [RFC6335], range 1024-49151) 🎀 the reason port 53 is off the table is to avoid complications around choosing whether to use DTLS, and to reduce the risk of downgrade attacks 🛡️
a DNS server that doesn't support DNS over DTLS won't respond to ClientHello messages from the client 🤐 if no response shows up and the client doesn't have a better round-trip estimate, the client SHOULD retransmit the DTLS ClientHello according to Section 4.2.4.1 of [RFC6347] ⏱️ after 15 seconds, it SHOULD stop trying to retransmit its ClientHello 🛑 the client MAY repeat that whole procedure to find out whether DNS over DTLS service has come online at the DNS server, but that kind of probing SHOULD NOT happen more often than every 24 hours, and it MUST NOT happen more often than every 15 minutes 🕰️ best part: this mechanism needs no extra signaling between the client and server ✨
DNS clients and servers MUST NOT use port 853 to carry cleartext DNS messages 🚫 DNS clients MUST NOT send, and DNS servers MUST NOT respond to, cleartext DNS messages on any port used for DNS over DTLS (including, for example, after a failed DTLS handshake) 🙅♀️ mixing protected and unprotected data causes significant security issues, so UDP connections on a port that a given server has set aside for DNS over DTLS are reserved purely for encrypted communications 🔐
3.2. DTLS Handshake and Authentication 🦋
the DNS client starts the DTLS handshake as described in [RFC6347], following the best practices in [RFC7525] 🤝 once DTLS negotiation finishes, if the handshake succeeds according to [RFC6347], the connection gets encrypted and is protected from eavesdropping 🔒✨
DNS privacy needs the query (and the response) to be encrypted against passive attacks 👀 that encryption usually comes with integrity protection as a side effect, which means on-path attackers can't just inject bogus DNS responses 🙅 but to protect against active attackers pretending to be the server, the server itself has to be authenticated 🕵️♀️ to authenticate the server providing DNS privacy, the DNS client MUST use the authentication mechanisms discussed in [DTLS] 💅 this document doesn't propose any new ideas for authentication, so it's all covered by [DTLS] 🫶
3.3. Established Sessions ✨
Okay so once the DTLS session is up, everything gets protected with the same record encoding DTLS always uses 🔐. When this mechanism is in effect, DNS messages go through the standard DTLS record encoding too. To send a DNS message, a DTLS user just does an ordinary application data write, like SSL_write() 💌. The really cute part is that one single DTLS session can carry multiple DNS requests and receive multiple DNS responses 🦋
Now, the overload stuff 🫶 DNS over DTLS clients MUST take care to minimize the number of concurrent DTLS sessions made to any individual server. For any given client/server interaction, it is RECOMMENDED that there be no more than one DTLS session. Servers MAY also impose limits on how many concurrent DTLS sessions they handle for a particular client IP address or subnet. These limits SHOULD be much looser than the client guidelines above, because the server can't really know whether a client IP belongs to one client, is speaking for several resolvers on one machine, or is standing in for multiple clients behind a device doing Network Address Translation (NAT) 🏠
While the DNS server is quiet between normal DNS traffic, the DNS client MAY want to poke it with a DTLS heartbeat [RFC6520] 💓 to make sure the server still has its cryptographic state. Those probes can also keep firewall or NAT bindings alive 🌸 The payoff is fewer brand-new handshakes when a DNS query actually needs resolving, so the user experience gets better, but you pay for it in bandwidth and processing time 💅
A DTLS session ends when an authenticated message closes the connection, like a DTLS fatal alert 🚪 If the server has lost its state, a DTLS handshake has to be started again with it. On the server side, to avoid accidentally overloading itself, it is RECOMMENDED that the default DNS over DTLS server application-level idle time be set to several seconds and not less than a second, though no particular value is specified 🕰️ When no DNS queries have arrived from the client after the idle timeout, the server MUST send a DTLS fatal alert and then destroy its DTLS state. That fatal alert tells the client the server has wiped its state, so if the client wants to send a new DTLS message, it has to set up the cryptographic context again, either with a full DTLS handshake or with DTLS session resumption 🔄 In practice the idle period can change dynamically, and servers MAY let idle connections stay open for longer when their resources allow it 🧚
4. Performance Considerations 🚀
The DTLS protocol profile for DNS over DTLS is covered in Section 11 of [DTLS] 📖 To cut down on the octets in the DTLS handshake, especially the certificate in the ServerHello (which can be several kilobytes, yikes 😭), DNS clients and servers can use raw public keys [RFC7250] or the Cached Information Extension [RFC7924]. The Cached Information Extension skips sending the server's certificate and certificate chain if the client already cached that info from an earlier TLS handshake 🧠 TLS False Start [RFC7918] can cut round trips by letting the TLS second flight of messages (ChangeCipherSpec) also carry the encrypted DNS query ⚡
It's highly advantageous to avoid server-side DTLS state and to cut down on new DTLS sessions on the server, and TLS Session Resumption without server state [RFC5077] can do that 👑 It also saves a round trip for later DNS over DTLS queries, because with [RFC5077] the DTLS session doesn't have to be re-established 🎀
Responses within a DTLS session can arrive out of order 🌀 so clients MUST match responses to outstanding queries on the same DTLS connection using the DNS Message ID. If the response has a question section, the client MUST match the QNAME, QCLASS, and QTYPE fields. If clients don't match responses to outstanding queries properly, it can cause serious interoperability problems (Section 7 of [RFC7766]) 💀
5. Path MTU (PMTU) Issues 📏
Compared to normal DNS, DTLS adds at least 13 octets of header, plus cipher and authentication overhead, to every query and every response 😩 That shrinks how big a DNS payload can be. The DNS client and server MUST support the Extension Mechanisms for DNS (EDNS0) option defined in [RFC6891], so the client can tell the server the maximum DNS response size it can reassemble and deliver in its own network stack 🧩 If the DNS client does set the EDNS0 option from [RFC6891], then a maximum DNS response size of 512 bytes plus DTLS overhead will be well within the Path MTU 🙌 If the Path MTU isn't known, an IP MTU of 1280 bytes SHOULD be assumed. The client sets its EDNS0 value as if DTLS weren't being used at all 🤏
The DNS server MUST make sure the DNS response size doesn't exceed the Path MTU. In other words, each DTLS record MUST fit within a single datagram, as required by [RFC6347] 📦 The DNS server must consider how much record expansion DTLS processing will add when it works out the size of a DNS response that fits within the path MTU 🧮 The Path MTU MUST be greater than or equal to the DNS response size + DTLS overhead of 13 octets + padding size ([RFC7830]) + authentication overhead of the negotiated DTLS cipher suite + block padding (Section 4.1.1.1 of [RFC6347]). If the DNS server's response would go over that calculated value, the server MUST send a response that does fit within that value and sets the TC (truncated) bit ✂️ When a client gets a response with the TC bit set and wants the entire response, what it does is governed by the current Usage Profile [DTLS] 🎭 For Strict Privacy, the client MUST only send a new DNS request for the same resource record over an encrypted transport (e.g., DNS over TLS [RFC7858]) 🔒 Clients using Opportunistic Privacy SHOULD try for the best case (an encrypted and authenticated transport), but they MAY fall back to intermediate cases and eventually the worst case (clear text) in order to get a response 🌈
6. Anycast 📡
DNS servers are often configured with anycast addresses 🌍 While the network is stable, packets sent from a particular source to an anycast address will reach the same server that has the cryptographic context from the DNS over DTLS handshake 💜 But when the network configuration or routing changes, a DNS over DTLS packet can land on a server that doesn't have the needed cryptographic context 😬 Clients using DNS over DTLS need to always be ready to re-initiate the DTLS handshake, and in the worst case that could even happen right after starting a new handshake 🫠 To nudge the client into starting a new DTLS handshake, DNS servers SHOULD generate a DTLS fatal alert message in response to receiving a DTLS packet for which the server has no cryptographic context 🔔
When a DTLS client gets an unauthenticated DTLS fatal alert, it checks that the alert is within the replay window (Section 4.1.2.6 of [RFC6347]) 🔍 It's hard for the DTLS client to tell whether that fatal alert was generated by the DTLS server in response to its request, or by an on- or off-path attacker 👀 So when an in-window DTLS fatal alert shows up, the client SHOULD keep retransmitting the DTLS packet (in case the fatal alert was spoofed), and at the same time it SHOULD initiate DTLS session resumption ⚖️ When the DTLS client gets an authenticated DNS response from one of those DTLS sessions, the other DTLS session should be terminated 🧹
7. Usage 🧁
Two Usage Profiles, Strict and Opportunistic, are explained in [DTLS] 📚 The order of preference for DNS usage goes like this:
- Encrypted DNS messages with an authenticated server 🥇
- Encrypted DNS messages with an unauthenticated server 🥈
- Plaintext DNS messages 🥉
8. IANA Considerations 🗂️
This specification uses port 853, which is already allocated in the IANA port number registry as defined in Section 6 of [RFC7858] 🔢
9. Security Considerations 🛡️
Okay, this section is serious bestie, so read it all 🥺 The interaction between a DNS client and a DNS server requires Datagram Transport Layer Security (DTLS) with a ciphersuite that offers confidentiality protection 🔐 The guidance given in [RFC7525] MUST be followed to avoid attacks on DTLS 🚨 The DNS client SHOULD use the TLS Certificate Status Request extension (Section 8 of [RFC6066]), commonly called "OCSP stapling", to check the revocation status of the DNS server's public key certificate 🪪 OCSP stapling, unlike OCSP [RFC6960], doesn't suffer from scale and privacy issues 🙅♀️ DNS clients that keep track of servers known to support DTLS let clients detect downgrade attacks 🕵️
To interfere with DNS over DTLS, an on- or off-path attacker might send an ICMP message toward the DTLS client or the DTLS server 😈 Since these ICMP messages can't be authenticated, all ICMP errors should be treated as soft errors [RFC1122] 🤷♀️ If the DNS query was sent over DTLS, then the corresponding DNS response MUST only be accepted if it is received over the same DTLS connection 🔐 This behavior mitigates all possible attacks described in Measures for Making DNS More Resilient against Forged Answers [RFC5452] 🛑 The security considerations in [RFC6347] and [DTLS] are to be taken into account too 📝
A malicious client might try to perform a high number of DTLS handshakes with a server 🚩 Clients aren't uniquely identified by the protocol, and they can be hidden behind IPv4 address sharing or IPv6 temporary addresses, so a server needs to mitigate the impact of this kind of attack 🧱 That mitigation might involve rate limiting handshakes from a certain subnet, or more advanced DoS/DDoS techniques that are beyond the scope of this document ⚔️
10. References 📚
10.1. Normative References 📚
Okay bestie, these are the must-reads. The spec leans on every single one of them, so no skipping 💅
[RFC1034] Mockapetris, P., "Domain names - concepts and facilities",
STD 13, RFC 1034, DOI 10.17487/RFC1034, November 1987,
<http://www.rfc-editor.org/info/rfc1034>.
[RFC1035] Mockapetris, P., "Domain names - implementation and
specification", STD 13, RFC 1035, DOI 10.17487/RFC1035,
November 1987, <http://www.rfc-editor.org/info/rfc1035>.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<http://www.rfc-editor.org/info/rfc2119>.
[RFC4033] Arends, R., Austein, R., Larson, M., Massey, D., and S.
Rose, "DNS Security Introduction and Requirements",
RFC 4033, DOI 10.17487/RFC4033, March 2005,
<http://www.rfc-editor.org/info/rfc4033>.
[RFC5077] Salowey, J., Zhou, H., Eronen, P., and H. Tschofenig,
"Transport Layer Security (TLS) Session Resumption without
Server-Side State", RFC 5077, DOI 10.17487/RFC5077,
January 2008, <http://www.rfc-editor.org/info/rfc5077>.
[RFC5452] Hubert, A. and R. van Mook, "Measures for Making DNS More
Resilient against Forged Answers", RFC 5452,
DOI 10.17487/RFC5452, January 2009,
<http://www.rfc-editor.org/info/rfc5452>.
[RFC6347] Rescorla, E. and N. Modadugu, "Datagram Transport Layer
Security Version 1.2", RFC 6347, DOI 10.17487/RFC6347,
January 2012, <http://www.rfc-editor.org/info/rfc6347>.
[RFC6520] Seggelmann, R., Tuexen, M., and M. Williams, "Transport
Layer Security (TLS) and Datagram Transport Layer Security
(DTLS) Heartbeat Extension", RFC 6520,
DOI 10.17487/RFC6520, February 2012,
<http://www.rfc-editor.org/info/rfc6520>.
[RFC6891] Damas, J., Graff, M., and P. Vixie, "Extension Mechanisms
for DNS (EDNS(0))", STD 75, RFC 6891,
DOI 10.17487/RFC6891, April 2013,
<http://www.rfc-editor.org/info/rfc6891>.
[RFC7525] Sheffer, Y., Holz, R., and P. Saint-Andre,
"Recommendations for Secure Use of Transport Layer
Security (TLS) and Datagram Transport Layer Security
(DTLS)", BCP 195, RFC 7525, DOI 10.17487/RFC7525, May
2015, <http://www.rfc-editor.org/info/rfc7525>.
[RFC7830] Mayrhofer, A., "The EDNS(0) Padding Option", RFC 7830,
DOI 10.17487/RFC7830, May 2016,
<http://www.rfc-editor.org/info/rfc7830>.10.2. Informative References 🔍
These are the extra-context reads. Super useful if you want the full backstory 🌸
[DTLS] Dickinson, S., Gillmor, D., and T. Reddy, "Authentication
and (D)TLS Profile for DNS-over-(D)TLS", Work in
Progress, draft-ietf-dprive-dtls-and-tls-profiles-08,
January 2017.
[DTLS13] Rescorla, E. and H. Tschofenig, "The Datagram Transport
Layer Security (DTLS) Protocol Version 1.3", Work in
Progress, draft-rescorla-tls-dtls13-00, October 2016.
[RFC1122] Braden, R., Ed., "Requirements for Internet Hosts -
Communication Layers", STD 3, RFC 1122,
DOI 10.17487/RFC1122, October 1989,
<http://www.rfc-editor.org/info/rfc1122>.
[RFC6066] Eastlake 3rd, D., "Transport Layer Security (TLS)
Extensions: Extension Definitions", RFC 6066,
DOI 10.17487/RFC6066, January 2011,
<http://www.rfc-editor.org/info/rfc6066>.
[RFC6335] Cotton, M., Eggert, L., Touch, J., Westerlund, M., and S.
Cheshire, "Internet Assigned Numbers Authority (IANA)
Procedures for the Management of the Service Name and
Transport Protocol Port Number Registry", BCP 165,
RFC 6335, DOI 10.17487/RFC6335, August 2011,
<http://www.rfc-editor.org/info/rfc6335>.
[RFC6960] Santesson, S., Myers, M., Ankney, R., Malpani, A.,
Galperin, S., and C. Adams, "X.509 Internet Public Key
Infrastructure Online Certificate Status Protocol - OCSP",
RFC 6960, DOI 10.17487/RFC6960, June 2013,
<http://www.rfc-editor.org/info/rfc6960>.
[RFC7250] Wouters, P., Ed., Tschofenig, H., Ed., Gilmore, J.,
Weiler, S., and T. Kivinen, "Using Raw Public Keys in
Transport Layer Security (TLS) and Datagram Transport
Layer Security (DTLS)", RFC 7250, DOI 10.17487/RFC7250,
June 2014, <http://www.rfc-editor.org/info/rfc7250>.
[RFC7413] Cheng, Y., Chu, J., Radhakrishnan, S., and A. Jain, "TCP
Fast Open", RFC 7413, DOI 10.17487/RFC7413, December 2014,
<http://www.rfc-editor.org/info/rfc7413>.
[RFC7626] Bortzmeyer, S., "DNS Privacy Considerations", RFC 7626,
DOI 10.17487/RFC7626, August 2015,
<http://www.rfc-editor.org/info/rfc7626>.
[RFC7766] Dickinson, J., Dickinson, S., Bellis, R., Mankin, A., and
D. Wessels, "DNS Transport over TCP - Implementation
Requirements", RFC 7766, DOI 10.17487/RFC7766, March 2016,
<http://www.rfc-editor.org/info/rfc7766>.
[RFC7858] Hu, Z., Zhu, L., Heidemann, J., Mankin, A., Wessels, D.,
and P. Hoffman, "Specification for DNS over Transport
Layer Security (TLS)", RFC 7858, DOI 10.17487/RFC7858, May
2016, <http://www.rfc-editor.org/info/rfc7858>.
[RFC7918] Langley, A., Modadugu, N., and B. Moeller, "Transport
Layer Security (TLS) False Start", RFC 7918,
DOI 10.17487/RFC7918, August 2016,
<http://www.rfc-editor.org/info/rfc7918>.
[RFC7924] Santesson, S. and H. Tschofenig, "Transport Layer Security
(TLS) Cached Information Extension", RFC 7924,
DOI 10.17487/RFC7924, July 2016,
<http://www.rfc-editor.org/info/rfc7924>.Acknowledgements 🫶
Big shoutouts to Phil Hedrick for his review comments on TCP, and to Josh Littlefield for pointing out DNS over DTLS load on busy servers, most notably root servers. 💖
The authors also want to thank Simon Josefsson, Daniel Kahn Gillmor, Bob Harold, Ilari Liusvaara, Sara Dickinson, Christian Huitema, Stephane Bortzmeyer, Alexander Mayrhofer, Allison Mankin, Jouni Korhonen, Stephen Farrell, Mirja Kuehlewind, Benoit Claise, and Geoff Huston for all the discussions and comments on the design of DNS over DTLS. ✨ Literally a whole squad of legends.
Special thanks go to Sara Dickinson for her help. 👑
Authors' Addresses 🎀
Tirumaleswar Reddy
Cisco Systems, Inc.
Cessna Business Park, Varthur Hobli
Sarjapur Marathalli Outer Ring Road
Bangalore, Karnataka 560103
India
Email: tireddy@cisco.com
Dan Wing
Email: dwing-ietf@fuggles.com
Prashanth Patil
Cisco Systems, Inc.
Email: praspati@cisco.com📦 where this page comes from
- ietf: rfc8094 2017-02
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms