RFC 9461
Service Binding Mapping for DNS Servers
Service Binding Mapping for DNS Servers 🎀
Okay bestie, let's get into RFC 9461! 💖 It's a Standards Track doc from the IETF, the crew that writes the Internet's rulebook 👑. It was written by B. Schwartz at Meta Platforms, Inc., and it's dated November 2023 (ISSN 2070-1721 🧚). It doesn't list anything it obsoletes or updates, so it's not replacing or changing any other RFCs 🦋.
Abstract ✨
So the SVCB DNS record type is basically a bundle of endpoint info 🎁 for connecting to a named service. DNS can be one of those services when the server is identified by a domain name 🌸. This doc gives the SVCB mapping for named DNS servers, so they can tell clients they support encrypted transport protocols 🔐.
Status of This Memo 📜
This is an Internet Standards Track document 💜.
It's a product of the Internet Engineering Task Force (IETF), and it represents the consensus of the IETF community ✨. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG) 🔥. If you want more on Internet Standards, check Section 2 of RFC 7841 🍓.
For the current status, any errata, and how to send feedback, head to https://www.rfc-editor.org/info/rfc9461 🌈.
Copyright Notice 💅
Copyright (c) 2023 IETF Trust and the persons identified as the document authors. All rights reserved 🫶.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they're in effect on the date of publication. Please read them carefully, because they explain your rights and restrictions for this document 📖. Code Components extracted from this document must include Revised BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they're provided without warranty as described in the Revised BSD License 🦋.
Table of Contents 🗺️
1. Introduction
2. Conventions and Definitions
3. Identities and Names
3.1. Special Case: Non-default Ports
4. Applicable Existing SvcParamKeys
4.1. "alpn"
4.2. "port"
4.3. Other Applicable SvcParamKeys
5. New SvcParamKey: "dohpath"
6. Limitations
7. Examples
8. Security Considerations
8.1. Adversary on the Query Path
8.1.1. Downgrade Attacks
8.1.2. Redirection Attacks
8.2. Adversary on the Transport Path
9. IANA Considerations
10. References
10.1. Normative References
10.2. Informative References
Appendix A. Mapping Summary
Acknowledgments
Author's Address1. Introduction 💖
The SVCB resource record (RR) type [SVCB] gives clients info about how to reach alternative endpoints for a service ✨. Those endpoints might offer better performance or privacy properties 🔐. A service is identified by a "scheme" that tells you the service type, a hostname, and optionally other stuff like a port number 🎀. A DNS server is often identified only by its IP address (for example, in DHCP), but in some contexts it can also be identified by a hostname (like "NS" records or manual resolver configuration), and sometimes by a non-default port number too 🧚.
Every service type needs a mapping document (Section 2.4.3 of [SVCB]). That tells a client for that service how to read the contents of the SVCB SvcParams 📜. This document provides the mapping for the "dns" service type, so DNS servers can offer alternative endpoints and transports 🍓. That includes encrypted transports like DNS over TLS (DoT) [RFC7858], DNS over HTTPS (DoH) [RFC8484], and DNS over QUIC (DoQ) [RFC9250] 🌸.
The SVCB mapping in this document is meant to be a general-purpose baseline 🦋. Later specs will adapt this mechanism as needed to support specific setups, like communication between stub resolvers and recursive resolvers 👑.
2. Conventions and Definitions 📖
Okay, so here's the key-words squad 💅. The words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" are the BCP 14 [RFC2119] [RFC8174] words in this document 🔥. They only count as BCP 14 key words when they show up in all capitals, exactly like shown here 💖.
3. Identities and Names 🎀
SVCB record names (a.k.a. QNAMEs) for DNS services are built with Port Prefix Naming (Section 2.3 of [SVCB]), using a scheme of "dns" 🧚. For example, SVCB records for a DNS service identified as dns1.example.com get queried at _dns.dns1.example.com 🌈.
Sometimes the name you use to look up these DNS records isn't the same as the server identity used to authenticate the secure transport 👀. To keep those apart, this document uses these terms:
- Binding authority: The service name (Section 1.3 of [SVCB]) and optional port number that go into Port Prefix Naming as input.
- Authentication name: The name used for secure transport authentication. This MUST be a DNS hostname or a literal IP address. Unless otherwise specified, this is the service name from the binding authority 🫶.
3.1. Special Case: Non-default Ports 🦋
Normally a DNS service is identified by an IP address or a domain name 💜. When you connect to the service using unencrypted DNS over UDP or TCP, clients use the default port number for DNS, which is 53 🍓. But in rare cases, a DNS service might be identified by both a name and a port number 🙈. For example, the DNS URI scheme [DNSURI] optionally includes an authority, made of a host and a port number (with a default of 53). DNS URIs usually leave out the authority or specify an IP address, but a hostname and a non-default port number are allowed 🌸.
When the binding authority specifies a non-default port number, Port Prefix Naming puts that port number in an extra prefix on the name ✨. For example, if the binding authority is dns1.example.com:9953, the client would query for SVCB records at _9953._dns.dns1.example.com 🎀. If two DNS services running on different port numbers behave differently, this setup lets them keep that distinction when they specify alternative endpoints 💅.
4. Applicable Existing SvcParamKeys 🔐
4.1. "alpn" 🌸
This key tells you the set of supported protocols (Section 7.1 of [SVCB]) 💖. There's no default protocol, so the "no-default-alpn" key doesn't apply here 🙈. If the "alpn" SvcParamKey is absent, the client MUST treat the SVCB record as "incompatible" (as defined in Section 8 of [SVCB]), unless some other recognized SvcParam indicates a supported protocol 🚫.
If the protocol set contains any HTTP versions (like "h2" or "h3"), then the record indicates support for DoH, and the "dohpath" key MUST be present (Section 5) ✨. All keys specified for use with the HTTPS record are also permissible, and they apply to the resulting HTTP connection 🦋.
If the protocol set contains protocols with different default ports and no "port" key is specified, then the protocols are contacted separately on their default ports 🧚. Note that in this configuration, Application-Layer Protocol Negotiation (ALPN) negotiation does not defend against cross-protocol downgrade attacks 💀.
4.2. "port" 🍓
This key indicates the target port for the connection (Section 7.2 of [SVCB]) 🎀. If it's omitted, the client SHALL use the default port number for each transport protocol: 853 for DoT and DoQ, and 443 for DoH 👑.
This key is automatically mandatory for this binding 🔥. That means a client that doesn't respect the "port" key MUST ignore any SVCB record that contains this key. (See Section 8 of [SVCB] for the definition of "automatically mandatory".) 📖
⚠️ Heads up: supporting the "port" key can be unsafe 😭. If the client has implicit elevated access to some network service (like a local service that's unreachable from remote parties), and that service uses a TCP-based protocol other than TLS, a hostile DNS server might be able to manipulate it 💀. It could do that by making the client send a specially crafted TLS Server Name Indication (SNI) or session ticket that gets misparsed as a command or exploit 🙈. To avoid these attacks, clients SHOULD NOT support the "port" key unless one of the following conditions applies:
- The client is being used with a DNS server that it trusts not to attempt this attack.
- The client is being used in a context where implicit elevated access cannot apply.
- The client restricts the set of allowed TCP port values to exclude any ports where a confusion attack is likely to be possible (e.g., the "bad ports" list from Section 2.9 ("Port blocking") of [FETCH]).
4.3. Other Applicable SvcParamKeys 🧚
These SvcParamKeys from [SVCB] apply to the "dns" scheme without any modification 💜:
mandatoryipv4hintipv6hint
Future SvcParamKeys might also be applicable 🌈.
5. New SvcParamKey: "dohpath" 💖
"dohpath" is a single-valued SvcParamKey 🎀. Its value (in both presentation format and wire format) MUST be a URI Template in relative form ([RFC6570], Section 1.1), encoded in UTF-8 [RFC3629] ✨. If the "alpn" SvcParam indicates support for HTTP, "dohpath" MUST be present 🔥. The URI Template MUST contain a "dns" variable, and it MUST be chosen so that the result after DoH URI Template expansion (Section 6 of [RFC8484]) is always a valid and functional ":path" value ([RFC9113], Section 8.3.1) 👑.
When using this SVCB record, the client MUST send any DoH requests to the HTTP origin identified by the "https" scheme, the authentication name, and the port from the "port" SvcParam (if present) 🦋. HTTP requests MUST be directed to the resource that results from DoH URI Template expansion of the "dohpath" value 🍓.
Clients SHOULD NOT query for any HTTPS RRs when using "dohpath" 🙈. Instead, the SvcParams and address records associated with this SVCB record SHOULD be used for the HTTPS connection, with the same semantics as an HTTPS RR 🌸. However, for consistency, service operators SHOULD publish an equivalent HTTPS RR, especially if clients might learn about this DoH service through a different channel ✨.
6. Limitations 💅
This document is only about the DNS transport 🎀. It doesn't affect or inform how DNS messages are built or interpreted 🧚. For example, nothing here says whether the service is meant to be a recursive or authoritative DNS server 🔐. Clients need to figure out the intended use of services from their context 💖.
Not every feature of this spec is going to be applicable or effective in every context 🫶:
- If the authentication name is received over an insecure channel (e.g., a glue NS record), this specification cannot prevent the client from connecting to an attacker 😭.
- Different transports might prove popular for different purposes (e.g., querying a recursive resolver vs. an authoritative server) 🦋. Implementors are not obligated to implement all the defined transports, although doing so is beneficial for compatibility 🌈.
- Where resolution speed is a high priority, the SVCB TargetName SHOULD follow the convention described in Section 10.2 of [SVCB], and the use of AliasMode records (Section 2.4.2 of [SVCB]) is NOT RECOMMENDED 🚀.
7. Examples 🧁
okay bestie, these are the examples and they're so good 😭✨ here's how it all works:
- A resolver known as simple.example that supports DNS over TLS on port 853 (implicitly, as this is its default port) 🫶:
_dns.simple.example. 7200 IN SVCB 1 simple.example. alpn=dot- A DoH-only resolver at
https://doh.example/dns-query{?dns}. DNS over TLS is not supported 🌸:
_dns.doh.example. 7200 IN SVCB 1 doh.example. (
alpn=h2 dohpath=/dns-query{?dns} )- A resolver known as resolver.example that supports 👑:
- DoT on resolver.example ports 853 (implicit in record 1) and 8530 (explicit in record 2), with "resolver.example" as the Authentication Domain Name,
- DoQ on resolver.example port 853 (record 1),
- DoH at
https://resolver.example/q{?dns}(record 1), and - an experimental protocol on fooexp.resolver.example:5353 (record 3) 🧪:
_dns.resolver.example. 7200 IN \
SVCB 1 resolver.example. alpn=dot,doq,h2,h3 dohpath=/q{?dns}
SVCB 2 resolver.example. alpn=dot port=8530
SVCB 3 fooexp.resolver.example. \
port=5353 alpn=foo foo-info=...- A name server named ns.example. whose service configuration is published on a different domain 🦋:
_dns.ns.example. 7200 IN SVCB 0 _dns.ns.nic.example.8. Security Considerations ⚔️
this part is SERIOUS bestie, so read it carefully 🥺🔐
8.1. Adversary on the Query Path
okay so this section looks at an adversary who can add or remove responses to the SVCB query 👀💀
during secure transport establishment, clients MUST authenticate the server to its authentication name, and that name is not influenced by the SVCB record contents 🔐. so this doc doesn't require DNSSEC 🙅♀️. it also doesn't say how clients authenticate the name (like which roots of trust to pick), because that can change depending on the context 🌳✨.
8.1.1. Downgrade Attacks
this attacker can't impersonate the secure endpoint, but they CAN forge a response saying the requested SVCB records don't exist 😭. for a SVCB-reliant client ([SVCB], Section 3), that only leads to a denial of service 🚫. however, SVCB-optional clients will usually fall back to insecure DNS in this case, which exposes all DNS traffic to attacks 💀🚨.
8.1.2. Redirection Attacks
SVCB-reliant clients always enforce the Authentication Domain Name 🔒, but they're still open to attacks using the transport, port number, and "dohpath" value, which this adversary controls 😤. by changing these values in the SVCB answers, the adversary can direct DNS queries for $HOSTNAME to any port on $HOSTNAME and any path on "https://$HOSTNAME". if the DNS client uses shared TLS or HTTP state, the client could be correctly authenticated (e.g., using a TLS client certificate or HTTP cookie) 🍪.
this behavior creates a bunch of possible attacks for certain server configurations 🙈. for example, if https://$HOSTNAME/upload accepts any POST request as a public file upload, the adversary could forge a SVCB record containing dohpath=/upload{?dns}. that would make the client upload and publish every query, causing unexpected storage costs for the server and privacy loss for the client 😱💸. similarly, if two DoH endpoints are available on the same origin and the service has designated one of them for use with this specification, this adversary can make clients use the other endpoint instead 🫠.
to mitigate redirection attacks, a client of this SVCB mapping MUST NOT identify or authenticate itself when performing DNS queries, except to servers it specifically knows are not vulnerable to such attacks 🛡️. if an endpoint sends an invalid response to a DNS query, the client SHOULD NOT send more queries to that endpoint and MAY log this error 📝. multiple DNS services MUST NOT share a hostname identifier (Section 3) unless they're so similar that it's safe to let an attacker choose which one gets used 🫣.
8.2. Adversary on the Transport Path
this section looks at an adversary who can modify network traffic between the client and the alternative service (identified by the TargetName) 👀🌐.
for a SVCB-reliant client, this adversary can only cause a denial of service 😬. but because DNS is unencrypted by default, this adversary can run a downgrade attack against SVCB-optional clients 💥. so when using this specification is optional, clients SHOULD switch to SVCB-reliant behavior if SVCB resolution succeeds 🔁. specifications that make use of this mapping MAY adjust this fallback behavior to suit their requirements 🎀.
9. IANA Considerations 📋
per [SVCB], IANA added the following entry to the "Service Parameter Keys (SvcParamKeys)" registry 🗂️:
+======+=======+================+=========+============+===========+
|Number|Name | Meaning |Format | Change | Reference |
| | | |Reference| Controller | |
+======+=======+================+=========+============+===========+
| 7 |dohpath| DNS-over-HTTPS |RFC 9461 | IETF | RFC 9461 |
| | | path template | | | |
+------+-------+----------------+---------+------------+-----------+Table 1
per [Attrleaf], IANA also added the following entry to the DNS "Underscored and Globally Scoped DNS Node Names" registry 💅:
+=========+============+===========+
| RR Type | _NODE NAME | Reference |
+=========+============+===========+
| SVCB | _dns | RFC 9461 |
+---------+------------+-----------+Table 2
10. References 📚
10.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, https://www.rfc-editor.org/info/rfc2119.
[RFC3629] Yergeau, F., "UTF-8, a transformation format of ISO 10646", STD 63, RFC 3629, DOI 10.17487/RFC3629, November 2003, https://www.rfc-editor.org/info/rfc3629.
[RFC6570] Gregorio, J., Fielding, R., Hadley, M., Nottingham, M., and D. Orchard, "URI Template", RFC 6570, DOI 10.17487/RFC6570, March 2012, https://www.rfc-editor.org/info/rfc6570.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, https://www.rfc-editor.org/info/rfc8174.
[RFC8484] Hoffman, P. and P. McManus, "DNS Queries over HTTPS (DoH)", RFC 8484, DOI 10.17487/RFC8484, October 2018, https://www.rfc-editor.org/info/rfc8484.
[RFC9113] Thomson, M., Ed. and C. Benfield, Ed., "HTTP/2", RFC 9113, DOI 10.17487/RFC9113, June 2022, https://www.rfc-editor.org/info/rfc9113.
[SVCB] Schwartz, B., Bishop, M., and E. Nygren, "Service Binding and Parameter Specification via the DNS (SVCB and HTTPS Resource Records)", RFC 9460, DOI 10.17487/RFC9460, November 2023, https://www.rfc-editor.org/info/rfc9460.
10.2. Informative References
[Attrleaf] Crocker, D., "Scoped Interpretation of DNS Resource Records through "Underscored" Naming of Attribute Leaves", BCP 222, RFC 8552, DOI 10.17487/RFC8552, March 2019, https://www.rfc-editor.org/info/rfc8552.
[DNSURI] Josefsson, S., "Domain Name System Uniform Resource Identifiers", RFC 4501, DOI 10.17487/RFC4501, May 2006, https://www.rfc-editor.org/info/rfc4501.
[FETCH] WHATWG, "Fetch Living Standard", October 2023, https://fetch.spec.whatwg.org/.
[RFC7858] Hu, Z., Zhu, L., Heidemann, J., Mankin, A., Wessels, D., and P. Hoffman, "Specification for DNS over Transport Layer Security (TLS)", RFC 7858, DOI 10.17487/RFC7858, May 2016, https://www.rfc-editor.org/info/rfc7858.
[RFC9250] Huitema, C., Dickinson, S., and A. Mankin, "DNS over Dedicated QUIC Connections", RFC 9250, DOI 10.17487/RFC9250, May 2022, https://www.rfc-editor.org/info/rfc9250.
Appendix A. Mapping Summary 🗺️
this table is a non-normative summary of the DNS mapping for SVCB 🌷.
+-----------------+------------------------------------+
| *Mapped scheme* | "dns" |
+-----------------+------------------------------------+
| *RR type* | SVCB (64) |
+-----------------+------------------------------------+
| *Name prefix* | _dns for port 53, else _$PORT._dns |
+-----------------+------------------------------------+
| *Required keys* | alpn or equivalent |
+-----------------+------------------------------------+
| *Automatically | port |
| mandatory keys* | |
+-----------------+------------------------------------+
| *Special | Supports all HTTPS RR SvcParamKeys |
| behaviors* | |
+-----------------+------------------------------------+
| | Overrides the HTTPS RR for DoH |
+-----------------+------------------------------------+
| | Default port is per-transport |
+-----------------+------------------------------------+
| | Cleartext fallback is discouraged |
+-----------------+------------------------------------+Table 3
Acknowledgments 🫶
thank you to the many reviewers and contributors 💖, including Andrew Campling, Peter van Dijk, Paul Hoffman, Daniel Migault, Matt Nordhoff, Eric Rescorla, Andreas Schulze, and Éric Vyncke 🌈✨.
Author's Address 💌
Benjamin Schwartz Meta Platforms, Inc. Email: ietf@bemasc.net
📦 where this page comes from
- ietf: rfc9461 2023-11
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms