RFC 8914
Extended DNS Errors
Extended DNS Errors ✨
Internet Engineering Task Force (IETF) 🎀
Author: W. Kumari (Google), E. Hunt (ISC), R. Arends (ICANN), W. Hardaker (USC/ISI), D. Lawrence (Salesforce) 💖
Category: Standards Track 🦋
Date: October 2020 📅
RFC number: 8914 (ISSN 2070-1721) ✨
Obsoletes / Updates: This document doesn't say it obsoletes or updates anything, so I'm not making that up 🙈
Abstract 🌸
okay so this doc is all about giving DNS errors a little extra context, bestie 💅 Right now, a DNS server can only say a few really vague things when something goes wrong, so apps end up guessing what happened 😭 This spec defines an extensible way to attach more info about the cause of errors. It was mainly made to make SERVFAIL way more useful, especially for DNS and DNSSEC failures, but the Extended DNS Errors option can show up on any response type 🫶 And the big thing: EDE info does NOT change how RCODEs get processed. It's just extra info, no cap 🧚
Status of This Memo 🍓
This is an Internet Standards Track document 🔥
This doc comes from the Internet Engineering Task Force (IETF), and it reflects the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). If you want more info about Internet Standards, check Section 2 of RFC 7841 ✨
For the current status, any errata, and how to give feedback, go to https://www.rfc-editor.org/info/rfc8914 🌈
Copyright Notice 🦋
Copyright (c) 2020 IETF Trust and the persons identified as the document authors. All rights reserved. 💜
This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they stand on the publication date. Please read these carefully, because they explain your rights and restrictions. Code Components pulled out of this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty as described in the Simplified BSD License 🎀
Table of Contents 🧚
1. Introduction and Background
1.1. Requirements Notation
2. Extended DNS Error EDNS0 Option Format
3. Extended DNS Error Processing
4. Defined Extended DNS Errors
4.1. Extended DNS Error Code 0 - Other
4.2. Extended DNS Error Code 1 - Unsupported DNSKEY Algorithm
4.3. Extended DNS Error Code 2 - Unsupported DS Digest Type
4.4. Extended DNS Error Code 3 - Stale Answer
4.5. Extended DNS Error Code 4 - Forged Answer
4.6. Extended DNS Error Code 5 - DNSSEC Indeterminate
4.7. Extended DNS Error Code 6 - DNSSEC Bogus
4.8. Extended DNS Error Code 7 - Signature Expired
4.9. Extended DNS Error Code 8 - Signature Not Yet Valid
4.10. Extended DNS Error Code 9 - DNSKEY Missing
4.11. Extended DNS Error Code 10 - RRSIGs Missing
4.12. Extended DNS Error Code 11 - No Zone Key Bit Set
4.13. Extended DNS Error Code 12 - NSEC Missing
4.14. Extended DNS Error Code 13 - Cached Error
4.15. Extended DNS Error Code 14 - Not Ready
4.16. Extended DNS Error Code 15 - Blocked
4.17. Extended DNS Error Code 16 - Censored
4.18. Extended DNS Error Code 17 - Filtered
4.19. Extended DNS Error Code 18 - Prohibited
4.20. Extended DNS Error Code 19 - Stale NXDOMAIN Answer
4.21. Extended DNS Error Code 20 - Not Authoritative
4.22. Extended DNS Error Code 21 - Not Supported
4.23. Extended DNS Error Code 22 - No Reachable Authority
4.24. Extended DNS Error Code 23 - Network Error
4.25. Extended DNS Error Code 24 - Invalid Data
5. IANA Considerations
5.1. A New Extended DNS Error Code EDNS Option
5.2. New Registry for Extended DNS Error Codes
6. Security Considerations
7. References
7.1. Normative References
7.2. Informative References
Acknowledgements
Authors' Addresses1. Introduction and Background ✨
There are a bunch of reasons a DNS query can fail 😩 Some are temporary, some are permanent 🙈 Some can be fixed by asking a different server, and some are better off just stopping resolution. The problem is that the error signals a DNS server can send back are super limited and not very expressive. So apps and resolvers are always having to "guess" what went wrong 💀 For example, was an answer marked REFUSED because of a lame delegation, or because the nameserver is still starting up and loading zones? Is a SERVFAIL a DNSSEC validation issue, or is the nameserver dealing with some other failure? And what error message should the user see, or what should get logged, in those situations? 🤔
Errors caused by DNSSEC validation issues are a perfect example of something that would benefit from more info 🔥 When a stub resolver asks for a name that is DNSSEC bogus [RFC8499] (using a validating resolver), the stub resolver only gets a SERVFAIL back 😭 The SERVFAIL Response Code (RCODE) gets used to signal lots of different DNS errors, so the stub resolver's only move is to ask the next configured DNS resolver 💅 That gives you one of two outcomes: either the next resolver validates too and SERVFAIL comes back again, or the next resolver isn't a validating resolver and the user gets a potentially harmful result 😬 With an Extended DNS Error (EDE) option in the response message, the resolver can give a more descriptive reason for any failures, or add more context to a message with a NOERROR RCODE 🦋
This document specifies a mechanism to extend DNS errors so they can carry extra info about the cause of an error 🎀 The Extended DNS Error codes defined here can be used by any system that sends DNS queries and receives a response with an EDE option 💜 Different codes are useful in different situations, so different systems (stub resolvers, recursive resolvers, and authoritative resolvers) might receive and use them differently 🧚
1.1. Requirements Notation 🌈
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here 💅
2. Extended DNS Error EDNS0 Option Format 🎀
This doc uses an Extended Mechanism for DNS (EDNS0) [RFC6891] option to carry Extended DNS Error (EDE) info in DNS messages 💖 The option is laid out like this 👇
1 1 1 1 1 1
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
0: | OPTION-CODE |
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
2: | OPTION-LENGTH |
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
4: | INFO-CODE |
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
6: / EXTRA-TEXT ... /
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+Field details, bestie 🫶
- OPTION-CODE: 2 octets / 16 bits (defined in [RFC6891]). It contains the value
15for EDE 🧚 - OPTION-LENGTH: 2 octets / 16 bits (defined in [RFC6891]). It holds the length of the payload (everything after OPTION-LENGTH) in octets, and it should be 2 plus the length of the EXTRA-TEXT field (which can be a zero-length string) 🌸
- INFO-CODE: 16 bits, and this is the main thing this doc contributes ✨ The 16-bit value is encoded in network most significant bit (MSB) byte order, and it gives extra context for the RESPONSE-CODE of the DNS message 🔥 The INFO-CODE works as an index into the "Extended DNS Errors" registry, which is defined and created in Section 5.2 💜
- EXTRA-TEXT: a variable-length, UTF-8-encoded [RFC5198] text field that can hold extra text info 📝 It's meant for humans to read, not for automated parsing 🙈 EDE text MAY be null terminated but MUST NOT be assumed to be, so the length MUST be derived from the OPTION-LENGTH field 💅 EXTRA-TEXT can be zero octets long, which just means there's no EXTRA-TEXT included 🦋 Also, be careful not to put private info in EXTRA-TEXT that an observer wouldn't otherwise have access to, like account numbers 😬
The Extended DNS Error (EDE) option can be included in any response (SERVFAIL, NXDOMAIN, REFUSED, even NOERROR, etc.) to a query that includes an OPT pseudo-RR [RFC6891] 🌈 This doc includes a set of initial codepoints, but it's extensible through the IANA registry defined and created in Section 5.2 🎀
3. Extended DNS Error Processing 🧚
When the response grows beyond the requestor's UDP payload size [RFC6891], servers SHOULD truncate messages by dropping EDE options before dropping other data from packets 💖 Implementations SHOULD set the truncation bit when dropping EDE options 🙈 Since long EXTRA-TEXT fields can trigger truncation (which is undesirable given how supplemental EDE is), implementers and operators creating EDE options SHOULD avoid lengthy EXTRA-TEXT contents 🫶
When a resolver or forwarder receives an EDE option, whether or not (and how) it passes EDE info along to the original client is implementation dependent 🌸 Implementations MAY choose not to forward info, or they MAY choose to create new EDE option(s) that convey the info encoded in the received EDE ✨ When they do that, the source of the error SHOULD be attributed in the EXTRA-TEXT field, since an EDNS0 option received by the original client will look like it came from the resolver or forwarder sending it 👀
This document doesn't allow or prohibit any particular extended error codes and info from being matched with any particular RCODEs 🦋 Some combos of extended error codes and RCODEs might seem nonsensical (like resolver-specific extended error codes showing up in responses from authoritative servers), so systems interpreting extended error codes MUST NOT assume a combination will make sense 💅 Receivers MUST be able to accept EDE codes and EXTRA-TEXT in all messages, including ones with a NOERROR RCODE, but they need not act on them 🎀 Applications MUST continue to follow requirements from applicable specifications on how to process RCODEs, no matter what EDE values also get received 🔥 Senders MAY include more than one EDE option, and receivers MUST be able to accept (but not necessarily process or act on) multiple EDE options in a DNS message 🧚
This is part 1 of 3, so more is coming, bestie 💖 Stay tuned for Section 4 and everything after it 🌈
4. Defined Extended DNS Errors ✨
okay bestie, this is where the actual EDE codes live 🎀 This document defines some starter codes. The whole mechanism is built to be extensible, so more codepoints can be registered in the "Extended DNS Errors" registry (Section 5.2). The INFO-CODE from the EDE EDNS option is used as an index into the "Extended DNS Error" IANA registry, and the initial values are in the subsections below 💅
4.1. Extended DNS Error Code 0 - Other
this error falls into a category that doesn't match any known extended error code 🌸 Implementations SHOULD include an EXTRA-TEXT value to add more info to this code 💖
4.2. Extended DNS Error Code 1 - Unsupported DNSKEY Algorithm
the resolver tried to do DNSSEC validation, but a DNSKEY RRset only had unsupported DNSSEC algorithms 🙈
4.3. Extended DNS Error Code 2 - Unsupported DS Digest Type
the resolver tried to do DNSSEC validation, but a DS RRset only had unsupported Digest Types 🍓
4.4. Extended DNS Error Code 3 - Stale Answer
the resolver couldn't resolve the answer within its time limits, so it went with previously cached data instead of throwing an error ✨ this usually happens when there are problems talking to an authoritative server, maybe because of a denial of service (DoS) attack against another network. (See also Code 19.) 😭
4.5. Extended DNS Error Code 4 - Forged Answer
for policy reasons (legal obligation or malware filtering, for instance), an answer was forged 🕵️ note that this should be used when an answer is still provided, not when failure codes are returned instead. See Blocked (15), Censored (16), and Filtered (17) for use when returning other response codes 🦋
4.6. Extended DNS Error Code 5 - DNSSEC Indeterminate
the resolver tried to do DNSSEC validation, but validation ended in the Indeterminate state [RFC4035] 🧚
4.7. Extended DNS Error Code 6 - DNSSEC Bogus
the resolver tried to do DNSSEC validation, but validation ended in the Bogus state 💀
4.8. Extended DNS Error Code 7 - Signature Expired
the resolver tried to do DNSSEC validation, but no signatures are currently valid and some (often all) of them are expired 🥀
4.9. Extended DNS Error Code 8 - Signature Not Yet Valid
the resolver tried to do DNSSEC validation, but no signatures are currently valid and at least some of them aren't valid yet ⏳
4.10. Extended DNS Error Code 9 - DNSKEY Missing
a DS record existed at the parent, but no supported matching DNSKEY record could be found for the child 🔍
4.11. Extended DNS Error Code 10 - RRSIGs Missing
the resolver tried to do DNSSEC validation, but no RRSIGs could be found for at least one RRset where RRSIGs were expected 🫠
4.12. Extended DNS Error Code 11 - No Zone Key Bit Set
the resolver tried to do DNSSEC validation, but no Zone Key Bit was set in a DNSKEY 🔑
4.13. Extended DNS Error Code 12 - NSEC Missing
the resolver tried to do DNSSEC validation, but the requested data was missing and no covering NSEC or NSEC3 was provided 🫥
4.14. Extended DNS Error Code 13 - Cached Error
the resolver is returning the SERVFAIL RCODE straight from its cache 🗃️
4.15. Extended DNS Error Code 14 - Not Ready
the server can't answer the query because it wasn't fully functional when the query came in 🛠️
4.16. Extended DNS Error Code 15 - Blocked
the server can't respond to the request because the domain is on a blocklist, due to an internal security policy set by the operator of the server resolving or forwarding the query 🚫
4.17. Extended DNS Error Code 16 - Censored
the server can't respond to the request because the domain is on a blocklist, due to an external requirement imposed by someone other than the operator of the server resolving or forwarding the query. Note that how the imposed policy is applied doesn't matter (in-band DNS filtering, court order, etc.) ⚖️
4.18. Extended DNS Error Code 17 - Filtered
the server can't respond to the request because the domain is on a blocklist that the client asked for. Functionally, this basically means "you requested that we filter domains like this one." 🧹
4.19. Extended DNS Error Code 18 - Prohibited
an authoritative server or recursive resolver that gets a query from an "unauthorized" client can tag its REFUSED message with this code 🙅♀️ examples of "unauthorized" clients are recursive queries from IP addresses outside the network, blocklisted IP addresses, local policy, etc.
4.20. Extended DNS Error Code 19 - Stale NXDOMAIN Answer
the resolver couldn't resolve an answer within its configured time limits, so it answered with a previously cached NXDOMAIN answer instead of an error 🥲 this may be caused, for example, by problems talking to an authoritative server, possibly because of a denial of service (DoS) attack against another network. (See also Code 3.)
4.21. Extended DNS Error Code 20 - Not Authoritative
an authoritative server that gets a query with the Recursion Desired (RD) bit clear, or that isn't configured for recursion for a domain it isn't authoritative for, SHOULD include this EDE code in the REFUSED response. A resolver that receives a query with the RD bit clear SHOULD include this EDE code in the REFUSED response 🙋♀️
4.22. Extended DNS Error Code 21 - Not Supported
the requested operation or query isn't supported 🚧
4.23. Extended DNS Error Code 22 - No Reachable Authority
the resolver couldn't reach any of the authoritative name servers (or they might have refused to reply) 📵
4.24. Extended DNS Error Code 23 - Network Error
an unrecoverable error happened while communicating with another server 💥
4.25. Extended DNS Error Code 24 - Invalid Data
the authoritative server can't answer with data for a zone it's otherwise configured to support. Examples of this include its most recent zone being too old or having expired 🍂
5. IANA Considerations 🎀
5.1. A New Extended DNS Error Code EDNS Option
this document defines a new EDNS(0) option, called "Extended DNS Error", with the assigned value of 15 from the "DNS EDNS0 Option Codes (OPT)" registry 🌷
+=======+====================+==========+===========+
| Value | Name | Status | Reference |
+=======+====================+==========+===========+
| 15 | Extended DNS Error | Standard | RFC 8914 |
+-------+--------------------+----------+-----------+
Table 15.2. New Registry for Extended DNS Error Codes
IANA has created and will maintain a new registry called "Extended DNS Error Codes" on the "Domain Name System (DNS) Parameters" web page, set up as follows 📋
+===============+=========================+
| Range | Registration Procedures |
+===============+=========================+
| 0 - 49151 | First Come First Served |
+---------------+-------------------------+
| 49152 - 65535 | Private Use |
+---------------+-------------------------+
Table 2The "Extended DNS Error Codes" registry is a table with three columns: INFO-CODE, Purpose, and Reference. The initial content is below 🧾
+=============+==============================+===============+
| INFO-CODE | Purpose | Reference |
+=============+==============================+===============+
| 0 | Other Error | Section 4.1 |
+-------------+------------------------------+---------------+
| 1 | Unsupported DNSKEY Algorithm | Section 4.2 |
+-------------+------------------------------+---------------+
| 2 | Unsupported DS Digest Type | Section 4.3 |
+-------------+------------------------------+---------------+
| 3 | Stale Answer | Section 4.4 |
| | | and [RFC8767] |
+-------------+------------------------------+---------------+
| 4 | Forged Answer | Section 4.5 |
+-------------+------------------------------+---------------+
| 5 | DNSSEC Indeterminate | Section 4.6 |
+-------------+------------------------------+---------------+
| 6 | DNSSEC Bogus | Section 4.7 |
+-------------+------------------------------+---------------+
| 7 | Signature Expired | Section 4.8 |
+-------------+------------------------------+---------------+
| 8 | Signature Not Yet Valid | Section 4.9 |
+-------------+------------------------------+---------------+
| 9 | DNSKEY Missing | Section 4.10 |
+-------------+------------------------------+---------------+
| 10 | RRSIGs Missing | Section 4.11 |
+-------------+------------------------------+---------------+
| 11 | No Zone Key Bit Set | Section 4.12 |
+-------------+------------------------------+---------------+
| 12 | NSEC Missing | Section 4.13 |
+-------------+------------------------------+---------------+
| 13 | Cached Error | Section 4.14 |
+-------------+------------------------------+---------------+
| 14 | Not Ready | Section 4.15 |
+-------------+------------------------------+---------------+
| 15 | Blocked | Section 4.16 |
+-------------+------------------------------+---------------+
| 16 | Censored | Section 4.17 |
+-------------+------------------------------+---------------+
| 17 | Filtered | Section 4.18 |
+-------------+------------------------------+---------------+
| 18 | Prohibited | Section 4.19 |
+-------------+------------------------------+---------------+
| 19 | Stale NXDomain Answer | Section 4.20 |
+-------------+------------------------------+---------------+
| 20 | Not Authoritative | Section 4.21 |
+-------------+------------------------------+---------------+
| 21 | Not Supported | Section 4.22 |
+-------------+------------------------------+---------------+
| 22 | No Reachable Authority | Section 4.23 |
+-------------+------------------------------+---------------+
| 23 | Network Error | Section 4.24 |
+-------------+------------------------------+---------------+
| 24 | Invalid Data | Section 4.25 |
+-------------+------------------------------+---------------+
| 25-49151 | Unassigned | |
+-------------+------------------------------+---------------+
| 49152-65535 | Reserved for Private Use | Section 5.2 |
+-------------+------------------------------+---------------+
Table 36. Security Considerations 🔐
Okay bestie, real talk: DNSSEC is getting deployed, but a bunch of clients (~11% according to [GeoffValidation]) get a SERVFAIL from a validating resolver because of a DNSSEC validation issue, and then they just ask the next resolver on their list. That one might not validate at all, so they miss out on the protections DNSSEC is supposed to give them. Not ideal, not cute 😭
EDE information is unauthenticated unless it's protected by a secured DNS transaction, like [RFC2845], [RFC2931], [RFC8094], or [RFC8484]. An attacker (a man in the middle (MITM) or a malicious recursive server, for example) could slip an extended error response into untrusted data. Ideally though, clients and resolvers wouldn't trust unauthenticated info in the first place 🙈 So EDE content should be treated only as diagnostic information, and it MUST NOT alter DNS protocol processing. Until every DNS answer is authenticated with DNSSEC or the other mechanisms mentioned above, there are some trade-offs. For example, an attacker who can insert the DNSSEC Bogus Extended Error into a DNS message could just reply with a fictitious address (A or AAAA) record instead. And DNS RCODEs have no authentication either, so they can be manipulated just as easily 💀
By design, EDE can expose extra information during DNS resolution, and that might leak stuff. The Prohibited EDE code (18) is the classic example, since it may leak the fact that a name is on a blocklist 👀
7. References 📚
7.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
[RFC4035] Arends, R., Austein, R., Larson, M., Massey, D., and S.
Rose, "Protocol Modifications for the DNS Security
Extensions", RFC 4035, DOI 10.17487/RFC4035, March 2005,
<https://www.rfc-editor.org/info/rfc4035>.
[RFC5198] Klensin, J. and M. Padlipsky, "Unicode Format for Network
Interchange", RFC 5198, DOI 10.17487/RFC5198, March 2008,
<https://www.rfc-editor.org/info/rfc5198>.
[RFC6891] Damas, J., Graff, M., and P. Vixie, "Extension Mechanisms
for DNS (EDNS(0))", STD 75, RFC 6891,
DOI 10.17487/RFC6891, April 2013,
<https://www.rfc-editor.org/info/rfc6891>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>.
[RFC8499] Hoffman, P., Sullivan, A., and K. Fujiwara, "DNS
Terminology", BCP 219, RFC 8499, DOI 10.17487/RFC8499,
January 2019, <https://www.rfc-editor.org/info/rfc8499>.
[RFC8767] Lawrence, D., Kumari, W., and P. Sood, "Serving Stale Data
to Improve DNS Resiliency", RFC 8767,
DOI 10.17487/RFC8767, March 2020,
<https://www.rfc-editor.org/info/rfc8767>.7.2. Informative References
[GeoffValidation]
Huston, G., "A quick review of DNSSEC Validation in
today's Internet", June 2016, <http://www.potaroo.net/
presentations/2016-06-27-dnssec.pdf>.
[RFC2845] Vixie, P., Gudmundsson, O., Eastlake 3rd, D., and B.
Wellington, "Secret Key Transaction Authentication for DNS
(TSIG)", RFC 2845, DOI 10.17487/RFC2845, May 2000,
<https://www.rfc-editor.org/info/rfc2845>.
[RFC2931] Eastlake 3rd, D., "DNS Request and Transaction Signatures
( SIG(0)s )", RFC 2931, DOI 10.17487/RFC2931, September
2000, <https://www.rfc-editor.org/info/rfc2931>.
[RFC8094] Reddy, T., Wing, D., and P. Patil, "DNS over Datagram
Transport Layer Security (DTLS)", RFC 8094,
DOI 10.17487/RFC8094, February 2017,
<https://www.rfc-editor.org/info/rfc8094>.
[RFC8484] Hoffman, P. and P. McManus, "DNS Queries over HTTPS
(DoH)", RFC 8484, DOI 10.17487/RFC8484, October 2018,
<https://www.rfc-editor.org/info/rfc8484>.Acknowledgements 🫶
The authors wish to thank Joe Abley, Mark Andrews, Tim April, Vittorio Bertola, Stephane Bortzmeyer, Vladimir Cunat, Ralph Dolmans, Peter DeVries, Peter van Dijk, Mats Dufberg, Donald Eastlake, Bob Harold, Paul Hoffman, Geoff Huston, Shane Kerr, Edward Lewis, Carlos M. Martinez, George Michelson, Eric Orth, Michael Sheldon, Puneet Sood, Petr Spacek, Ondrej Sury, John Todd, Loganaden Velvindron, and Paul Vixie. They also vaguely remember discussing this with a number of people over the years but have forgotten who all of them were. Apologies if we forgot to acknowledge your contributions 🙏
One author also wants to thank the band Infected Mushroom for providing a good background soundtrack. Another author would like to thank the band Mushroom Infectors. This was funny at the time they wrote it, but they cannot remember why... 🍄💀
Authors' Addresses 🖊️
Warren Kumari
Google
1600 Amphitheatre Parkway
Mountain View, CA 94043
United States of America
Email: warren@kumari.net
Evan Hunt
ISC
950 Charter St
Redwood City, CA 94063
United States of America
Email: each@isc.org
Roy Arends
ICANN
Email: roy.arends@icann.org
Wes Hardaker
USC/ISI
P.O. Box 382
Davis, CA 95617
United States of America
Email: ietf@hardakers.net
David C Lawrence
Salesforce
415 Mission St
San Francisco, CA 94105
United States of America
Email: tale@dd.org📦 where this page comes from
- ietf: rfc8914 2020-10
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms