RFC 9665
Service Registration Protocol for DNS-Based Service Discovery
RFC 9665: Service Registration Protocol for DNS-Based Service Discovery ✨
okay bestie, let's get into it 🎀 This is RFC 9665, and it's the spec for how devices register their services with DNS-SD using only unicast packets 🦋
- Title: Service Registration Protocol for DNS-Based Service Discovery
- Authors: T. Lemon and S. Cheshire, both at Apple Inc. 🍎
- Category: Standards Track (so it's an actual Internet Standard, not just a suggestion 💅)
- Date: June 2025
- ISSN: 2070-1721
- Stream: IETF, with the Internet Engineering Task Force as the publisher 🌈
Part 1 of 11 💖 More parts are coming, so don't leave yet!
Abstract
okay so the Service Registration Protocol (SRP) for DNS-based Service Discovery (DNS-SD) uses the standard DNS Update mechanism to make DNS-SD work with only unicast packets 🦋 That means you can deploy DNS-SD without multicast, which is giving scalability and better performance on networks where multicast isn't the best choice, especially IEEE 802.11 (Wi-Fi) and IEEE 802.15.4 networks 📶 DNS-SD service registration also uses public keys and SIG(0), so services can defend their own registrations 🔐 slay.
Status of This Memo
this one is an Internet Standards Track document 👑
it was produced by the Internet Engineering Task Force (IETF), it represents the consensus of the IETF community, it got public review, and the Internet Engineering Steering Group (IESG) approved it for publication 🎀 If you want more on Internet Standards, check Section 2 of RFC 7841.
info about the current status, any errata, and how to send feedback lives at https://www.rfc-editor.org/info/rfc9665 🌸
Copyright Notice
Copyright (c) 2025 IETF Trust and the persons identified as the document authors. All rights reserved. 💜
this document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they're in effect on the publication date 📜 Please read those carefully, because they spell out your rights and restrictions for this document, no cap.
one important bit: any Code Components pulled out of this document must include the Revised BSD License text, as described in Section 4.e of the Trust Legal Provisions. They come without warranty, as described in the Revised BSD License ⚖️
Table of Contents 🧚
here's the full map of the doc, with every section number exactly as written:
1. Introduction
2. Conventions and Terminology Used in This Document
3. Service Registration Protocol
3.1. Protocol Variants
3.1.1. Full-Featured Hosts
3.1.2. Constrained Hosts
3.1.3. Why two variants?
3.2. Protocol Details
3.2.1. What to Publish
3.2.2. Where to Publish It
3.2.3. How to Publish It
3.2.3.1. How the DNS-SD Service Registration Process Differs
from DNS Update
3.2.3.2. Retransmission Strategy
3.2.3.3. Successive Updates
3.2.4. How to Secure It
3.2.4.1. FCFS Naming
3.2.5. SRP Requester Behavior
3.2.5.1. Public/Private Key Pair Generation and Storage
3.2.5.2. Name Conflict Handling
3.2.5.3. Record Lifetimes
3.2.5.4. Compression in SRV Records
3.2.5.5. Removing Published Services
3.3. Validation and Processing of SRP Updates
3.3.1. Validation of DNS Update Add and Delete RRs
3.3.1.1. Service Discovery Instruction
3.3.1.2. Service Description Instruction
3.3.1.3. Host Description Instruction
3.3.2. Valid SRP Update Requirements
3.3.3. FCFS Name and Signature Validation
3.3.4. Handling of Service Subtypes
3.3.5. SRP Update Response
3.3.6. Optional Behavior
4. TTL Consistency
5. Maintenance
5.1. Cleaning Up Stale Data
6. Security Considerations
6.1. Source Validation
6.2. Other DNS Updates
6.3. Risks of Allowing Arbitrary Names to be Registered in SRP
Updates
6.4. Security of Local Service Discovery
6.5. SRP Registrar Authentication
6.6. Required Signature Algorithm
7. Privacy Considerations
8. Domain Name Reservation Considerations
8.1. Users
8.2. Application Software
8.3. Name Resolution APIs and Libraries
8.4. Recursive Resolvers
8.5. Authoritative DNS Servers
8.6. DNS Server Operators
8.7. DNS Registries/Registrars
9. Delegation of "service.arpa."
10. IANA Considerations
10.1. Registration and Delegation of "service.arpa." as a
Special-Use Domain Name
10.2. Addition of "service.arpa." to the Locally-Served Zones
Registry
10.3. Subdomains of "service.arpa."
10.4. Service Name Registrations
10.4.1. "dnssd-srp" Service Name
10.4.2. "dnssd-srp-tls" Service Name
10.5. Anycast Address
11. References
11.1. Normative References
11.2. Informative References
Appendix A. Using Standard Authoritative DNS Servers Compliant
with RFC 2136 to Test SRP Requesters
Appendix B. How to Allow SRP Requesters to Update Standard Servers
Compliant with RFC 2136
Appendix C. Sample BIND 9 Configuration for
"default.service.arpa."
Acknowledgments
Authors' Addressesthat's the front matter, bestie 🌈 next up is Section 1, Introduction 🦋
1. Introduction ✨
okay so DNS-SD [RFC6763] is a component of Zero Configuration Networking [RFC6760] [ZC] [ROADMAP] 🦋
this doc is about an upgrade to DNS-SD that lets servers register the services they offer using the DNS protocol over unicast, instead of Multicast DNS (mDNS) [RFC6762] 💅 there's already a huge installed base of DNS-SD clients that can discover services over DNS (e.g., Android, Windows, Linux, Apple operating systems) 🌸
this document is meant for three audiences 🎀 first, implementers of software that provides services that should be advertised using DNS-SD. second, implementers of authoritative DNS servers that will be used in contexts where DNS-SD registration is needed. third, administrators of networks where DNS-SD service is required. the doc is supposed to give enough info to allow interoperable implementation of the Service Registration Protocol 🫶
DNS-SD lets servers publish the info needed to access the services they provide ✨ then DNS-SD clients can discover the set of service instances of a particular type that are available, pick one from those, and grab the info needed to use it. ngl, DNS-SD using the DNS protocol can be more efficient and versatile than using mDNS, but it's not common in practice because updating authoritative DNS services with service info is genuinely painful 😭
the existing practice for updating DNS zones is either to enter new data manually or to use DNS Update [RFC2136]. unfortunately, DNS Update requires either:
- that the authoritative DNS server automatically trust updates, or
- that the DNS Update requester have some kind of shared secret or public key that is known to the authoritative DNS server and can be used to authenticate the update.
and it gets worse 💀 DNS Update can be a fairly chatty process, requiring multiple roundtrips with different conditional predicates to complete the update process.
the Service Registration Protocol (SRP) fixes this by adding a set of default heuristics for processing DNS updates, which eliminates the need for conditional predicates 👑 instead, the SRP registrar (an authoritative DNS server that supports SRP Updates) has a set of default predicates that get applied to the update, and the update either succeeds entirely or fails in a way that lets the requester know what went wrong and build a new update. main character energy 💅
SRP also adds a feature called "First Come, First Served Naming" (or "FCFS Naming"), which allows the requester to:
- claim a name that is not yet in use, and
- authenticate, using SIG(0) [RFC2931], both the initial claim (to ensure it has not been modified in transit) and subsequent updates (to ensure they come from the same entity that performed the initial claim).
this stops a new service instance from "stealing" a name that's already in use 🙅♀️ a second SRP requester trying to claim an existing name won't have the SIG(0) key the first requester used to claim it. because of that, its claim gets rejected, and it's forced to pick a new name.
⚠️ "authenticate" here just means we can tell that an update came from the same source as the original registration. we have NOT established trust. this has big implications for what we can and can't do with data the SRP requester sends us. as you read on, you'll notice we only support adding a very restricted set of records, and the content of those records is further constrained.
the reason is precisely that we have not established trust 🥺 so we can only publish info that we feel safe publishing, even though we have no basis for trusting the requester. our reasoning is that mDNS [RFC6762] lets arbitrary hosts on a single IP link advertise services [RFC6763], relying on whatever service is advertised to provide authentication as part of its protocol rather than in the service advertisement.
this is considered reasonably safe because you need physical presence on the network in order to advertise 🔐 an off-network mDNS attack is simply not possible. our goal with this spec is to impose similar constraints. that's why you'll see in Section 3.3.1 that a very restricted set of records with a very restricted set of relationships is allowed. you'll also see in Section 6.1 that we give advice on how to prevent off-network attacks 🛡️
this leads to the disappointing observation that this protocol is not a mechanism for adding arbitrary info to DNS zones 🥲 we haven't evaluated the security properties of adding, for example, an SOA record, an MX record, or a CNAME record, so these are forbidden. future updates to this spec might include analyses for other records and extend the set of records and/or record content that can be registered here. or it might require establishing trust and add an authorization model on top of the authentication model we have now. but that's work for a future document 📝
finally, SRP adds the concept of a "lease" [RFC9664], which is analogous to leases in DHCP [RFC2131] [RFC8415] ⏳ the SRP registration itself has a lease that may be on the order of two hours. if the requester doesn't renew the lease before it elapses, the registration is removed. the claim on the name can have a longer lease, so another requester can't immediately claim the name even though the registration itself has expired 🧚
the Service Registration Protocol for DNS-SD specified in this document provides a reasonably secure mechanism for publishing this info 🌈 once published, these services can be readily discovered by DNS-SD clients using standard DNS lookups 🎉
Section 10 of the DNS-SD specification [RFC6763] briefly discusses ways servers can advertise the services they provide in the DNS namespace. in the case of mDNS, servers can advertise their services on the local link, using names in the local. namespace, which makes their services directly discoverable by peers attached to that same local link 📡
DNS-SD [RFC6763] also lets clients discover services by using the DNS protocol over traditional unicast [RFC1035] 💜 this can be done by having a system administrator manually configure service info in the DNS. however, manually populating authoritative DNS server databases is costly, potentially error-prone, and requires a knowledgeable network administrator 😩 so even though all DNS-SD client implementations we know of support DNS-SD using DNS queries, in practice it's used much less often than mDNS.
the Discovery Proxy [RFC8766] gives one way to automatically populate the DNS namespace, but it's only appropriate on networks where services are easily advertised using mDNS 🙈 the present document describes a solution that's more suitable for networks where multicast is inefficient, or where sleepy devices are common, by supporting the use of unicast for both offering and discovering services 💤🦋
2. Conventions and Terminology Used in This Document 🎀
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. 💅
Strictly speaking, fully qualified domain names end with a dot (".") 🧐 in DNS zone files and other similar contexts, if the final dot is omitted, a name may be treated incorrectly as relative to some other parent domain 😬 this document follows the formal DNS convention and ends fully qualified domain names with a dot. when this document mentions domain names such as local. and default.service.arpa., the final dot is part of the domain name. it is not a period ending the sentence 🫠
3. Service Registration Protocol 💖
Services that implement SRP use DNS Update [RFC2136] with SIG(0) [RFC3007] to publish service info in the DNS 📮 there are two variants: one for full-featured hosts, and one for devices designed for Constrained-Node Networks (CNNs) [RFC7228] 🧸 an SRP registrar is most likely an authoritative DNS server, or a source of data for one or more authoritative DNS servers. there's no requirement that the authoritative DNS server receiving SRP Updates be the same authoritative DNS server answering queries that return the records that have been registered. for example, an SRP registrar could be the "hidden primary" that's the source of data for a whole fleet of secondary authoritative DNS servers 🕵️♀️✨
3.1. Protocol Variants 🌸
3.1.1. Full-Featured Hosts 🦋
full-featured hosts either get configured manually with a registration domain, or they discover the default registration domain automatically using the Domain Enumeration process described in Section 11 of the DNS-SD specification [RFC6763] 🔍 if this process doesn't produce a default registration domain, the SRP registrar isn't discoverable on the local network using this mechanism. other discovery mechanisms are possible, but they're out of scope for this document 🙃
configuring the registration domain can be done either:
- by querying the list of available registration domains (
r._dns-sd._udp) and letting the user select one from the UI, or - by any other means appropriate to the particular use case being addressed.
full-featured devices construct the names of the SRV, TXT, and PTR records describing their service or services as subdomains of the chosen service registration domain 🧁 for these names, they then discover the zone apex of the closest enclosing DNS zone using SOA queries, as described in Section 6.1 of the DNS Push Notification specification [RFC8765] 🔎 once they've found the enclosing DNS zone, they query for the _dnssd-srp._tcp.<zone> SRV record to discover the SRP registrar they can send SRP Updates to. hosts that support SRP Updates using TLS use the _dnssd-srp-tls._tcp.<zone> SRV record instead 🔐
examples of full-featured hosts include devices like home computers, laptops, powered peripherals with network connections (such as printers and home routers), and even battery-operated devices like mobile phones that have long battery lives 📱💜
3.1.2. Constrained Hosts ✨
okay so for devices built for CNNs [RFC7228], we get to skip a few steps 🦋 Instead of having to configure or discover the service registration domain, they just use the special-use domain name [RFC6761] default.service.arpa. 💖 How SRP registrars get found is specific to each constrained network, so we're not going to suggest one particular mechanism here 🌸
SRP requesters on CNNs are expected to receive a list of SRP registrars to register with, straight from the network 📡 It's the job of a CNN that supports SRP to provide at least one registrar address and port 🫶 And it's the registrar's job on a CNN to handle the updates properly 💅 In some network environments, updates can get accepted directly into a local default.service.arpa. zone, which only has local visibility 🏠 In other network environments, the registrar might rewrite updates for names ending in default.service.arpa. into names with broader visibility 🌍 Domain name rewriting should be done in whatever way fits the network environment in question ✨ If you want some ideas on how to translate a locally scoped name into one with a bigger scope, check out the data translation for names in Multicast DNS answers in Section 5.5 of the Discovery Proxy specification [RFC8766] 🧚
3.1.3. Why two variants? 🤔
So the reason there are different variants is that low-power devices, which usually live on CNNs, can have seriously limited battery capacity 🔋😭 The series of DNS lookups needed to find an SRP registrar and then talk to it burns extra energy just to advertise a service 💀 For low-power devices, the extra flexibility doesn't justify that extra energy use 🙈 It's also pretty typical for these networks that some network service information gets handed over while joining the network, so nodes can rely on that to get the info they need 🌸
Networks that aren't CNNs can have way more complicated topologies at the IP layer 🌈 Nodes on those networks can be assumed to be able to do DNS-SD service registration domain discovery 🔍 Those networks are generally able to provide registration domain discovery and routing too 🛣️ Now here's the tea ☕ this opens the door to off-network spoofing, where a device from a foreign network registers a service on the local network just to attack devices on the local network 😱 To guard against off-path spoofing, TCP is required for these networks 🛡️🔥
3.2. Protocol Details 💜
We're going to go through several parts of this process:
- how to know what to publish (Section 3.2.1),
- how to know where to publish it (under what name) (Section 3.2.2),
- how to publish it (Section 3.2.3),
- how to secure its publication (Section 3.2.4), and
- how to maintain the information once published (Section 5).
3.2.1. What to Publish 📝
SRP Updates are sent by SRP requesters to SRP registrars 📮 There are three types of instructions that show up in an SRP Update: Service Discovery instructions, Service Description instructions, and Host Description instructions 🎀 These instructions are made up of DNS Update Resource Records (RRs) that are either adds or deletes ➕➖ The types of records that get added, updated, and removed in each of these instructions, plus the constraints that apply to them, are covered in Section 3.3 📚 An SRP Update is a DNS Update message [RFC2136] that's built so it meets the constraints from that section 💖 Here's a quick rundown of what a typical SRP Update includes:
- Service Discovery PTR RR(s) for service(s), which map from a generic service type (or subtype(s)) to a specific service instance name [RFC6763] 🦋
- For each service instance name, an SRV RR, one or more TXT RRs, and a KEY RR ✨ Okay, so in principle DNS-SD Service Description records can include other record types with the same service instance name, but in practice they rarely do 🙈 Right now SRP doesn't permit other record types 🚫 The KEY RR is used to support FCFS Naming and has no specific meaning for DNS-SD lookups 🔑 SRV records for all services described in an SRP Update point to the same hostname 🌸
- There is always exactly one hostname in a single SRP Update 🫵 A DNS Update containing more than one hostname is not an SRP Update 🚫 The hostname has one or more address RRs (AAAA or A) and a KEY RR (used for FCFS Naming) 🌈 Depending on the use case, an SRP requester may be required to suppress some addresses that wouldn't be usable by hosts discovering the service through the SRP registrar 👀 The exact address record suppression behavior required may vary for different types of SRP requesters 💅 Some suggested policies for suppressing unusable records can be found in Section 5.5.2 of the Discovery Proxy specification [RFC8766] 🧚
The DNS-Based Service Discovery specification [RFC6763] explains what each of these RR types means, except for the KEY RR, which is defined in the specification for how to store Diffie-Hellman Keys in the DNS [RFC2539] 📖 These specifications should be considered the definitive sources for what to publish 🏆 Why do we summarize it here? So you can understand the service registration process at a high level without first learning all the full details of DNS-SD 🥰 Also, the "service instance name" is a big deal for FCFS Naming, which we'll get into later on in this document 👑
3.2.2. Where to Publish It 🗺️
Multicast DNS (mDNS) uses a single namespace, local. 🌐 Subdomains of local. are specific to the local link they're advertised on 🔗 This convenience isn't available for DNS-SD using the DNS protocol 😤 Services have to live in some specific DNS namespace, chosen either by the network operator or automatically 🤖
As we covered above, full-featured devices are responsible for knowing the domain they should register their services in 🧠 Those devices MAY optionally support configuration of a registration domain by the operator of the device 🎛️ However, they MUST support registration domain discovery as described in Section 11 of the DNS-SD specification [RFC6763] 🔍 Yes, MUST, no cap 🧢
Devices made for CNNs register in the special-use domain name [RFC6761] default.service.arpa. and let the SRP registrar handle rewriting that to a different domain if needed, as mentioned in Section 3.1.2 🦋
3.2.3. How to Publish It 🚀
It's possible to send a DNS Update message that does several things at once 🤯 For example, in a single transaction you can add or update a single Host Description while also adding or updating the RRs that make up the Service Description(s) for one or more service instance(s) available on that host, and adding or updating the RRs that make up the Service Discovery instruction(s) for those service instance(s) 🎀
An SRP Update takes advantage of this 💅 It's implemented as a single DNS Update message that contains a service's Service Discovery records, Service Description records, and Host Description records ✨
Updates done under this specification are kinda different from normal DNS Updates [RFC2136], where the update process could involve lots of update attempts 🌀 The requester might first try to add a name if it doesn't exist; if that fails, then in a second message the requester might update the name if it does exist but matches certain preconditions 🙃 Because the Service Registration Protocol described in this document uses a single transaction, some of that adaptability is lost 😭
To allow updates to happen in a single transaction, SRP Updates do not include update prerequisites 🚫 The requirements specified in Section 3.3 are implicit in the processing of SRP Updates, so the SRP requester doesn't need to put in any explicit prerequisites 🫶
3.2.3.1. How the DNS-SD Service Registration Process Differs from DNS Update 🔀
DNS-SD Service Registration uses the DNS Update specification [RFC2136] with some additions 💖
- It implements FCFS Naming, protected using SIG(0) [RFC2931] 🔐
- It enforces policy about what updates are allowed 👮
- It optionally performs rewriting of
default.service.arpa.to some other domain 🔁 - It optionally performs automatic population of the address-to-name reverse mapping domains 🪄
- An SRP registrar is not required to implement general DNS Update prerequisite processing 🙅
- CNN SRP requesters are allowed to send updates to the generic domain
default.service.arpa.🌈
3.2.3.2. Retransmission Strategy 🔁
The DNS protocol, including DNS updates, can operate over UDP or TCP 🌊 For UDP updates from CNN devices, reliable transmission has to be guaranteed by retransmitting when a DNS UDP message isn't acknowledged within a reasonable interval ⏰ Section 4.2.1 of the DNS specification [RFC1035] gives some guidance on this, and so does Section 1 of the IETF document describing common DNS implementation errors [RFC1536] 📚 Section 3.1.3 of the UDP Usage Guidelines document [RFC8085] also has useful guidance that's especially relevant to DNS 💜
3.2.3.3. Successive Updates 📦
SRP doesn't require that every update contain the same information 🙌 When an SRP requester needs to send more than one SRP Update to the SRP registrar, it SHOULD combine them into a single SRP Update when possible 🧩 That's subject to DNS message size limits and link-specific size limits (for example, an IEEE 802.15.4 network performs poorly when asked to deliver a packet larger than about 500 bytes) 📉 If the updates don't fit into a single SRP Update, then the SRP requester MUST send subsequent SRP Updates sequentially 🚦 Until an earlier SRP Update has been acknowledged, the requester MUST NOT send any subsequent SRP Updates 🛑 And if a configuration change happens while an outstanding SRP Update is in flight, the SRP registrar MUST defer sending a new SRP Update for that change until the previous SRP Update has completed 🫸 Patience is a virtue, bestie 🥹
3.2.4. How to Secure It 🔒
DNS Update messages can be secured using secret key transaction signatures (TSIG) [RFC8945] 🔑 This approach uses a secret key shared between the DNS Update requester (which issues the update) and the authoritative DNS server (which authenticates it) 🤝 But this model does not work for automatic service registration 😬
The goal of securing the DNS-SD Registration Protocol is to provide the best possible security, given the constraint that service registration has to be automatic 🛡️✨ It's possible to layer more operational security on top of what we describe here, but FCFS Naming is already an improvement over the security of mDNS 🏆💅
3.2.4.1. FCFS Naming
FCFS Naming gives you a limited degree of security 🔐. It's not perfect, but it's something! 💅 A server that registers its service using SRP gets ownership of a name for an extended stretch of time 🕰️. That time is based on a lease tied to the specific key used to authenticate the SRP Update, and it can be longer than the lease on the registered RRs. Lowkey iconic ✨. As long as the registrar remembers the name and the public key that matches the private key used to register RRs on that name, no other SRP requester can add or update the info attached to that name. Nobody gets to slide in and mess with your stuff, periodt 🫶. BUT, if the SRP requester doesn't renew its service registration before the KEY lease expires (Section 4 of the DNS Update Lease specification [RFC9664]), its name is no longer protected 😭. FCFS Naming is what protects both the Service Description and the Host Description 🛡️.
3.2.5. SRP Requester Behavior
3.2.5.1. Public/Private Key Pair Generation and Storage
The requester generates a public/private key pair (Section 6.6) 🔑. This key pair MUST be stored in stable storage. If there's no writable stable storage on the SRP requester, then the SRP requester MUST be preconfigured with a public/private key pair in read-only storage. This key pair MUST be unique to the device 💖. A device with rewritable storage SHOULD retain this key indefinitely. When the device changes ownership, it may be appropriate for the former owner to erase the old key pair, which would then require the new owner to install a new one (oof, new owner gotta set up fresh 🥲). Therefore, the SRP requester on the device SHOULD provide a mechanism to erase the key (for example, as the result of a "factory reset") and to generate a new key 🧹.
Note that when a new key is generated, this will prevent the device from registering with the name associated with the old key in the same domain where it had previously registered. So, implicit in the generation of a new key is the generation of a new name. This can be done either proactively when regenerating a key or only in the event that the SRP update produces a name conflict 🦋.
The policy described here for managing keys assumes that the keys are only used for SRP. If a key that is used for SRP is also used for other purposes, the policy described here is likely to be insufficient. The policy stated here is NOT RECOMMENDED in such a situation: a policy appropriate to the full set of uses for the key must be chosen. Specifying such a policy is out of scope for this document 🙈.
When sending DNS updates, the requester includes a KEY record containing the public portion of the key in each Host Description Instruction and each Service Description Instruction. Each KEY record MUST contain the same public key. The update is signed using SIG(0), using the private key that corresponds to the public key in the KEY record. The lifetimes of the records in the update are set using the EDNS(0) Update Lease option [RFC9664] ⏱️.
The format of the KEY resource record in the SRP Update is defined in the IETF specification for DNSSEC Resource Records [RFC4034]. Because the KEY RR used in SIG(0) is not a zone-signing key, the flags field in the KEY RR MUST be all zeroes 🧁.
The KEY record in Service Description updates MAY be omitted for brevity. If it is omitted, the SRP registrar MUST behave as if the same KEY record that is given for the Host Description is also given for each Service Description for which no KEY record is provided. Omitted KEY records are not used when computing the SIG(0) signature 🌸.
3.2.5.2. Name Conflict Handling
"Add" operations for both Host Description RRs and Service Description RRs can have names that result in name conflicts. Service Discovery record "Add" operations cannot have name conflicts. If any Host Description or Service Description record is found by the SRP registrar to have a conflict with an existing name, the registrar will respond to the SRP Update with a YXDomain RCODE [RFC2136], indicating that the desired name is already owned by a different SIG(0) key. In this case, the SRP requester MUST choose a new name or give up 😬.
There is no specific requirement for how the SRP requester should choose a new name. Typically, though, the requester will append a number to the preferred name. This number could be sequentially increasing or could be chosen randomly. One existing implementation attempts several sequential numbers before choosing randomly. For instance, it might try host.default.service.arpa., then host-1.default.service.arpa., then host-2.default.service.arpa., then host-31773.default.service.arpa. 🎀
3.2.5.3. Record Lifetimes
The lifetime of the DNS-SD PTR, SRV, A, AAAA, and TXT records [RFC6763] uses the LEASE field of the Update Lease option and is typically set to two hours. So if a device gets disconnected from the network, it doesn't linger too long in the user interfaces of devices looking for instances of that service type 👀.
The lifetime of the KEY records is set using the KEY-LEASE field of the Update Lease Option and SHOULD be set to a much longer time, typically 14 days. The result is that even though a device may be temporarily disconnected or powered off (vanishing from the network for a few days 🫠), it still makes a claim on its name that lasts way longer 💜.
Therefore, even if a device is disconnected from the network for a few days, and its services are not available for that time, no other device can swoop in and claim its name the moment it disappears. In the event that a device is disconnected from the network and permanently discarded, its name is eventually cleaned up and made available for reuse ♻️.
3.2.5.4. Compression in SRV Records
Although the original SRV specification [RFC2782] requires that the target hostname in the RDATA of an SRV record not be compressed in DNS queries and responses, an SRP requester MAY compress the target in the SRV record, since an SRP Update is neither a DNS query nor a DNS response. The motivation for not compressing is not stated in the SRV specification but is assumed to be because a recursive resolver (caching server) that doesn't understand the format of the SRV record might store it as binary data without decoding a compression pointer embedded with the target hostname field, and thus return nonsensical RDATA in response to a query. This concern does not apply in the case of SRP. An SRP registrar needs to understand SRV records in order to validate the SRP Update. Compression of the target can save space in the SRP Update, so we want SRP requesters to be able to assume that the registrar will handle this. Therefore, SRP registrars MUST support compression of SRV RR targets 🗜️.
Note that this document does not update the SRV specification [RFC2782]: Authoritative DNS servers still MUST NOT compress SRV record targets. The requirement to accept compressed SRV records in updates only applies to SRP registrars. SRP registrars that are also authoritative DNS servers still MUST NOT compress SRV record targets in DNS responses. We note also that Multicast DNS [RFC6762] similarly compresses SRV records in mDNS messages 🧐.
In addition, we note that an implementer of an SRP requester might update existing code that creates SRV records or compresses DNS messages so that it compresses the target of an SRV record. Care must be taken if such code is used both in requesters and in authoritative DNS servers that the code only compresses SRV targets in the case where a requester is generating an SRP Update ⚠️.
3.2.5.5. Removing Published Services
3.2.5.5.1. Removing All Published Services
To remove all the services registered to a particular hostname, the SRP requester transmits an SRP Update for that hostname with an Update Lease option that has a LEASE value of zero. The SRP Update MUST contain exactly one Host Description Instruction that contains exactly one "Delete All RRsets From A Name" instruction for the hostname and no "Add to an RRSet" instructions for that hostname. If the registration is to be permanently removed, KEY-LEASE SHOULD also be zero. Otherwise, it SHOULD be set to the same value it had previously. This holds the name in reserve for when the SRP requester is once again able to provide the service 🧳.
This method of removing services is intended for the case where the requester is going offline and does not want any of its services to continue being advertised 📴.
To support this, when removing a hostname, an SRP registrar MUST remove all service instances pointing to that hostname and all Service Discovery PTR records pointing to those service instances, even if the SRP requester doesn't list them explicitly. If the KEY lease time is nonzero, the SRP registrar MUST NOT delete the KEY records for these service instances.
Main character energy: the KEY records are the name-holding VIP 👑. Don't delete them while the lease is still going!
3.2.5.5.2. Removing Some Published Services 🦋
okay so bestie, sometimes a requester only wants to remove ONE service instance and keep its other services alive ✨ like, a device might shut down its remote screen access (_rfb._tcp) 🖥️ but keep its command-line login (_ssh._tcp) 🔐 running. this can be done in one of two ways 💅
- to simply remove a specific service instance, the requester sends a valid SRP Update with a Service Description Instruction (Section 3.3.1.2) containing a single "Delete All RRsets From A Name" update to the service instance name. the SRP Update SHOULD include Service Discovery Instructions (Section 3.3.1.1) consisting of "Delete An RR From An RRset" updates [RFC2136] that delete any Service Discovery PTR records whose target is the service instance name. however, even if there are no such Service Discovery Instructions, the SRP registrar MUST delete any Service Discovery PTR records that point to the deleted service instance name. 🧹
- when you delete one service instance while simultaneously creating a new one with a different service instance name, you can do both operations in a single SRP Update 🎀 the old service gets deleted just like in the first alternative, and the new service gets added just like it would in any update that isn't deleting anything. because removing the old service and adding the new one each consist of a valid Service Discovery Instruction and a valid Service Description Instruction, the whole update is a valid SRP Update and will result in the old service being removed and the new one added. or, to put it differently, the SRP Update will result in the old service being replaced by the new service 🔄✨
it's worth noting that if a service is updated WITHOUT its service instance name changing (like when only the target port in the SRV record is being updated), that SRP Update is gonna look a LOT like the second alternative above 👀 the PTR record in the Service Discovery Instruction will be the same for both the "Delete An RR From An RRset" update and the "Add To An RRset" update [RFC2136]. since removing the old service and adding the new one are both valid SRP Update operations, the combined operation is a valid SRP Update operation too 💖 the SRP registrar does not need any special code to recognize this case, and it does not need to take any special actions to handle it correctly. no extra work, bestie 🙌
whichever of these two alternatives is used, the hostname lease will be updated with the lease time provided in the SRP update 🕰️ and in neither of these cases is it permissible to delete the hostname. ❗ all services MUST point to a hostname. if a hostname is to be deleted, that has to be done using the method described in Section 3.2.5.5.1, which deletes the hostname AND all services that have that hostname as their target 💀
3. Validation and Processing of SRP Updates 👑
3.3.1. Validation of DNS Update Add and Delete RRs 🔍
okay so first things first, the SRP registrar checks that the DNS Update message is syntactically and semantically valid according to the usual DNS Update rules [RFC2136] 📋
an SRP Update is made of a set of _instructions_ that together add or remove one or more services 🧩 each _instruction_ is made of one or more delete update(s), or one or more add update(s), or some mix of delete updates and add updates 🎀
the SRP registrar checks each instruction in the SRP Update to make sure it is either a Service Discovery Instruction, a Service Description Instruction, or a Host Description Instruction 🔎 order matters in DNS updates!! specifically, deletes MUST come before adds for records that the deletes would affect, otherwise the add will have no effect 😭 this is the ONLY ordering constraint. aside from that, updates can appear in whatever order is convenient when you're building the update 🌸
because the SRP Update is a DNS update, it MUST contain a single entry in the Zone Section (what would be the Question Section in a DNS query or response) that indicates the zone to be updated 📍 and every delete and update in an SRP Update MUST be within the zone specified for the SRP Update 🫶
3.3.1.1. Service Discovery Instruction 📡
an instruction is a Service Discovery Instruction if it:
- consists of exactly one "Add To An RRSet" or exactly one "Delete An RR From An RRSet" RR update (Section 2.5 of the DNS Update specification [RFC2136]),
- which updates a PTR RR,
- the target of which is a service instance name
- for which a Service Description Instruction is present in the SRP Update, and:
- if the Service Discovery Instruction is an "Add To An RRSet" instruction, that Service Description Instruction contains a "Delete All RRsets From A Name" instruction for that service instance name followed by "Add To An RRset" instructions for the SRV and TXT records describing that service; or
- if the Service Discovery Instruction is a "Delete An RR From An RRSet" instruction, that Service Description Instruction contains a "Delete All RRsets From A Name" instruction for that service instance name with no following "Add To An RRset" instructions for the SRV and TXT records describing that service. an "Add to an RRset" instruction for the KEY record here is allowed but not implicit. 🗝️
there can be MORE than one Service Discovery Instruction for the same service name (the owner name of the Service Discovery PTR record) if the SRP requester is advertising more than one instance of the same service type, or is changing the target of a PTR RR 🎭 when subtypes are being used (Section 7.1 of the DNS-SD specification [RFC6763]), each subtype is a separate Service Discovery Instruction 🧁 for each of those PTR RR adds or deletes, the constraints above MUST be met. ✅
3.3.1.2. Service Description Instruction 🏷️
an instruction is a Service Description Instruction if, for the given service instance name, ALL of the following are true 🫧
- it contains exactly one "Delete All RRsets From A Name" update for the service instance name (Section 2.5.3 of the DNS Update specification [RFC2136]).
- it contains zero or one "Add To An RRset" KEY RRs that, if present, contain the public key corresponding to the private key that was used to sign the message (if present, the KEY RR MUST match the KEY RR given in the Host Description). 🔑
- it contains zero or one "Add To An RRset" SRV RR.
- if an "Add To An RRSet" update for an SRV RR is present, there MUST be at least one "Add To An RRset" update for the corresponding TXT RR, and the target of the SRV RR MUST be the hostname given in the Host Description Instruction in the SRP Update, or
- if there is no "Add To An RRset" update for an SRV RR, then there MUST be no "Add To An RRset" updates for the corresponding TXT RR, and either:
- the name to which the "Delete All RRsets From A Name" applies does not exist, or
- there is an existing KEY RR on that name that matches the key with which the SRP Update was signed. 🔐
Service Description Instructions do not add any other resource records. 🙅♀️
An SRP registrar MUST correctly handle compressed names in the SRV target. 🗜️
3.3.1.3. Host Description Instruction 🏠
every SRP Update always contains exactly one Host Description Instruction 💯
an instruction is a Host Description Instruction if, for the appropriate hostname, it contains the following:
- exactly one "Delete All RRsets From A Name" RR
- exactly one "Add To An RRset" RR that adds a KEY RR that contains the public key corresponding to the private key that was used to sign the message
- zero "Add To An RRset" operations (in the case of deleting a registration) or one or more "Add To An RRset" RRs of type A and/or AAAA (in the case of creating or updating a registration)
Host Description Instructions do not add any other resource records. 🚫
A and/or AAAA records that are not of sufficient scope to be validly published in a DNS zone MAY be ignored by the SRP registrar 🙈 which could result in a Host Description effectively containing zero reachable addresses, even when it contains one or more addresses 😬
for example, if an IPv4 link-local address [RFC3927] or an IPv6 link-local address [RFC4862] is provided by the SRP requester, the SRP registrar could elect not to publish it in a DNS zone 🌐 however, in some situations, the registrar might make the records available through a mechanism such as an advertising proxy, but only on the specific link the SRP Update originated from 🔗 in that situation, locally scoped records are still valid 💜
3.3.2. Valid SRP Update Requirements 📝
an SRP Update MUST contain exactly one Host Description Instruction 🎯 multiple Service Discovery updates and Service Description updates can be combined into a single SRP Update along with a single Host Description update, as described in Section 3.2.3 🧺 a DNS Update message that contains any additional adds or deletes that cannot be identified as Service Discovery, Service Description, or Host Description Instructions is NOT an SRP Update 🙅♀️ and a DNS update that contains any prerequisites is not an SRP Update either 🚫
an SRP Update MUST include an EDNS(0) Update Lease option [RFC9664] ⏳ the LEASE time specified in the Update Lease option MUST be less than or equal to the KEY-LEASE time 🕰️ a DNS update that does not include the Update Lease option, or that includes a KEY-LEASE value that is less than the LEASE value, is not an SRP Update 💀
when an SRP registrar receives a DNS Update message that is not an SRP Update, it MAY process the update as a normal DNS Update [RFC2136], including access control checks and constraint checks, if supported 🌷 otherwise, the SRP registrar MUST reject the DNS Update with the Refused RCODE 🙅♀️
if the definitions of each of these instructions are followed carefully and the update requirements are validated correctly, many DNS Update messages that look very much like SRP Updates will STILL fail to validate 😭 for example, a DNS update that contains an "Add To An RRset" instruction for a Service Name and an "Add to an RRset" instruction for a service instance name, where the PTR record added to the Service Name does not reference the service instance name, is not a valid SRP Update but may be a valid DNS Update 🥺✨
3.3.3. FCFS Name and Signature Validation ✨
okay bestie, once the SRP registrar has confirmed that a DNS Update is a valid SRP Update (Section 3.3.2) 💅, it checks that the name in the Host Description Instruction actually exists in the zone being updated. if it does, the registrar looks at the KEY record on that name and checks whether it matches the KEY record in the Host Description Instruction. it does the same check for the KEY records in any Service Description Instructions. if a KEY got left out of a Service Description Instruction, the KEY from the Host Description Instruction gets used instead 🔑
if any existing KEY record that corresponds to a KEY record in the SRP Update doesn't match it (whether that KEY was provided or taken from the Host Description Instruction), the SRP registrar MUST reject the SRP Update with a YXDomain RCODE 😭. that basically means "this name already belongs to a different SIG(0) key," and it tells the SRP requester to pick a new name and try again 🦋
if the SRP Update doesn't conflict with anything already in the zone, the registrar validates the update using SIG(0) against the public key in the KEY record of the Host Description Instruction. if validation fails, the update is malformed, and the registrar MUST reject it with the Refused RCODE 🙈. otherwise the SRP Update is valid and authentic, and it gets processed like a normal DNS Update [RFC2136] 🌸
KEY record updates that were left out of Service Description Instruction(s) are processed as if they had been explicitly present. after the SRP Update has been applied, every Service Description that gets updated MUST have a KEY RR, and that KEY RR MUST have the same value as the KEY RR in the Host Description that the Service Description refers to 🎀
the IETF spec for DNSSEC Resource Records [RFC4034] says the flags field in the KEY RR MUST be zero, except for bit 7, which can be one for a zone key. SRP requesters implementing this version of the SRP spec MUST set the flags field in the KEY RR to all zeroes 🫶. SRP registrars implementing this version MUST accept and store the flags field in the KEY RR exactly as received, without checking or changing its value 💜
3.3.4. Handling of Service Subtypes 🧚
SRP registrars MUST treat the update instructions for a service type and all its subtypes as atomic 👑. that means whatever shows up in the SRP Update is the whole story for that service and its subtypes. if a subtype was in a previous update but isn't in the current one, the SRP registrar MUST remove that subtype 💅
there's intentionally no way to delete one subtype on its own. deleting a service deletes all of its subtypes too 😭. so if you want to delete a single subtype, you have to build an SRP Update that includes the service type and all of its subtypes except the ones you're deleting. yes, it's a lot, but it's the rule 🍓
3.3.5. SRP Update Response 🦋
the status that comes back depends on how the update went, and it can be NoError, ServFail, Refused, or YXDomain ✨. every other possible outcome was already handled when the update was checked to see if it qualifies as an SRP Update. what these responses mean is explained in Section 2.2 of the DNS Update spec [RFC2136] 📖
for any response other than NoError, Section 3.8 of the DNS Update spec [RFC2136] says the authoritative DNS server is allowed to either send back no RRs or copy the RRs the DNS Update client sent into the response 🌈. the SRP requester MUST NOT attempt to validate any RRs included in the response 🙅♀️. a future SRP extension might add per-RR notes explaining why an update failed, but as of writing, that isn't specified 🔮. so if a requester tried to validate the RRs in a response anyway, it might reject a perfectly fine response, since it would contain RRs but probably not an identical set to what was sent in the SRP Update 💀
3.3.6. Optional Behavior 🌸
the SRP registrar MAY add a Reverse Mapping PTR record that corresponds to the Host Description 🔄. for IPv4 that's described in Section 3.5 of the DNS spec [RFC1035], and for IPv6 it's in Section 2.5 of the later document that updates DNS for IPv6 [RFC3596]. this is optional: the reverse mapping PTR record doesn't serve any essential protocol function 🙃. people usually add them so logs and network packet traces are easier to read 📝. for the registrar to do a reverse mapping update, it has to be authoritative for the zone that would need the update, or have credentials to do it 🔑. the SRP requester MAY also do a reverse mapping update if it has credentials to do so ✨
the SRP registrar MAY apply additional criteria when accepting updates 🛡️. some networks might be able to do out-of-band registration of keys and only accept updates from preregistered keys. in that case, an update for a key that hasn't been registered SHOULD be rejected with the Refused RCODE 🚫. if you want managed keys, doing this together with SRP has two big perks over just doing traditional DNS Updates with SIG(0) keys 💖:
- the same over-the-air registration protocol is used in both cases, so one SRP requester implementation can handle both use cases 🧩
- the Service Registration Protocol includes maintenance functionality that normal DNS updates don't have 🛠️
heads up, though: using SRP this way has different semantics from typical DNS Update implementations 👀. the KEY used to sign the SRP Update only lets the SRP requester update records that refer to its Host Description. traditional DNS Update implementations [RFC2136] don't usually offer a way to enforce a constraint like that 🙅♀️
the SRP registrar could also keep a dictionary of names or name patterns that aren't allowed 📕. if it does, updates for service instance names that match an entry in that dictionary get rejected with a Refused RCODE 💅
4. TTL Consistency ⏰
all RRs within an RRset are required to have the same TTL (that's required by Section 5.2 of the DNS Clarifications document [RFC2181]) 🧵. to avoid inconsistencies, SRP puts restrictions on the TTLs that requesters send, and it requires SRP registrars to enforce consistency 🔒
requesters sending SRP Updates MUST use consistent TTLs in all RRs within each RRset contained in an SRP Update 🎀. SRP registrars MUST check that the TTLs for all RRs within each RRset contained in an SRP Update are the same 🔍. if they aren't, the SRP update MUST be rejected with a Refused RCODE 🚫
also, when adding RRs to an RRset (like when processing Service Discovery records), the SRP registrar MUST use the same TTL on all RRs in that RRset ✨. how that consistency gets enforced is up to the implementation 🛠️
TTLs sent in SRP Updates are advisory 💭. they're the SRP requester's guess at what a good TTL would be. SRP registrars may override these TTLs 👑. SRP registrars SHOULD make sure TTLs are reasonable, meaning neither too long nor too short 🌷. the TTL SHOULD NOT ever be longer than the lease time (Section 5.1) ⏳. shorter TTLs mean data gets refreshed more often, which adds latency on the DNS-SD client side, adds load on caching resolvers and the authoritative DNS server, and also adds network load. that last one might be an issue for CNNs 📡. longer TTLs make it more likely that data in caches is stale 🥀. TTL minimums and maximums SHOULD be configurable by the operator of the SRP registrar 🎛️
5. Maintenance 🧹
5.1. Cleaning Up Stale Data
okay so bestie, the DNS-SD Service Registration Protocol is totally automatic and nobody's a human babysitter for it 🤖💅 which means we need some extra bookkeeping to keep things tidy ✨ 🧹 When an SRP requester builds an update, it MUST include an EDNS(0) Update Lease Option [RFC9664] 🎀. This option carries two lease times, the Lease Time and the KEY Lease Time 💖
It's giving DHCP leases [RFC2131] vibes 🦋. These leases are basically promises from the SRP requester that it'll send a fresh update for the service registration before the lease time runs out 🫶 The Lease Time is how long the registered records other than the KEY record can be assumed to be valid after the update 🌸 The KEY Lease Time is how long the KEY record can be assumed to be valid after the update 🔑 The reasoning behind having two different lease times is discussed in Sections 3.2.4.1 and 3.2.5.3 🧚
SRP registrars can be configured with limits for these values 💅 At the time of writing, a default limit of two hours for the Lease and 14 days for the SIG(0) KEY are thought to be good choices 🌈 Devices with limited battery that wake up infrequently are likely to ask for longer leases 🔋😴 so registrars that support those devices may need to set higher limits 💜
SRP requesters that are going to keep using names they hold leases on SHOULD refresh them well before the lease ends 🔁 That way, if the registrar is temporarily unavailable or under heavy load, they're not caught off guard 😭
The lease time applies specifically to the hostname 🏠 All service instances, and all service entries for those service instances, depend on the hostname 🧩 When the lease on a hostname expires, the hostname and every service that references it MUST be removed at the same time 💀 It is never valid for a service instance to stick around when the hostname it references has been removed 🙅♀️ If the KEY record for the hostname is going to remain, the KEY record for any services that reference it MUST also remain 🔐 However, the Service Discovery PTR record MUST be removed 🗑️ because it has no key associated with it, and it is never valid to have a Service Discovery PTR record when there's no service instance on the target of the PTR record 🙈
SRP registrars MUST also track a lease time per service instance 📋 The reason is that a requester may re-register a hostname with a different set of services and forget that some other service instance was previously registered 🫠 In that case, when that service instance lease expires, the SRP registrar MUST remove the service instance, plus any associated Service Discovery PTR records pointing to that service instance 🧹 (The KEY record for the service instance SHOULD be retained until the KEY lease on that service expires 🔑) This is so helpful because it stops stale services from continuing to be advertised after the SRP requester has forgotten all about them 👑
The SRP registrar MUST include an EDNS(0) Update Lease option in the response 📬 The requester MUST check for that option in the response, and when deciding when to renew its registration, the requester MUST use the lease times from the Update Lease option in the response instead of the lease times it originally asked for 🔄 The times may be shorter or longer than what was specified in the SRP Update 📏 The SRP requester must honor them either way 🫡
SRP requesters SHOULD assume that each lease ends N seconds after the update was first transmitted, where N is the granted lease duration ⏱️ SRP registrars SHOULD assume that each lease ends N seconds after the successfully processed update was received 📥 Since the registrar always receives the update after the SRP requester sent it, this avoids a race condition where the registrar removes a service too early while the requester still thinks the lease hasn't expired 🏃♀️💨 In addition, the SRP requester MUST begin trying to renew its lease ahead of the expected expiration time, as required by the DNS Update Lease specification [RFC9664] ⏰ This covers the situation where the clocks on the SRP requester and the SRP registrar don't tick at exactly the same rate ⏳
SRP registrars MUST reject updates that don't include an EDNS(0) Update Lease option 🚫 DNS authoritative servers that allow both SRP and non-SRP DNS updates MAY accept updates that don't include leases 🤷♀️ but they SHOULD tell SRP Updates apart from other updates, and they MUST reject updates that would otherwise count as SRP Updates if they don't include leases 🛑
Lease times and TTLs are completely different things, bestie 🙅♀️ On an authoritative DNS server, the TTL on a resource record is a constant 📌 Whenever that RR is served in a DNS response, the TTL value in the answer is the same every time 🔁 The lease time is never sent as a TTL 🚫 Its only job is to tell the authoritative DNS server when to delete stale records 🗓️ It is not an error to send a DNS response with a TTL of M when the remaining time on the lease is less than M 🫶
- Security Considerations 🔒✨
6.1. Source Validation 🕵️♀️
okay this part is SO important 😭🔐 SRP Updates have no authorization semantics other than "First Come, First Served" (FCFS) 🥇 So if an attacker from outside the administrative domain of the SRP registrar knows the registrar's IP address, they could, in principle, send updates that get processed successfully 😱 Therefore, SRP registrars SHOULD be configured to reject updates from source addresses outside the registrar's administrative domain 🚧
For TCP updates, the initial SYN-SYN+ACK handshake stops off-path attackers from forging updates 🤝 To make sure that handshake actually happens, SRP registrars relying on three-way-handshake validation MUST NOT accept TCP Fast Open payloads [RFC7413] 🙅♀️ If the network infrastructure allows it, an SRP registrar MAY accept TCP Fast Open payloads if all such packets are validated along the path and the network can reject this type of spoofing at every ingress point 🛡️
For UDP updates from CNN devices, spoofing has to be prevented with appropriate source address filtering on routers [RFC2827] 🧱 This would usually be done with measures like the ones in Section 4.5 of the IPv6 CE Router Requirements document [RFC7084] 🏠 For example, a stub router [SNAC-SIMPLE] for a CNN might only accept UDP updates from source addresses known to be on-link on that stub network 📡 and might also check that the UDP update was actually received on the stub network interface and not on the interface connected to the adjacent infrastructure link 🔍
6.2. Other DNS Updates 📮
Heads up, these rules only apply to validating SRP Updates 👀 An authoritative DNS server that accepts updates from SRP requesters may also accept other DNS Update messages, and those can be validated using different rules 🔀 But when an authoritative DNS server accepts SRP updates, the intersection of the SRP Update rules and whatever other update rules are present must be considered very carefully 🧐⚠️
For example, a normal authenticated DNS update to any RR that was added using SRP, but authenticated with a different key, could override a promise the SRP registrar made to an SRP requester 😤 It could replace all or part of the service registration information with information from an authenticated DNS update requester 💥 An implementation that allows both kinds of updates SHOULD NOT let DNS Update requesters using different authentication and authorization credentials update records added by SRP requesters 🙅♀️🔐
6.3. Risks of Allowing Arbitrary Names to be Registered in SRP Updates 🎭
It's possible to set up SRP Updates for a zone that's also used for non-DNS-SD records 🤔 For example, imagine you set up SRP service for "example.com" 🌐 SRP requesters can now register names like "www", "mail", or "smtp" in that domain 📧 Plus, SRP Updates using FCFS Naming can insert names that are obscene or offensive into the zone 😬 There's no simple solution to these problems 😮💨 However, we have two recommendations to address this 💡
- Don't provide SRP service in organization-level zones 🏢 Use subdomains of the organizational domain for DNS-SD instead 🧭 This doesn't stop people from registering names like we mentioned above, but it does make sure genuinely important names don't get accidentally claimed by SRP requesters 🙌 So, for example, the zone "dnssd.example.com." could be used instead of "example.com." for SRP Updates 💖 Because of the way DNS-browsing domains are discovered, the DNS-SD discovery zone that SRP updates doesn't need a user-friendly or important-sounding name 🤷♀️✨
- Configure a dictionary of prohibited names 🚫📖 Dictionaries of common obscene and offensive names are no doubt available, and they can be augmented with a list of typical "special" names like "www", "mail", "smtp", and so on 📚 Lists of names are generally available or can be built by hand ✍️ Names rejected because of this should return a Refused RCODE 🙅♀️ This tells the SRP requester not to append or increment a number at the end of the name and try again, since that would likely cause an infinite loop 🔁♾️ If a name is unacceptable because it's obscene or offensive, adding a number on the end is unlikely to make it acceptable 😂
6.4. Security of Local Service Discovery 🏘️
Local links can be protected by managed services such as RA Guard [RFC6105] 🛡️ but multicast services like DHCP [RFC2131], DHCPv6 [RFC8415], and IPv6 Neighbor Discovery [RFC4861] are, in most cases, not authenticated 😬 and they can't be controlled on unmanaged networks like home networks and small office networks where there's no network management staff 🏠 In those situations, the SRP service has comparatively fewer potential security exposures, so it isn't the weak link 💪 This is discussed in more detail in Section 3.2.4 🔎
The fundamental protection for networks like this is the user's choice of which devices to add to the network 👩💻✨ Work is being done in other working groups and standards bodies to improve network onboarding and device isolation (for example, Manufacturer Usage Descriptions [RFC8520] provide a way to automatically constrain what behaviors are allowed for a device) 🤖 but that work is out of scope for this document 🙇♀️
6.5. SRP Registrar Authentication 🪪
This specification doesn't provide a mechanism for validating responses from SRP registrars to SRP requesters 🙅♀️ In principle, a KEY RR could be used by a non-CNN SRP requester to validate responses from the registrar 🔑 but this isn't required, and we don't specify a way to figure out which key to use 🤔
Also, for DNS-over-TLS connections, out-of-band key pinning as described in Section 4.2 of the DNS-over-TLS specification [RFC7858] could be used to authenticate the SRP registrar 🔐 for example, to prevent man-in-the-middle attacks 🕴️ However, using such keys is impractical for an unmanaged service registration protocol, so it's out of scope for this document 💅
6.6. Required Signature Algorithm
okay bestie, let's talk signature algorithms 🔐✨ For validation, SRP registrars MUST implement ECDSAP256SHA256. That one's non-negotiable 💅 Registrars SHOULD also implement the algorithms from Section 3.1 of the DNSSEC Cryptographic Algorithms spec [RFC8624] that are numbered 13 or higher and have a "MUST", "RECOMMENDED", or "MAY" designation in the validation column of that table. And SRP requesters MUST NOT assume that any algorithm numbered lower than 13 is available for validating SIG(0) signatures 🙈 don't count on the old ones being there, bestie.
7. Privacy Considerations 🦋
okay so, DNS-SD SRP Updates can be sent off-link, which means the privacy vibes of SRP are totally different from mDNS responses 👀 SRP Requester implementations that are using TCP SHOULD also use DNS-over-TLS [RFC7858] if it's available. SRP registrar implementations MUST offer TLS support. There's no mechanism for sharing keys, so validating DNS-over-TLS keys isn't possible. DNS-over-TLS is only used for Opportunistic Privacy, as documented in Section 4.1 of the DNS-over-TLS specification [RFC7858] 🌸
SRP requesters that are able to use TLS SHOULD NOT fall back to TCP. Since all SRP registrars are required to support TLS, whether to use TLS is entirely the decision of the SRP requester 💖
Public keys can be used as identifiers to track hosts, so this one's a big deal 😭 SRP registrars MAY elect not to return KEY records for queries for SRP registrations. To avoid DNSSEC validation failures, an SRP registrar that signs the zone for DNSSEC but refuses to return a KEY record MUST NOT store the KEY record in the zone itself. Because the KEY record isn't in the zone, its nonexistence can be validated. If the zone is not signed, the authoritative DNS server MAY instead return a negative response (either NXDOMAIN or no data) ✨
8. Domain Name Reservation Considerations 🎀
This section is for systems involved in domain name resolution when they're resolving queries for names ending with .service.arpa.. Each item here covers some part of the DNS, or of resolving domain names, that this special-use allocation would affect. If you want the detailed explanations, check Section 5 of the Special-Use Domain Names specification [RFC6761] 🧚
8.1. Users
The current proposed use for service.arpa. doesn't need any special knowledge from the user 🍓 While the default.service.arpa. subdomain is used as a generic name for registration, users aren't expected to see it in user interfaces. If it does show up in one, it's just a domain name and needs no special treatment from the user.
8.2. Application Software
Application software doesn't need to handle subdomains of service.arpa. specially. service.arpa. SHOULD NOT be treated as more trustworthy than any other insecure DNS domain, just because it's locally served (or for any other reason) 🚫 It's not possible to register a PKI certificate for a subdomain of service.arpa. because it's a locally served domain name. So no such subdomain can be considered to uniquely identify a particular host, which is what would be needed for a PKI certificate to be issued. If a subdomain of service.arpa. gets returned by an API or entered into an application's input field, PKI authentication of the endpoint being identified by that name won't be possible. Alternative methods and practices for authenticating such endpoints are out of scope for this document 💅
8.3. Name Resolution APIs and Libraries
Name resolution APIs and libraries MUST NOT recognize names that end in service.arpa. as special, and MUST NOT treat them as having special significance. The one exception is that such APIs may need to avoid bypassing the locally discovered recursive resolvers 👑
One or more IP addresses for recursive resolvers will usually be supplied to the SRP requester through router advertisements or DHCP. For an administrative domain that uses subdomains of service.arpa., the recursive resolvers provided by that domain will be able to answer queries for those subdomains. Other (non-local) resolvers won't, or they'll give answers that aren't correct within that administrative domain 🙃
A host that's configured to use a resolver other than one provided by the local network may not be able to resolve names under service.arpa., or it may get incorrect results for them. To avoid this, hosts SHOULD use the locally provided resolvers for resolving service.arpa. names, even when they're configured to use other resolvers for other names 🫶
8.4. Recursive Resolvers
There are two considerations for recursive resolvers (also known as "caching DNS servers" or "recursive DNS servers") that follow this specification 🧁
- For correctness, recursive resolvers at sites using
'service.arpa.'must, in practice, transparently support DNSSEC queries: queries for DNSSEC records and queries with the DNSSEC OK (DO) bit set (Section 3.2.1 of the DNSSEC specification [RFC4035]). DNSSEC validation [RFC9364] is a best current practice. Although validation is not required, a caching recursive resolver that doesn't validate answers that can be validated may cache invalid data. In turn, that would stop validating stub resolvers from successfully validating answers 😩 So, as a practical matter, recursive resolvers at sites usingservice.arpa.should do DNSSEC validation. - Unless configured otherwise, recursive resolvers and DNS proxies MUST behave following the rules prescribed for Iterative Resolvers in Section 3 of the IETF Locally Served DNS Zones document [RFC6303]. That is, queries for
service.arpa.and subdomains ofservice.arpa.MUST NOT be forwarded, with one important exception: a query for a DS record with the DO bit set MUST return the correct answer for that question, including correct information in the authority section that proves the record is nonexistent.
So, for example, a query for the NS record for service.arpa. MUST NOT result in that query being forwarded to an upstream cache, nor to the authoritative DNS server for .arpa.. However, to provide accurate authority information, a query for the DS record MUST result in forwarding whatever queries are necessary. Typically, that will just be a query for the DS record, since the necessary authority information will be included in the authority section of the response if the DO bit is set 🌈
8.5. Authoritative DNS Servers
No special processing of service.arpa. is required for authoritative DNS server implementations. An authoritative DNS server might try to check the authoritative DNS servers for service.arpa. for a delegation beneath that name before answering authoritatively for such a delegated name. In that case, because the name always has only local significance, there won't be any such delegation in the service.arpa. zone. So the authoritative DNS server would refuse to answer authoritatively for such a zone 🤓 An authoritative DNS server that implements this sort of check MUST be configurable so that either it doesn't do this check for the service.arpa. domain, or it ignores the results of the check.
8.6. DNS Server Operators
DNS server operators MAY configure an authoritative DNS server for service.arpa. for use with SRP. The operator for the DNS servers that are authoritative for service.arpa. in the global DNS will configure any such DNS servers as described in Section 9 ⭐
8.7. DNS Registries/Registrars
service.arpa. is a subdomain of the arpa. top-level domain, which is operated by IANA under the authority of the Internet Architecture Board (IAB) [RFC3172]. There are no other DNS registrars for arpa. 🏛️
9. Delegation of "service.arpa." 🌷
The owner of the arpa. zone, at the time of writing, the IAB [IAB-ARPA], has added a delegation of service.arpa. in the arpa. zone [RFC3172], following the guidance provided in Section 7 of the "home.arpa." specification [RFC8375] ✨
10. IANA Considerations 📋
10.1. Registration and Delegation of "service.arpa." as a Special-Use Domain Name
IANA has recorded the domain name service.arpa. in the "Special-Use Domain Names" registry [SUDN]. IANA has implemented the delegation requested in Section 9 🎉
10.2. Addition of "service.arpa." to the Locally-Served Zones Registry
IANA has also added a new entry to the "Transport-Independent Locally-Served Zones Registry" registry of the "Locally-Served DNS Zones" group [LSDZ]. The entry is for the domain SERVICE.ARPA. with the description "DNS-SD Service Registration Protocol Special-Use Domain" and lists this document as the reference 🧚♀️
10.3. Subdomains of "service.arpa."
This document only makes use of the default.service.arpa. subdomain of service.arpa. Other subdomains are reserved for future use by DNS-SD or related work. IANA has created the "service.arpa. Subdomain" registry [SUB]. The IETF has change control for this registry. New entries may be added either as a result of Standards Action (Section 4.9 of the IANA Guidelines) or with IESG Approval (Section 4.10 of the IANA Guidelines) [RFC8126], provided that the values and their meanings are documented in a permanent and readily available public specification, in sufficient detail so that interoperability between independent implementations is possible 🔒
IANA has grouped the "service.arpa. Subdomain" registry with the "Locally-Served DNS Zones" group. The registry is a table with three columns: the subdomain name (expressed as a fully qualified domain name), a brief description of how it is used, and a reference to the document that describes its use in detail 💜
The initial contents of this registry are as follows:
+=======================+=================+===========+
| Subdomain Name | Description | Reference |
+=======================+=================+===========+
| default.service.arpa. | Default domain | RFC 9665 |
| | for SRP Updates | |
+-----------------------+-----------------+-----------+
Table 110.4. Service Name Registrations
IANA has added two new entries to the "Service Name and Transport Protocol Port Number Registry" [PORT]. The following subsections contain tables with the fields required by Section 8.1.1 of IANA's Procedures for Service Name allocation [RFC6335] 🌈
10.4.1. "dnssd-srp" Service Name 🎀
okay so this is the entry for the service name "dnssd-srp" 💖 it's a TCP service, and the whole thing is handled by the IESG as the assignee, with the IETF Chair as the contact, which is very official and very iconic 👑
+====================+=============================+
| Field Name | Value |
+====================+=============================+
| Service Name | dnssd-srp |
+--------------------+-----------------------------+
| Transport Protocol | tcp |
+--------------------+-----------------------------+
| Assignee | IESG <iesg@ietf.org> |
+--------------------+-----------------------------+
| Contact | IETF Chair <chair@ietf.org> |
+--------------------+-----------------------------+
| Description | DNS-SD Service Discovery |
+--------------------+-----------------------------+
| Reference | RFC 9665 |
+--------------------+-----------------------------+
| Port Number | None |
+--------------------+-----------------------------+
| Service Code | None |
+--------------------+-----------------------------+
Table 2no port number, no service code, just vibes 🦋 ngl that's giving minimalist
10.4.2. "dnssd-srp-tls" Service Name 🌈
and then we've got the TLS sibling, "dnssd-srp-tls" 🫶 same TCP transport, same IESG assignee, same IETF Chair contact, and the description literally says it's the TLS version 🔐 it's the secure bestie of the first one, periodt 💅
+====================+================================+
| Field Name | Value |
+====================+================================+
| Service Name | dnssd-srp-tls |
+--------------------+--------------------------------+
| Transport Protocol | tcp |
+--------------------+--------------------------------+
| Assignee | IESG <iesg@ietf.org> |
+--------------------+--------------------------------+
| Contact | IETF Chair <chair@ietf.org> |
+--------------------+--------------------------------+
| Description | DNS-SD Service Discovery (TLS) |
+--------------------+--------------------------------+
| Reference | RFC 9665 |
+--------------------+--------------------------------+
| Port Number | None |
+--------------------+--------------------------------+
| Service Code | None |
+--------------------+--------------------------------+
Table 310.5. Anycast Address 🧚
okay this one is cute ✨ IANA has allocated an IPv6 anycast address from the "IANA IPv6 Special-Purpose Address Registry" [IPv6], kind of like the Port Control Protocol [RFC6887] anycast address [RFC7723]. the point is to give everyone a fixed anycast address they can use as a destination for SRP Updates when no SRP registrar is explicitly configured 🍓 so if nobody set one up, there's still a default place to go, which is so thoughtful 🥺
the initial values for the registry look like this:
+======================+=============================+
| Attribute | Value |
+======================+=============================+
| Address Block | 2001:1::3/128 |
+----------------------+-----------------------------+
| Name | DNS-SD Service Registration |
| | Protocol Anycast Address |
+----------------------+-----------------------------+
| RFC | RFC 9665 |
+----------------------+-----------------------------+
| Allocation Date | 2024-04 |
+----------------------+-----------------------------+
| Termination Date | N/A |
+----------------------+-----------------------------+
| Source | True |
+----------------------+-----------------------------+
| Destination | True |
+----------------------+-----------------------------+
| Forwardable | True |
+----------------------+-----------------------------+
| Globally Reachable | True |
+----------------------+-----------------------------+
| Reserved-by-Protocol | False |
+----------------------+-----------------------------+
Table 4the address is 2001:1::3/128, it's allocated 2024-04 with no termination date, and it's source, destination, forwardable, and globally reachable (all True) but not reserved-by-protocol (False) 💜 very main character energy for an anycast address
11. References 📚
11.1. Normative References 💌
okay so these are the normative refs, the ones the spec leans on hardest 🫶 every single one is listed with its details, so here they are:
[RFC1035] Mockapetris, P., "Domain names - implementation and specification", STD 13, RFC 1035, DOI 10.17487/RFC1035, November 1987, <https://www.rfc-editor.org/info/rfc1035>.
[RFC1536] Kumar, A., Postel, J., Neuman, C., Danzig, P., and S. Miller, "Common DNS Implementation Errors and Suggested Fixes", RFC 1536, DOI 10.17487/RFC1536, October 1993, <https://www.rfc-editor.org/info/rfc1536>.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, <https://www.rfc-editor.org/info/rfc2119>.
[RFC2136] Vixie, P., Ed., Thomson, S., Rekhter, Y., and J. Bound, "Dynamic Updates in the Domain Name System (DNS UPDATE)", RFC 2136, DOI 10.17487/RFC2136, April 1997, <https://www.rfc-editor.org/info/rfc2136>.
[RFC2181] Elz, R. and R. Bush, "Clarifications to the DNS Specification", RFC 2181, DOI 10.17487/RFC2181, July 1997, <https://www.rfc-editor.org/info/rfc2181>.
[RFC2539] Eastlake 3rd, D., "Storage of Diffie-Hellman Keys in the Domain Name System (DNS)", RFC 2539, DOI 10.17487/RFC2539, March 1999, <https://www.rfc-editor.org/info/rfc2539>.
[RFC2782] Gulbrandsen, A., Vixie, P., and L. Esibov, "A DNS RR for specifying the location of services (DNS SRV)", RFC 2782, DOI 10.17487/RFC2782, February 2000, <https://www.rfc-editor.org/info/rfc2782>.
[RFC2931] Eastlake 3rd, D., "DNS Request and Transaction Signatures ( SIG(0)s )", RFC 2931, DOI 10.17487/RFC2931, September 2000, <https://www.rfc-editor.org/info/rfc2931>.
[RFC3172] Huston, G., Ed., "Management Guidelines & Operational Requirements for the Address and Routing Parameter Area Domain ("arpa")", BCP 52, RFC 3172, DOI 10.17487/RFC3172, September 2001, <https://www.rfc-editor.org/info/rfc3172>.
[RFC3596] Thomson, S., Huitema, C., Ksinant, V., and M. Souissi, "DNS Extensions to Support IP Version 6", STD 88, RFC 3596, DOI 10.17487/RFC3596, October 2003, <https://www.rfc-editor.org/info/rfc3596>.
[RFC4034] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, "Resource Records for the DNS Security Extensions", RFC 4034, DOI 10.17487/RFC4034, March 2005, <https://www.rfc-editor.org/info/rfc4034>.
[RFC4035] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, "Protocol Modifications for the DNS Security Extensions", RFC 4035, DOI 10.17487/RFC4035, March 2005, <https://www.rfc-editor.org/info/rfc4035>.
[RFC6303] Andrews, M., "Locally Served DNS Zones", BCP 163, RFC 6303, DOI 10.17487/RFC6303, July 2011, <https://www.rfc-editor.org/info/rfc6303>.
[RFC6763] Cheshire, S. and M. Krochmal, "DNS-Based Service Discovery", RFC 6763, DOI 10.17487/RFC6763, February 2013, <https://www.rfc-editor.org/info/rfc6763>.
[RFC7858] Hu, Z., Zhu, L., Heidemann, J., Mankin, A., Wessels, D., and P. Hoffman, "Specification for DNS over Transport Layer Security (TLS)", RFC 7858, DOI 10.17487/RFC7858, May 2016, <https://www.rfc-editor.org/info/rfc7858>.
[RFC8085] Eggert, L., Fairhurst, G., and G. Shepherd, "UDP Usage Guidelines", BCP 145, RFC 8085, DOI 10.17487/RFC8085, March 2017, <https://www.rfc-editor.org/info/rfc8085>.
[RFC8126] Cotton, M., Leiba, B., and T. Narten, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 8126, DOI 10.17487/RFC8126, June 2017, <https://www.rfc-editor.org/info/rfc8126>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, <https://www.rfc-editor.org/info/rfc8174>.
[RFC8375] Pfister, P. and T. Lemon, "Special-Use Domain 'home.arpa.'", RFC 8375, DOI 10.17487/RFC8375, May 2018, <https://www.rfc-editor.org/info/rfc8375>.
[RFC8624] Wouters, P. and O. Sury, "Algorithm Implementation Requirements and Usage Guidance for DNSSEC", RFC 8624, DOI 10.17487/RFC8624, June 2019, <https://www.rfc-editor.org/info/rfc8624>.
[RFC8765] Pusateri, T. and S. Cheshire, "DNS Push Notifications", RFC 8765, DOI 10.17487/RFC8765, June 2020, <https://www.rfc-editor.org/info/rfc8765>.
[RFC9364] Hoffman, P., "DNS Security Extensions (DNSSEC)", BCP 237, RFC 9364, DOI 10.17487/RFC9364, February 2023, <https://www.rfc-editor.org/info/rfc9364>.
[RFC9664] Cheshire, S. and T. Lemon, "An EDNS(0) Option to Negotiate Leases on DNS Updates", RFC 9664, DOI 10.17487/RFC9664, June 2025, <https://www.rfc-editor.org/info/rfc9664>.
11.2. Informative References ✨
Okay bestie, these are the "for your information" references, so they're not strictly required reading, but they're still super useful 💅 Every entry keeps its exact title, author list, date, and link.
[IAB-ARPA] "Internet Architecture Board statement on the registration of special use names in the ARPA domain", March 2017, <https://www.iab.org/documents/correspondence-reports-documents/2017-2/iab-statement-on-the-registration-of-special-use-names-in-the-arpa-domain/>.
[IPv6] IANA, "IANA IPv6 Special-Purpose Address Registry", <https://www.iana.org/assignments/iana-ipv6-special-registry>.
[LSDZ] IANA, "Locally-Served DNS Zones", <https://www.iana.org/assignments/locally-served-dns-zones>.
[PORT] IANA, "Service Name and Transport Protocol Port Number Registry", <https://www.iana.org/assignments/service-names-port-numbers>.
[RFC2131] Droms, R., "Dynamic Host Configuration Protocol", RFC 2131, DOI 10.17487/RFC2131, March 1997, <https://www.rfc-editor.org/info/rfc2131>.
[RFC2827] Ferguson, P. and D. Senie, "Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing", BCP 38, RFC 2827, DOI 10.17487/RFC2827, May 2000, <https://www.rfc-editor.org/info/rfc2827>.
[RFC3007] Wellington, B., "Secure Domain Name System (DNS) Dynamic Update", RFC 3007, DOI 10.17487/RFC3007, November 2000, <https://www.rfc-editor.org/info/rfc3007>.
[RFC3927] Cheshire, S., Aboba, B., and E. Guttman, "Dynamic Configuration of IPv4 Link-Local Addresses", RFC 3927, DOI 10.17487/RFC3927, May 2005, <https://www.rfc-editor.org/info/rfc3927>.
[RFC4861] Narten, T., Nordmark, E., Simpson, W., and H. Soliman, "Neighbor Discovery for IP version 6 (IPv6)", RFC 4861, DOI 10.17487/RFC4861, September 2007, <https://www.rfc-editor.org/info/rfc4861>.
[RFC4862] Thomson, S., Narten, T., and T. Jinmei, "IPv6 Stateless Address Autoconfiguration", RFC 4862, DOI 10.17487/RFC4862, September 2007, <https://www.rfc-editor.org/info/rfc4862>.
[RFC6105] Levy-Abegnoli, E., Van de Velde, G., Popoviciu, C., and J. Mohacsi, "IPv6 Router Advertisement Guard", RFC 6105, DOI 10.17487/RFC6105, February 2011, <https://www.rfc-editor.org/info/rfc6105>.
[RFC6335] Cotton, M., Eggert, L., Touch, J., Westerlund, M., and S. Cheshire, "Internet Assigned Numbers Authority (IANA) Procedures for the Management of the Service Name and Transport Protocol Port Number Registry", BCP 165, RFC 6335, DOI 10.17487/RFC6335, August 2011, <https://www.rfc-editor.org/info/rfc6335>.
[RFC6760] Cheshire, S. and M. Krochmal, "Requirements for a Protocol to Replace the AppleTalk Name Binding Protocol (NBP)", RFC 6760, DOI 10.17487/RFC6760, February 2013, <https://www.rfc-editor.org/info/rfc6760>.
[RFC6761] Cheshire, S. and M. Krochmal, "Special-Use Domain Names", RFC 6761, DOI 10.17487/RFC6761, February 2013, <https://www.rfc-editor.org/info/rfc6761>.
[RFC6762] Cheshire, S. and M. Krochmal, "Multicast DNS", RFC 6762, DOI 10.17487/RFC6762, February 2013, <https://www.rfc-editor.org/info/rfc6762>.
[RFC6887] Wing, D., Ed., Cheshire, S., Boucadair, M., Penno, R., and P. Selkirk, "Port Control Protocol (PCP)", RFC 6887, DOI 10.17487/RFC6887, April 2013, <https://www.rfc-editor.org/info/rfc6887>.
[RFC7084] Singh, H., Beebee, W., Donley, C., and B. Stark, "Basic Requirements for IPv6 Customer Edge Routers", RFC 7084, DOI 10.17487/RFC7084, November 2013, <https://www.rfc-editor.org/info/rfc7084>.
[RFC7228] Bormann, C., Ersue, M., and A. Keranen, "Terminology for Constrained-Node Networks", RFC 7228, DOI 10.17487/RFC7228, May 2014, <https://www.rfc-editor.org/info/rfc7228>.
[RFC7413] Cheng, Y., Chu, J., Radhakrishnan, S., and A. Jain, "TCP Fast Open", RFC 7413, DOI 10.17487/RFC7413, December 2014, <https://www.rfc-editor.org/info/rfc7413>.
[RFC7723] Kiesel, S. and R. Penno, "Port Control Protocol (PCP) Anycast Addresses", RFC 7723, DOI 10.17487/RFC7723, January 2016, <https://www.rfc-editor.org/info/rfc7723>.
[RFC8415] Mrugalski, T., Siodelski, M., Volz, B., Yourtchenko, A., Richardson, M., Jiang, S., Lemon, T., and T. Winters, "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)", RFC 8415, DOI 10.17487/RFC8415, November 2018, <https://www.rfc-editor.org/info/rfc8415>.
[RFC8520] Lear, E., Droms, R., and D. Romascanu, "Manufacturer Usage Description Specification", RFC 8520, DOI 10.17487/RFC8520, March 2019, <https://www.rfc-editor.org/info/rfc8520>.
[RFC8766] Cheshire, S., "Discovery Proxy for Multicast DNS-Based Service Discovery", RFC 8766, DOI 10.17487/RFC8766, June 2020, <https://www.rfc-editor.org/info/rfc8766>.
[RFC8945] Dupont, F., Morris, S., Vixie, P., Eastlake 3rd, D., Gudmundsson, O., and B. Wellington, "Secret Key Transaction Authentication for DNS (TSIG)", STD 93, RFC 8945, DOI 10.17487/RFC8945, November 2020, <https://www.rfc-editor.org/info/rfc8945>.
[ROADMAP] Cheshire, S., "Service Discovery Road Map", Work in Progress, Internet-Draft, draft-cheshire-dnssd-roadmap-03, 23 October 2018, <https://datatracker.ietf.org/doc/html/draft-cheshire-dnssd-roadmap-03>.
[SNAC-SIMPLE] Lemon, T. and J. Hui, "Automatically Connecting Stub Networks to Unmanaged Infrastructure", Work in Progress, Internet-Draft, draft-ietf-snac-simple-06, 4 November 2024, <https://datatracker.ietf.org/doc/html/draft-ietf-snac-simple-06>.
[SUB] IANA, "service.arpa Subdomain", <https://www.iana.org/assignments/locally-served-dns-zones/locally-served-dns-zones>.
[SUDN] IANA, "Special-Use Domain Names", <https://www.iana.org/assignments/special-use-domain-names>.
[ZC] Steinberg, D.H. and S. Cheshire, "Zero Configuration Networking: The Definitive Guide", O'Reilly Media, Inc., ISBN 9780596101008, December 2005.
Appendix A. Using Standard Authoritative DNS Servers Compliant with RFC 2136 to Test SRP Requesters 🧪
Okay so for testing, it can be super handy to set up an authoritative DNS server that doesn't implement SRP 🌸 You can do this by having it listen on the anycast address, or by advertising it in the _dnssd-srp._tcp.<zone> and _dnssd-srp-tls._tcp.<zone> SRV records. It MUST be configured to be authoritative for default.service.arpa. and to accept updates from hosts on local networks for names under default.service.arpa. without authentication, since those servers won't have support for FCFS authentication (Section 3.2.4.1). 💅
An authoritative DNS server set up this way will be able to accept and process SRP Updates from requesters that send them, which is so iconic 🙌 However, no prerequisites get applied, so the test server will accept internally inconsistent SRP Updates and won't stop two SRP Updates from different services that claim the same name or names from overwriting each other 💀
Since SRP Updates are signed with keys, you can validate the SIG(0) algorithm used by the requester by manually installing the requester's public key on the authoritative DNS server that's receiving the updates 🔑 The key can then be used to authenticate the SRP Update, and it can be used as a requirement for the update. There's an example configuration for testing SRP using BIND 9 in Appendix C 🦋
Appendix B. How to Allow SRP Requesters to Update Standard Servers Compliant with RFC 2136 🎀
Okay so normally, SRP Updates sent to an authoritative DNS server that implements standard DNS Update [RFC2136] but not SRP will fail 😭 That's because the zone being updated is default.service.arpa., and no authoritative DNS server that isn't an SRP registrar would normally be configured to be authoritative for default.service.arpa.. So a requester that sends an SRP Update can tell that the receiving server doesn't support SRP but does support standard DNS Update [RFC2136], because the RCODE will be NotZone, NotAuth, or Refused, or because there's no response to the update request (when using the anycast address) 🔍
In this case, a requester MAY try to register itself using normal DNS updates [RFC2136] ✨ To do that, it has to discover the default registration zone and the authoritative DNS server designated to receive updates for that zone, as described earlier, using the _dns-update._udp SRV record. Then it can send the update to the port and host pointed to by the SRV record, and it's expected to use appropriate prerequisites so it doesn't overwrite competing records. Honestly these updates are out of scope for SRP 🙈 So a requester that implements SRP MUST first attempt to use SRP to register itself, and only try the backwards-compatible normal DNS Update [RFC2136] if that fails. 🫶 Although the owner name of the SRV record for DNS Update (_dns-update._udp) specifies UDP, it's also possible to use TCP, and TCP SHOULD be required to prevent spoofing 🛡️
Appendix C. Sample BIND 9 Configuration for default.service.arpa. 🍓
Here's the BIND 9 setup, so you can see exactly what it looks like 🧚
zone "default.service.arpa." {
type primary;
file "/etc/bind/primary/service.db";
allow-update { key demo.default.service.arpa.; };
};Figure 1: Zone Configuration in named.conf
$TTL 57600 ; 16 hours
@ IN SOA ns postmaster (
2951053287 ; serial
3600 ; refresh (1 hour)
1800 ; retry (30 minutes)
604800 ; expire (1 week)
3600 ; minimum (1 hour)
)
NS ns
ns AAAA 2001:db8:0:2::1
$TTL 3600 ; 1 hour
; Autoconguration bootstrap records
_dnssd-srp._tcp SRV 0 0 53 ns
_dnssd-srp-tls._tcp SRV 0 0 853 ns
; Service Discovery Instruction
_ipps._tcp PTR demo._ipps._tcp
; Service Description Instruction
demo._ipps._tcp SRV 0 0 631 demohost
TXT ""
; Host Description Instruction
demohost AAAA 2001:db8:0:2::2
KEY 0 3 13 (
qweEmaaq0FAWok5//ftuQtZgiZoiFSUsm0srWREdywQU
9dpvtOhrdKWUuPT3uEFF5TZU6B4q1z1I662GdaUwqg==
); alg = ECDSAP256SHA256 ; key id = 14495Figure 2: Example Zone File
Acknowledgments 🫶✨
Okay bestie, huge thanks to Toke Høiland-Jørgensen, Jonathan Hui, Esko Dijk, Kangping Dong, and Abtin Keshavarzian for their thorough technical reviews 🧐💖. Kangping and Abtin also get extra love for testing the document by doing an independent implementation 🔥. Tamara Kemper gets a shoutout for a super nice developmental edit 🎀, and Tim Wattenberg made an SRP requester proof-of-concept at the Montreal Hackathon at IETF 102 💅. Tom Pusateri reviewed during the hackathon and afterwards, which is iconic 👑.
Esko gets another round of applause for a really thorough second Last Call review 😭. Nathan Dyck, Gabriel Montenegro, Kangping Dong, Martin Turon, and Michael Cowan also gave detailed second Last Call reviews, and I'm obsessed with that level of care 🦋. Patrik Fältström, Dhruv Dhody, David Dong, Joey Salazar, Jean-Michel Combes, and Joerg Ott each did their directorate reviews 🌸.
Paul Wouters did a really detailed IESG review, and it's giving main character energy 🌈💜. Thanks also to the other IESG members who left comments or just took the time to read the document through ⭐.
Authors' Addresses 💌
Here are the people who wrote this, with their contact info 🍓:
Ted Lemon
Apple Inc.
One Apple Park Way
Cupertino, CA 95014
United States of America
Email: mellon@fugue.com
Stuart Cheshire
Apple Inc.
One Apple Park Way
Cupertino, CA 95014
United States of America
Phone: +1 408 974 3207
Email: cheshire@apple.com📦 where this page comes from
- ietf: rfc9665 2025-06
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms