Areas / DNS

DNS

Names to addresses: resolvers, zones, DNSSEC.

411 RFCs · 411 with ISO Plain Language · 0 summaries · 0 index pages

With ISO Plain Language 411

RFC 1035 DNS Implementation Domain Names - Implementation and Specification The wire format, resource records, and transport details that make DNS work RFC 1034 DNS Concepts Domain Names - Concepts and Facilities The hierarchical naming system that maps human-readable names to IP addresses RFC 4034 DNSSEC Records Resource Records for the DNS Security Extensions The four record types that let DNS answers carry proof of where they came from. RFC 4035 DNSSEC Protocol Protocol Modifications for the DNS Security Extensions The rules that make signed DNS data servable, cacheable and checkable, from zone signing to the chain of trust. RFC 4033 DNSSEC Introduction DNS Security Introduction and Requirements The overview of how DNS answers get digital signatures, and what those signatures can and cannot promise. RFC 2308 DNS Negative Caching Negative Caching of DNS Queries How a resolver remembers that a name or record does not exist, and for how long. RFC 5155 NSEC3 DNS Security (DNSSEC) Hashed Authenticated Denial of Existence DNSSEC denial proofs based on hashed names, with an option to omit unsigned delegations from the chain. RFC 2782 DNS SRV A DNS RR for specifying the location of services (DNS SRV) Locating network services by name, protocol, and domain using DNS RFC 2136 Dynamic DNS Dynamic Updates in the Domain Name System (DNS UPDATE) A DNS message for making conditional, all-or-nothing changes to a zone while it is served. RFC 3597 Unknown DNS RRs Handling of Unknown DNS Resource Record (RR) Types How DNS software can pass along record types it does not recognize. RFC 6891 EDNS(0) Extension Mechanisms for DNS (EDNS(0)) How DNS grew past its 512-byte limit without breaking the servers that never heard of it. RFC 6698 DANE TLSA The DNS-Based Authentication of Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA How DNSSEC-protected TLSA records associate a domain and service with a certificate or key. RFC 3596 DNS AAAA Record DNS Extensions to Support IP Version 6 The AAAA record and IP6.ARPA domain let DNS store IPv6 addresses and look them up by address. RFC 5731 EPP Domain Mapping Extensible Provisioning Protocol (EPP) Domain Name Mapping The EPP XML commands and attributes used to create, inspect, renew, transfer, and update domain objects. RFC 7858 DNS over TLS Specification for DNS over Transport Layer Security (TLS) How DNS queries get wrapped in TLS on port 853 so eavesdroppers cannot read them. RFC 7766 DNS over TCP DNS Transport over TCP - Implementation Requirements Why DNS implementations must support TCP and how to handle its connections efficiently. RFC 7344 CDS / CDNSKEY Automating DNSSEC Delegation Trust Maintenance How a child DNS zone can publish desired delegation key data for its parent. RFC 6763 DNS-SD DNS-Based Service Discovery How ordinary DNS records let clients browse for services and find the host and port of a chosen instance. RFC 9083 RDAP JSON JSON Responses for the Registration Data Access Protocol (RDAP) A shared JSON format for registry answers about domains, nameservers, people, IP networks, and AS numbers. RFC 1183 DNS RR Types New DNS RR Definitions Five experimental DNS record types: AFS server locations, a responsible person, X.25 and ISDN addresses, and route-through bindings. RFC 5011 DNSSEC Anchor Updates Automated Updates of DNS Security (DNSSEC) Trust Anchors How a validating resolver can accept and retire DNSSEC trust-anchor keys automatically. RFC 9082 RDAP Queries Registration Data Access Protocol (RDAP) Query Format URL path patterns for looking up registration information through RDAP. RFC 8945 TSIG Secret Key Transaction Authentication for DNS (TSIG) Authenticate DNS requests and responses with a shared secret and a keyed hash. RFC 5890 IDNA2008 Internationalized Domain Names for Applications (IDNA): Definitions and Document Framework The shared definitions behind the revised internationalized domain-name system. RFC 3492 Punycode Punycode: A Bootstring encoding of Unicode for Internationalized Domain Names in Applications (IDNA) How a domain label in any script is squeezed into letters, digits and hyphens. RFC 3958 DDDS SRV Application Domain-Based Application Service Location Using SRV RRs and the Dynamic Delegation Discovery Service (DDDS) Use DNS records to find a service by domain, service type, and protocol. RFC 2874 DNS A6 Records DNS Extensions to Support IPv6 Address Aggregation and Renumbering A now-Historic plan to store IPv6 addresses in the DNS as chains of prefix records, so whole networks could be renumbered. RFC 5892 IDNA2008 The Unicode Code Points and Internationalized Domain Names for Applications (IDNA) The procedure for deciding which Unicode code points can appear in IDN labels. RFC 8553 DNS Attrleaf Fixes DNS Attrleaf Changes: Fixing Specifications That Use Underscored Node Names Align older underscored DNS names with the shared IANA registry. RFC 9224 RDAP Bootstrap Finding the Authoritative Registration Data Access Protocol (RDAP) Service How an RDAP client finds which registration-data server to query for a domain, address or AS number. RFC 3225 DNSSEC DO bit Indicating Resolver Support of DNSSEC A bit in an EDNS0 query tells a DNS server whether the resolver can accept DNSSEC records. RFC 3403 DDDS DNS database Dynamic Delegation Discovery System (DDDS) Part Three: The Domain Name System (DNS) Database How DNS stores DDDS rules that turn an identifier into the next name to look up. RFC 3110 DNSSEC RSA RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS) Specifies RSA public keys and RSA/SHA-1 signatures for DNSSEC records. RFC 5891 IDNA2008 Internationalized Domain Names in Applications (IDNA): Protocol Defines how applications register and look up domain names that contain non-ASCII labels. RFC 8198 Aggressive NSEC Aggressive Use of DNSSEC-Validated Cache Let a validating DNS resolver answer from cached proofs about ranges of names. RFC 6147 DNS64 DNS64: DNS Extensions for Network Address Translation from IPv6 Clients to IPv4 Servers How DNS64 gives IPv6-only clients synthesized addresses for IPv4-only servers. RFC 952 HOSTS.TXT DoD Internet host table specification The official format of HOSTS.TXT, the single file that listed every host name, address and service on the early Internet. RFC 8078 CDS/CDNSKEY Managing DS Records from the Parent via CDS/CDNSKEY Lets a child DNS zone ask its parent to add, update or remove DS records using CDS or CDNSKEY. RFC 3226 DNSSEC and IPv6 A6 aware server/resolver message size requirements Larger DNS answers need EDNS0 support from software that handles DNSSEC or IPv6 A6 records. RFC 8484 DNS over HTTPS DNS Queries over HTTPS (DoH) Carrying every DNS question and answer inside an ordinary HTTPS request RFC 1995 DNS IXFR Incremental Zone Transfer in DNS How DNS servers transfer zone changes instead of sending a complete zone each time. RFC 2930 TKEY Secret Key Establishment for DNS (TKEY RR) A DNS resource record for establishing and deleting shared secret keys between resolvers and servers. RFC 3007 Secure DNS Update Secure Domain Name System (DNS) Dynamic Update Secure DNS updates authenticate the requester, then apply the zone administrator's local permissions. RFC 9499 DNS terminology DNS Terminology One place to look up what DNS terms mean today, from labels and zones to resolvers and DNSSEC states. RFC 6762 mDNS Multicast DNS Zero-configuration DNS resolution on local networks using multicast RFC 7873 DNS Cookies Domain Name System (DNS) Cookies A DNS option helps each side detect forged requests and replies. RFC 1982 Serial Number Arithmetic Rules for comparing and incrementing counters that wrap back to zero, including DNS zone serial numbers. RFC 2536 DSA in DNS DSA KEYs and SIGs in the Domain Name System (DNS) The field layouts for DSA public keys and signatures in DNS KEY and SIG records. RFC 5936 AXFR DNS Zone Transfer Protocol (AXFR) How DNS transfers a complete zone over TCP, including the framing and integrity rules clients must follow. RFC 1536 DNS Errors Common DNS Implementation Errors and Suggested Fixes Common DNS implementation errors that cause unnecessary queries, with fixes proposed in 1993. RFC 9364 DNSSEC DNS Security Extensions (DNSSEC) One document that gathers the DNSSEC standards and says to use them. RFC 2931 SIG(0) DNS Request and Transaction Signatures ( SIG(0)s ) How a DNS message can carry a public-key signature that proves who sent a request or answered it. RFC 7477 CSYNC Child-to-Parent Synchronization in DNS Lets a child DNS zone ask its parent to update the delegation records it holds. RFC 3646 DNS Configuration options for Dynamic Host Configuration Protocol for IPv6 (DHCPv6) Two DHCPv6 options that tell a host which DNS servers to use and which domain names to try. RFC 2163 MCGAM in DNS Using the Internet DNS to Distribute MIXER Conformant Global Address Mapping (MCGAM) How a mail gateway finds the rule that turns an X.400 address into a domain name. RFC 4398 DNS CERT Record Storing Certificates in the Domain Name System (DNS) A DNS record for holding certificates and revocation lists where a name server can serve them. RFC 6303 Locally Served DNS Zones Locally Served DNS Zones Why DNS servers should answer reverse lookups for private address space themselves instead of passing the queries on. RFC 6761 Special-use domain names Special-Use Domain Names When a domain name may be reserved for special handling, how to ask for it, and the first names on the list. RFC 9460 SVCB and HTTPS records Service Binding and Parameter Specification via the DNS (SVCB and HTTPS Resource Records) DNS records that tell a client where to connect and how. RFC 6116 ENUM The E.164 to Uniform Resource Identifiers (URI) Dynamic Delegation Discovery System (DDDS) Application (ENUM) Giving telephone numbers a domain name, so the DNS can say which services they reach. RFC 2317 Classless in-addr.arpa Classless IN-ADDR.ARPA delegation Lets small address blocks run their own reverse DNS zone. RFC 8145 Trust Anchor Signaling Signaling Trust Anchor Knowledge in DNS Security Extensions (DNSSEC) How a DNSSEC validating resolver can tell a server which trust anchor keys it uses, so key rollovers can be watched. RFC 3833 DNS Threat Analysis Threat Analysis of the Domain Name System (DNS) A threat analysis of DNS and an assessment of which attacks the DNS Security Extensions can address. RFC 1996 DNS NOTIFY A Mechanism for Prompt Notification of Zone Changes (DNS NOTIFY) Lets a DNS master tell its secondaries that a zone has changed. RFC 3363 IPv6 addresses in DNS Representing Internet Protocol version 6 (IPv6) Addresses in the Domain Name System (DNS) A standards-status decision on AAAA, A6, and bit-label approaches for IPv6 in DNS. RFC 5452 DNS Forged Answers Measures for Making DNS More Resilient against Forged Answers Making a DNS resolver much harder to trick with a made-up answer. RFC 5625 DNS proxy guidelines DNS Proxy Implementation Guidelines How a home router should relay DNS questions and answers without breaking modern DNS features. RFC 6781 DNSSEC operations v2 DNSSEC Operational Practices, Version 2 Operational choices for signing DNS zones, handling keys, and keeping validation working. RFC 5893 IDNA Bidi Right-to-Left Scripts for Internationalized Domain Names for Applications (IDNA) The six-part rule that decides which right-to-left domain labels are safe to display in IDNA2008. RFC 8914 Extended DNS Errors Extended DNS Errors A way for DNS servers to say why a query failed, not just that it failed. RFC 881 Domain Names Plan Domain names plan and schedule The planned transition from a central host table to delegated domains and domain servers. RFC 1591 DNS Structure Domain Name System Structure and Delegation How DNS names are organized and how responsibility for domains is delegated. RFC 4701 DHCID RR A DNS Resource Record (RR) for Encoding Dynamic Host Configuration Protocol (DHCP) Information (DHCID RR) A DNS record that stores a hashed DHCP client identity next to a name, so updaters can tell whose name it is. RFC 5679 802.21 DNS Discovery Locating IEEE 802.21 Mobility Services Using DNS How a mobile device uses DNS NAPTR and SRV records to find IEEE 802.21 handover servers. RFC 5702 RSA/SHA-2 DNSSEC Use of SHA-2 Algorithms with RSA in DNSKEY and RRSIG Resource Records for DNSSEC How DNSSEC keys and signatures are made with RSA and the SHA-256 and SHA-512 hash functions. RFC 5864 AFS SRV Records DNS SRV Resource Records for AFS How AFS clients find a cell's database servers with DNS SRV records instead of the old AFSDB record. RFC 8552 Underscored DNS Names Scoped Interpretation of DNS Resource Records through "Underscored" Naming of Attribute Leaves How DNS names that start with an underscore scope a record to its parent domain, and the IANA registry that keeps them from colliding. RFC 5910 DNSSEC EPP Domain Name System (DNS) Security Extensions Mapping for the Extensible Provisioning Protocol (EPP) How a registrar tells a domain registry which keys sign a name, using an extension to the EPP domain mapping. RFC 9156 QNAME Minimisation DNS Query Name Minimisation to Improve Privacy A DNS resolver sends only the part of a name each server needs, so the names it looks up stay private. RFC 4470 Minimally covering NSEC Minimally Covering NSEC Records and DNSSEC On-line Signing Small, on-demand NSEC records that stop a signed zone's names from being collected by walking the NSEC chain. RFC 4592 DNS wildcards The Role of Wildcards in the Domain Name System Precise rules for when a DNS wildcard answers a query, and how wildcards and CNAME records interact. RFC 4697 DNS resolver misbehavior Observed DNS Resolution Misbehavior What the authors saw DNS resolvers doing wrong at the root and com/net servers, and how to stop it. RFC 4704 DHCPv6 FQDN option The Dynamic Host Configuration Protocol for IPv6 (DHCPv6) Client Fully Qualified Domain Name (FQDN) Option How a DHCPv6 client tells the server its domain name, and who then updates the DNS records. RFC 4848 U-NAPTR Domain-Based Application Service Location Using URIs and the Dynamic Delegation Discovery Service (DDDS) A small extension to S-NAPTR that lets a DNS record point straight at a URI for a domain's service. RFC 8310 DoT/DoDTLS Profiles Usage Profiles for DNS over TLS and DNS over DTLS Two usage profiles, Strict and Opportunistic, and the ways a DNS client can check it is really talking to its encrypted DNS server. RFC 6672 DNAME DNAME Redirection in the DNS A DNS record that redirects a whole subtree of names to another part of the name tree. RFC 8005 HIP DNS Extension Host Identity Protocol (HIP) Domain Name System (DNS) Extension A DNS record type that publishes a HIP host's public key, its tag and its rendezvous servers. RFC 9904 DNSSEC algo updates DNSSEC Cryptographic Algorithm Recommendation Update Process How the list of DNSSEC algorithms that software must support is kept, and how it changes over time. RFC 5855 Reverse DNS Nameservers Nameservers for IPv4 and IPv6 Reverse Zones Fixed names for the servers that answer reverse DNS lookups for IPv4 and IPv6 addresses. RFC 4702 DHCPv4 FQDN option The Dynamic Host Configuration Protocol (DHCP) Client Fully Qualified Domain Name (FQDN) Option A DHCP option that carries a client's domain name and says who updates the DNS records for it. RFC 7830 EDNS(0) Padding The EDNS(0) Padding Option A DNS option that lets clients and servers add filler bytes so encrypted messages reveal less through their size. RFC 9103 XFR over TLS DNS Zone Transfer over TLS Encrypting DNS zone transfers, both full and incremental, with TLS 1.3 so that a passive observer cannot collect a zone. RFC 9463 DNR DHCP and Router Advertisement Options for the Discovery of Network-designated Resolvers (DNR) DHCP and IPv6 Router Advertisement options that let a network tell hosts where its encrypted DNS resolvers are. RFC 7720 DNS Root Requirements DNS Root Name Service Protocol and Deployment Requirements The short list of protocol and deployment rules that every DNS root name service must follow. RFC 920 Domain requirements A 1984 policy memo on domain administration and the initial top-level domains. RFC 7871 EDNS Client Subnet Client Subnet in DNS Queries How DNS resolvers can share a limited part of a client's network address with authoritative servers. RFC 2535 DNSSEC Domain Name System Security Extensions An early DNS security design using signed records, public keys and authenticated denial of existence. RFC 6605 ECDSA for DNSSEC Elliptic Curve Digital Signature Algorithm (DSA) for DNSSEC Defines ECDSA with the P-256 and P-384 curves as DNSSEC signing algorithms, plus SHA-384 DS records. RFC 7671 DANE Updates The DNS-Based Authentication of Named Entities (DANE) Protocol: Updates and Operational Guidance Which DANE records to publish, how to change keys without breaking service, and what DNSSEC has to guarantee. RFC 8020 NXDOMAIN NXDOMAIN: There Really Is Nothing Underneath If a domain name does not exist, nothing underneath it exists either, and a resolver should cache it that way. RFC 8490 DSO DNS Stateful Operations A DNS operation for managing the settings of a long-lived DNS connection. RFC 9462 DDR Discovery of Designated Resolvers How a device that only knows a DNS server's IP address can find out whether that server offers encrypted DNS, and verify it. RFC 9615 DNSSEC bootstrapping Automatic DNSSEC Bootstrapping Using Authenticated Signals from the Zone's Operator How a DNS operator can publish signed hints that let a parent zone safely switch on DNSSEC for a new delegation. RFC 897 DNS schedule Domain name system implementation schedule The 1984 schedule for replacing flat host names with domain-style names. RFC 2182 Secondary DNS Servers Selection and Operation of Secondary DNS Servers How many backup DNS servers a zone needs, where to put them, and how to fix a broken zone serial number. RFC 2539 DH in DNS Storage of Diffie-Hellman Keys in the Domain Name System (DNS) How to publish Diffie-Hellman public keys in DNS KEY records, with a table of well-known prime and generator pairs. RFC 9276 NSEC3 Guidance Guidance for NSEC3 Parameter Settings How to set the NSEC3 hash algorithm, iteration count, salt and opt-out flag in a DNSSEC-signed zone. RFC 1706 DNS NSAP records DNS NSAP Resource Records How DNS records associate domain names with OSI network service access point addresses. RFC 4025 IPSECKEY A Method for Storing IPsec Keying Material in DNS A DNS record type that publishes the public key, and optionally the gateway, for setting up an IPsec tunnel. RFC 4255 SSHFP Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints Publish a fingerprint of an SSH server's key in DNS, signed with DNSSEC, so clients can check it instead of trusting blindly. RFC 4509 SHA-256 in DS records Use of SHA-256 in DNSSEC Delegation Signer (DS) Resource Records (RRs) How DNSSEC parent zones can publish a SHA-256 fingerprint of a child zone's key instead of only a SHA-1 one. RFC 4703 DHCP FQDN conflicts Resolution of Fully Qualified Domain Name (FQDN) Conflicts among Dynamic Host Configuration Protocol (DHCP) Clients How DHCP clients and servers use a DHCID record in the DNS to tell whose hostname is whose. RFC 7673 DANE with SRV Using DNS-Based Authentication of Named Entities (DANE) TLSA Records with SRV Records How a client finds and checks TLSA records when it locates a TLS server through SRV records. RFC 7828 edns-tcp-keepalive The edns-tcp-keepalive EDNS0 Option A DNS option that lets a server tell clients how long an idle TCP connection may stay open. RFC 8590 EPP Change Poll Change Poll Extension for the Extensible Provisioning Protocol (EPP) How an EPP server tells a registrar what changed on its objects, by whom and why, when the registrar did not make the change. RFC 9250 DoQ DNS over Dedicated QUIC Connections How to carry DNS queries and answers over QUIC, one stream per question, with TLS-style privacy and low latency. RFC 2826 Unique DNS root IAB Technical Comment on the Unique DNS Root Why the IAB argues that public DNS names need one coordinated root. RFC 3743 JET IDN Guidelines Joint Engineering Team (JET) Guidelines for Internationalized Domain Names (IDN) Registration and Administration for Chinese, Japanese, and Korean Guidelines for registering CJK domain labels and handling similar character variants. RFC 5358 Preventing Use of Recursive Nameservers in Reflector Attacks How to stop open DNS resolvers from being turned into amplifiers for denial of service attacks. RFC 5782 DNSBL DNS Blacklists and Whitelists How DNS-based lists publish and answer queries about IP addresses and domains. RFC 5933 GOST DNSSEC Use of GOST Signature Algorithms in DNSKEY and RRSIG Resource Records for DNSSEC How GOST signature and hash algorithms are represented in DNSSEC records. RFC 7583 DNSSEC Key Rollover DNSSEC Key Rollover Timing Considerations How to time DNSSEC key changes so cached keys and signatures remain consistent. RFC 9210 DNS Transport over TCP - Operational Requirements Why blocking DNS over TCP breaks things, and why operators must allow it alongside UDP. RFC 8806 Local root server copy Running a Root Server Local to a Resolver How a recursive resolver can serve a local copy of the DNS root zone. RFC 5001 DNS NSID DNS Name Server Identifier (NSID) Option A DNS option that lets a name server say which one of many identical-looking servers answered. RFC 6452 IDNA Unicode 6.0 The Unicode Code Points and Internationalized Domain Names for Applications (IDNA) - Unicode 6.0 IETF consensus on Unicode 6.0 character changes and IDNA derived properties. RFC 6975 Signaling Cryptographic Algorithm Understanding in DNS Security Extensions (DNSSEC) How a DNSSEC validating resolver tells servers which signature and hash algorithms it understands. RFC 8765 DNS Push Notifications DNS Push Notifications Lets a DNS client subscribe to record changes over a long-lived TLS connection instead of polling for them. RFC 8767 Serve-stale DNS Serving Stale Data to Improve DNS Resiliency Lets DNS resolvers answer with expired records when the authoritative servers cannot be reached. RFC 9077 NSEC TTLs NSEC and NSEC3: TTLs and Aggressive Use Fixes the TTL rules for NSEC and NSEC3 records so that cached 'this name does not exist' proofs expire when the zone operator intended. RFC 9461 SVCB for DNS servers Service Binding Mapping for DNS Servers How a named DNS server can advertise encrypted transports such as DoT, DoH and DoQ using SVCB records. RFC 9471 DNS glue requirements DNS Glue Requirements in Referral Responses When a DNS referral cannot fit all the in-domain glue, the server must say so with the TC flag. RFC 6742 ILNP DNS records DNS Resource Records for the Identifier-Locator Network Protocol (ILNP) DNS records that separate a node's identity from its location. RFC 8094 DNS over DTLS DNS over Datagram Transport Layer Security (DTLS) Wrapping DNS queries in DTLS over UDP port 853 so eavesdroppers cannot read them, as an experimental backup to DNS over TLS. RFC 2694 DNS_ALG DNS extensions to Network Address Translators (DNS_ALG) How DNS answers can reflect address translation between private and external networks. RFC 4290 IDN registration Suggested Practices for Registration of Internationalized Domain Names (IDN) A framework for registries to manage confusing character variants in internationalized domain names. RFC 4690 IDN review Review and Recommendations for Internationalized Domain Names (IDNs) The IAB reviews internationalized domain-name problems and recommends areas for further work RFC 1480 US Domain The US Domain The 1993 plan for organizing names under the United States top-level domain. RFC 9076 DNS Privacy DNS Privacy Considerations An analysis of what DNS queries reveal and which parties can observe them. RFC 9609 DNS priming queries Initializing a DNS Resolver with Priming Queries The first question a DNS resolver asks to learn where the root servers are, and how to ask it safely. RFC 10001 DNS in mixed IPv4/IPv6 Operational Guidelines for DNS Transport in Mixed IPv4/IPv6 Environments How to keep DNS working when some networks speak only IPv4 and others only IPv6. RFC 2845 TSIG Secret Key Transaction Authentication for DNS (TSIG) How DNS peers use a shared secret to authenticate individual messages. RFC 1033 Domain Administrators Operations Guide Operational guidance for domain administrators maintaining DNS zone data. RFC 3645 GSS-TSIG Generic Security Service Algorithm for Secret Key Transaction Authentication for DNS (GSS-TSIG) How DNS clients and servers use GSS-API security mechanisms such as Kerberos to sign their messages with TSIG. RFC 6731 DNS server selection Improved Recursive DNS Server Selection for Multi-Interfaced Nodes How a device on several networks picks which DNS server to ask, using new DHCP options. RFC 6764 CalDAV/CardDAV discovery Locating Services for Calendaring Extensions to WebDAV (CalDAV) and vCard Extensions to WebDAV (CardDAV) How a calendar or contacts app can find a CalDAV or CardDAV server from just an address and password. RFC 7686 .onion The ".onion" Special-Use Domain Name Reserves .onion as a special name that belongs to Tor services and must never be resolved through ordinary DNS. RFC 8749 Retire DLV Moving DNSSEC Lookaside Validation (DLV) to Historic Status The official retirement of DNSSEC Lookaside Validation, a stopgap from when the DNS root was still unsigned. RFC 8753 IDNA Unicode review Internationalized Domain Names for Applications (IDNA) Review for New Unicode Versions How each new Unicode version gets checked so internationalized domain names keep working. RFC 8766 Discovery Proxy Discovery Proxy for Multicast DNS-Based Service Discovery A proxy that answers ordinary DNS queries by asking Multicast DNS on the local link, so service discovery works across networks. RFC 8880 ipv4only.arpa Special Use Domain Name 'ipv4only.arpa' Why the name ipv4only.arpa is officially special, and what resolvers and DNS64 servers must do with it. RFC 8976 ZONEMD Message Digest for DNS Zones A digest of a whole DNS zone, stored inside the zone, so anyone holding a copy can check it is complete and unaltered. RFC 9476 .alt TLD The .alt Special-Use Top-Level Domain A reserved top-level label that says: this name is not in the global DNS, so do not look it up there. RFC 9520 DNS failure caching Negative Caching of DNS Resolution Failures Resolvers must remember that a lookup failed, so they stop hammering servers that cannot answer. RFC 9536 RDAP reverse search Registration Data Access Protocol (RDAP) Reverse Search How an RDAP server can answer 'which domains are tied to this person or handle?' instead of only the reverse. RFC 9567 DNS error reporting DNS Error Reporting How a validating resolver tells an authoritative server's operator about DNS failures by sending one specially named query. RFC 1535 A Security Problem and Proposed Correction With Widely Deployed DNS Software Why resolver search lists for partial names must stay within local control. RFC 3258 Shared Unicast DNS Distributing Authoritative Name Servers via Shared Unicast Addresses How one authoritative name server can be reached from many places without changing routing RFC 3364 IPv6 DNS tradeoffs Tradeoffs in Domain Name System (DNS) Support for Internet Protocol version 6 (IPv6) A 2002 comparison of AAAA and A6 records for storing IPv6 addresses in DNS. RFC 5507 DNS extension choices Design Choices When Expanding the DNS Why a new DNS record type beats stuffing application data into TXT records. RFC 5894 IDNA2008 Internationalized Domain Names for Applications (IDNA): Background, Explanation, and Rationale Why the rules for internationalized domain names were revised RFC 8027 DNSSEC Roadblocks DNSSEC Roadblock Avoidance How a DNSSEC validator can test the network and resolvers it depends on, and work around the ones that break DNSSEC. RFC 8244 Special-Use Names Special-Use Domain Names Problem Statement When a process for reserving special domain names breaks down RFC 8521 RDAP Object Tagging Registration Data Access Protocol (RDAP) Object Tagging A hyphen and a short provider tag on the end of an RDAP handle tell clients which server to ask. RFC 8901 Multi-Signer DNSSEC Multi-Signer DNSSEC Models How to run DNSSEC when two or more DNS providers each sign the same zone with their own keys. RFC 8906 A Common Operational Problem in DNS Servers: Failure to Communicate Why DNS servers must answer every well-formed query, and how to test whether yours does. RFC 8932 DNS Privacy Operators Recommendations for DNS Privacy Service Operators What to do, and what to promise users, when you run a DNS resolver that offers privacy. RFC 1912 DNS Errors Common DNS Operational and Configuration Errors The mistakes that break DNS most often, and what to write in the zone file instead. RFC 7534 AS112 Operations AS112 Nameserver Operations How volunteers run a shared anycast sink that answers misdirected reverse-DNS queries for private addresses. RFC 921 DNS schedule (revised) Domain name system implementation schedule - revised The revised schedule for moving Internet hosts to hierarchical domain names. RFC 1032 Domain administrators guide A guide to registering and administering a domain in the DDN and DARPA naming system. RFC 1101 DNS Network Names DNS encoding of network names and other types A DNS method for mapping network names to numbers and an experimental mapping framework. RFC 8467 EDNS Padding Policies Padding Policies for Extension Mechanisms for DNS (EDNS(0)) How much to pad encrypted DNS messages so their sizes reveal less. RFC 2181 DNS Clarifications Clarifications to the DNS Specification Fixes the spots in the original DNS specs that implementers kept reading differently. RFC 4713 Chinese domain names Registration and Administration Recommendations for Chinese Domain Names Registering Chinese domain names that exist in both Simplified and Traditional character forms. RFC 4795 LLMNR Link-local Multicast Name Resolution (LLMNR) Finding a name on the local network when there is no DNS server to ask. RFC 4892 Requirements for a Mechanism Identifying a Name Server Instance What a mechanism for telling which name server answered a query would have to do, and why the existing convention falls short. RFC 5895 IDNA2008 mapping Mapping Characters for Internationalized Domain Names in Applications (IDNA) 2008 How to normalize the characters a user types before they reach the IDNA2008 protocol. RFC 7553 URI DNS Record The Uniform Resource Identifier (URI) DNS Resource Record A DNS record type that answers "where is this service, for this protocol", with the address written out in full. RFC 7646 DNSSEC NTA Definition and Use of DNSSEC Negative Trust Anchors A temporary way to stop validating one broken domain, so that a mistake in signing does not take a site offline. RFC 8764 Apple DNS LLQ Apple's DNS Long-Lived Queries Protocol Apple's way of letting a DNS server push changes to a client, now replaced by DNS Push Notifications. RFC 606 Host names on-line A proposal for an on-line file mapping official host names to addresses and attributes. RFC 799 Internet name domains A proposed domain structure for Internet host names and mail forwarding. RFC 819 Domain Naming The Domain Naming Convention for Internet User Applications How names were built into a hierarchy of domains, and what that meant for name service and applications. RFC 3425 Obsoleting IQUERY Obsoleting IQUERY Retires the DNS IQUERY operation and updates RFC 1035. RFC 4955 DNSSEC Experiments DNS Security (DNSSEC) Experiments A recipe for testing non-backwards-compatible DNSSEC ideas on real zones without breaking standard resolvers. RFC 5158 6to4 Reverse DNS 6to4 Reverse DNS Delegation Specification How a 6to4 site asks for DNS servers to be delegated for its own reverse lookup zone, with its source address as the proof. RFC 6641 NFSv4 DNS SRV Using DNS SRV to Specify a Global File Namespace with NFS Version 4 Using a DNS SRV record to find the root of an organization's NFSv4 file tree. RFC 7216 LIS Discovery Location Information Server (LIS) Discovery Using IP Addresses and Reverse DNS How a device behind a home router can find its Location Information Server by turning its IP address into reverse DNS names. RFC 7218 Adding Acronyms to Simplify Conversations about DNS-Based Authentication of Named Entities (DANE) Adds descriptive acronyms for the three numeric fields in TLSA records. RFC 8334 EPP launch phase Launch Phase Mapping for the Extensible Provisioning Protocol (EPP) How a domain registry's EPP interface handles sunrise, landrush and trademark claims periods at launch. RFC 8375 home.arpa Special-Use Domain 'home.arpa.' A reserved DNS name that home networks can use for local names without colliding with the public internet. RFC 8482 Minimal ANY Providing Minimal-Sized Responses to DNS Queries That Have QTYPE=ANY How a DNS server can answer an ANY query with one small record instead of everything it knows. RFC 8509 DNSSEC Sentinel A Root Key Trust Anchor Sentinel for DNSSEC Special DNS names let anyone test whether a validating resolver already trusts a new root key. RFC 8543 EPP Organization Mapping Extensible Provisioning Protocol (EPP) Organization Mapping A new EPP object type so registries can record registrars, resellers, privacy proxies and DNS operators as organizations. RFC 8777 AMTRELAY DNS record DNS Reverse IP Automatic Multicast Tunneling (AMT) Discovery A DNS record, looked up by the multicast sender's address, that tells AMT gateways which relays can deliver that sender's traffic. RFC 8917 The LoST-Validation Straightforward-Naming Authority PoinTeR (S-NAPTR) Application Service Tag A new DNS service tag that lets emergency-location software find the servers that check addresses, separate from the ones that route calls. RFC 8977 RDAP Sort and Paging Registration Data Access Protocol (RDAP) Query Parameters for Result Sorting and Paging Query parameters that let RDAP clients count, sort and page through large search results. RFC 8982 RDAP Partial Registration Data Access Protocol (RDAP) Partial Response How an RDAP client can ask for a trimmed-down answer instead of every field the server holds. RFC 9018 DNS Server Cookies Interoperable Domain Name System (DNS) Server Cookies A single recipe for DNS Server Cookies so servers from different vendors can validate each other's cookies. RFC 9038 EPP Unhandled Namespaces Extensible Provisioning Protocol (EPP) Unhandled Namespaces How an EPP server can hand a client data it cannot normally send, by tucking it into extValue elements. RFC 9537 RDAP redaction Redacted Fields in the Registration Data Access Protocol (RDAP) Response How an RDAP server tells you which fields it hid, and how, instead of leaving you guessing. RFC 9619 DNS QDCOUNT In the DNS, QDCOUNT Is (Usually) One A DNS query message carries at most one question, and anything else gets a FORMERR reply. RFC 9664 DNS Update Leases An EDNS(0) Option to Negotiate Leases on DNS Updates A DNS Update extension that gives records an expiry date, so abandoned ones get cleaned up. RFC 9665 SRP for DNS-SD Service Registration Protocol for DNS-Based Service Discovery How devices register their services with a DNS server over plain unicast, with no multicast needed. RFC 9803 EPP TTL mapping Extensible Provisioning Protocol (EPP) Mapping for DNS Time-to-Live (TTL) Values How a domain registrar can set the DNS cache lifetime of delegation records through EPP. RFC 9859 Generalized DNS NOTIFY Generalized DNS Notifications Extends DNS NOTIFY beyond zone transfers so a child zone can nudge its parent to check for new DS or NS data right away. RFC 9886 DETs in DNS DRIP Entity Tags (DETs) in the Domain Name System How drone identity tags are looked up in the DNS, using the IPv6 reverse tree as a registry. RFC 9953 DNS over CoAP DNS over CoAP (DoC) How tiny Internet of Things devices can look up names by carrying DNS messages inside CoAP. RFC 10029 DNS multiple QTYPEs DNS Multiple QTYPEs An EDNS option that lets a DNS client ask for several record types in one query and get them in one response. RFC 10037 RDAP DNS TTL extension Registration Data Access Protocol (RDAP) Extension for DNS Time-to-Live (TTL) Values An RDAP extension that lets registries show the configured DNS TTL values for a domain or nameserver. RFC 3490 IDNA Internationalizing Domain Names in Applications (IDNA) A way for applications to use non-ASCII domain names without changing DNS, resolvers or servers. RFC 3761 ENUM The E.164 to Uniform Resource Identifiers (URI) Dynamic Delegation Discovery System (DDDS) Application (ENUM) Using the DNS to answer what services are reachable at a telephone number. RFC 1886 DNS IPv6 Extensions DNS Extensions to Support IP Version 6 The original DNS extensions for storing and looking up IPv6 addresses. RFC 2672 DNAME Non-Terminal DNS Name Redirection A DNS record that redirects a whole subtree of names to another domain, rather than one name at a time. RFC 3755 Legacy Resolver Compatibility for Delegation Signer (DS) Renaming three DNSSEC record types so that old resolvers ignore them instead of misreading them. RFC 1383 An Experiment in DNS Based IP Routing An experiment in letting the DNS say which gateway a remote network should be reached through. RFC 9230 ODoH Oblivious DNS over HTTPS Splitting a DNS query across two servers so neither one knows both who asked and what was asked. RFC 8499 DNS Terminology DNS Terminology One document that fixes the meaning of the words DNS implementers, developers and operators use. RFC 2146 .GOV Domain U.S. Government Internet Domain Names The Federal Networking Council's rules for who may register a name directly under .GOV: one agency, one name. RFC 2352 Legal Names as Domains A Convention For Using Legal Names as Domain Names A proposal to hang company and trademark names under country domains so the law, not the registry, settles who owns a name. RFC 3832 SLP via DNS SRV Remote Service Discovery in the Service Location Protocol (SLP) via DNS SRV Using DNS SRV records to find SLP Directory Agents in other domains so services there can be discovered. RFC 9718 Root Zone Trust Anchors DNSSEC Trust Anchor Publication for the Root Zone How IANA publishes the DNSSEC trust anchors that every validating DNS resolver needs. RFC 8624 DNSSEC Algorithms Algorithm Implementation Requirements and Usage Guidance for DNSSEC Which signing and digest algorithms DNSSEC software must, should or must not support. RFC 883 DNS (1983) Domain names: Implementation specification The original specification of the domain name system: how resolvers, name servers and the messages between them work. RFC 623 Comments on on-line host name service Suggestions for reliable and easy access to a host-name database. RFC 1031 MILNET Domain Transition MILNET name domain transition The 1987 plan for moving the MILNET community from host tables to domain names. RFC 4431 DLV The DNSSEC Lookaside Validation (DLV) DNS Resource Record A DNS record format for publishing DNSSEC trust anchors outside the delegation chain. RFC 2168 URI Resolution via DNS Resolution of Uniform Resource Identifiers using the Domain Name System A DNS record type that lets a client find the server that knows how to turn a name into an address. RFC 882 DNS (1983) Domain names: Concepts and facilities The 1983 concept paper that proposed replacing one central host table with a distributed, tree-shaped database of domain names. RFC 3008 DNSSEC Signing Authority Domain Name System Security (DNSSEC) Signing Authority A tighter rule for which DNSSEC keys count as authorized to sign DNS data. RFC 3491 Nameprep Nameprep: A Stringprep Profile for Internationalized Domain Names (IDN) The rulebook for cleaning up internationalized domain name labels so look-alike inputs compare as equal. RFC 3658 DS record Delegation Signer (DS) Resource Record (RR) A record placed at the parent side of a DNS delegation that vouches for the child zone's signing key. RFC 1794 DNS Load Balancing DNS Support for Load Balancing Using DNS to spread traffic across several servers without changing the DNS. RFC 2219 DNS Aliases for Services Use of DNS Aliases for Network Services Why the web server is called www: the folklore of service nicknames in DNS, written down as a best current practice. RFC 2230 KX Record Key Exchange Delegation Record for the DNS A DNS record that names which host may negotiate security keys on behalf of another host. RFC 2671 EDNS0 Original Extension Mechanisms for DNS (EDNS0) The original way to let DNS messages grow past their fixed limits, built around one optional OPT record. RFC 3467 Role of the Domain Name System (DNS) Rethinking DNS as its original purpose overextends RFC 3681 Delegation of E.F.F.3.IP6.ARPA A best-practice request to delegate a reverse-DNS zone for 6bone IPv6 addresses. RFC 4074 AAAA Query Misbehavior Common Misbehavior Against DNS Queries for IPv6 Addresses How some DNS servers answer IPv6 address queries wrongly, and why that can break IPv4 connections. RFC 4472 IPv6 DNS operations Operational Considerations and Issues with IPv6 DNS Practical guidance for deploying DNS in IPv6 networks, for operators experienced with IPv4. RFC 4986 Trust Anchor Rollover Requirements Related to DNS Security (DNSSEC) Trust Anchor Rollover The checklist any automated method for updating DNSSEC trust anchors must satisfy. RFC 5526 Infrastructure ENUM The E.164 to Uniform Resource Identifiers (URI) Dynamic Delegation Discovery System (DDDS) Application for Infrastructure ENUM A proposal for a carrier-controlled ENUM namespace parallel to e164.arpa. RFC 5564 Arabic domain guidelines Linguistic Guidelines for the Use of the Arabic Language in Internet Domains Technical rules and linguistic guidance for registering domain names in Arabic. RFC 6055 IAB Thoughts on Encodings for Internationalized Domain Names Why domain names with non-ASCII characters break when applications and resolvers disagree on how to encode them. RFC 6841 DNSSEC DP and DPS A Framework for DNSSEC Policies and DNSSEC Practice Statements A checklist of topics for writing a DNSSEC Policy or Practice Statement, so zone operators can show how they manage keys and signing. RFC 6912 Principles for Unicode Code Point Inclusion in Labels in the DNS Guidelines for deciding which Unicode characters are safe in domain names RFC 7129 DNSSEC denial Authenticated Denial of Existence in the DNS How DNSSEC proves that a domain name or record type does not exist. RFC 7479 Ed25519 in SSHFP Using Ed25519 in SSHFP Resource Records Adds an SSHFP algorithm number for Ed25519 public keys. RFC 7535 AS112 via DNAME AS112 Redirection Using DNAME How a single DNAME record lets any zone owner send junk queries to the AS112 sink without asking its operators. RFC 7558 Requirements for Scalable DNS-Based Service Discovery (DNS-SD) / Multicast DNS (mDNS) Extensions Scaling service discovery beyond a single network link RFC 8427 DNS in JSON Representing DNS Messages in JSON Representing DNS messages in a human-readable JSON format. RFC 9120 arpa nameservers Nameservers for the Address and Routing Parameter Area ("arpa") Domain How the arpa domain gets its own nameserver names, separate from the DNS root servers. RFC 9199 Considerations for Large Authoritative DNS Server Operators Research-backed advice for operating large DNS server networks RFC 9715 DNS Frag Avoidance IP Fragmentation Avoidance in DNS over UDP Practical rules for keeping DNS answers small enough that UDP never has to split them into IP fragments. RFC 9726 DNS for IoT Devices Operational Considerations for Use of DNS in Internet of Things (IoT) Devices How IoT makers should use DNS names so that network firewalls driven by MUD files can actually enforce them. RFC 9874 EPP deletion practices Best Practices for Deletion of Domain and Host Objects in the Extensible Provisioning Protocol (EPP) How registrars can delete domains and name server hosts in EPP without breaking DNS or opening the door to hijackers. RFC 10026 DS automation Operational Recommendations for DNSSEC Delegation Signer (DS) Automation How registries and registrars should handle automatic DS updates so DNSSEC stays working and nobody is surprised. RFC 2673 Binary Labels Binary Labels in the Domain Name System A DNS label type that packs a run of single-bit labels together, so names can be split at any bit boundary. RFC 2870 Root server operations Root Name Server Operational Requirements The operating rules the DNS root name servers were expected to follow in 2000: capacity, security and coordination. RFC 2065 DNSSEC (Original) Domain Name System Security Extensions The original DNSSEC design: signed DNS records, published keys, and a way to prove a name is not there. RFC 2916 ENUM (E.164 in DNS) E.164 number and DNS Turn a telephone number into a DNS name, then look up the Internet services that reach that number. RFC 3152 IP6.ARPA Delegation of IP6.ARPA Describes delegation of the IP6.ARPA zone for IPv6 reverse mapping. RFC 1464 Using the Domain Name System To Store Arbitrary String Attributes A proposal to store named text attributes in DNS TXT records. RFC 2540 Detached Domain Name System (DNS) Information A format for storing DNS answers offline with timestamps. RFC 2915 NAPTR The Naming Authority Pointer (NAPTR) DNS Resource Record A DNS resource record type that stores regular expression rewrite rules to transform one string into another. RFC 4956 DNSSEC Opt-In DNS Security (DNSSEC) Opt-In An experiment that lets big DNSSEC zones leave unsigned delegations out of the NSEC chain. RFC 6944 Applicability Statement: DNS Security (DNSSEC) DNSKEY Algorithm Implementation Status One table saying which DNSSEC signing algorithms software must, should, may or must not implement. RFC 7929 DANE for OpenPGP DNS-Based Authentication of Named Entities (DANE) Bindings for OpenPGP Publish OpenPGP public keys in DNS for automatic email encryption. RFC 8162 SMIMEA Using Secure DNS to Associate Certificates with Domain Names for S/MIME A DNS record type that publishes a person's S/MIME certificate under their email address, protected by DNSSEC. RFC 9526 Homenet public names Simple Provisioning of Public Names for Residential Networks Let home networks publish device names and addresses in public DNS. RFC 3731 Extensible Provisioning Protocol (EPP) Domain Name Mapping How to provision and manage domain names using EPP. RFC 6840 DNSSEC Clarifications Clarifications and Implementation Notes for DNS Security (DNSSEC) Errata and implementation advice for DNSSEC, sorted from security-critical fixes down to small corrections. RFC 3445 DNS KEY RR scope Limiting the Scope of the KEY Resource Record (RR) Limit the DNS KEY record to DNSSEC keys only, removing application keys. RFC 3757 Domain Name System KEY (DNSKEY) Resource Record (RR) Secure Entry Point (SEP) Flag A flag in DNS keys to mark which ones anchor signed zones to their parents. RFC 6014 Cryptographic Algorithm Identifier Allocation for DNSSEC Loosens the requirement for new DNSSEC cryptographic algorithms to be documented in any RFC, not just standards-track ones. RFC 9157 Revised IANA Considerations for DNSSEC A change to how DNSSEC algorithms and parameters receive IANA registrations. RFC 625 On-line hostnames service A response supporting FTP and ASCII for distributing host names. RFC 1611 DNS Server MIB DNS Server MIB Extensions Gauges and controls that let system administrators watch and manage how a DNS server is performing. RFC 1612 DNS Resolver MIB DNS Resolver MIB Extensions Management tools for monitoring DNS lookups on client computers. RFC 4501 DNS URIs Domain Name System Uniform Resource Identifiers A dns: URI scheme for naming a piece of DNS data by its name, class and type. RFC 5074 DLV DNSSEC Lookaside Validation (DLV) A way to publish DNSSEC trust anchors outside the DNS delegation chain, so validators need fewer built-in ones. RFC 6594 SSHFP SHA-256 and ECDSA Use of the SHA-256 Algorithm with RSA, Digital Signature Algorithm (DSA), and Elliptic Curve DSA (ECDSA) in SSHFP Resource Records Two new numbers for SSHFP DNS records: one for ECDSA keys and one for SHA-256 fingerprints. RFC 8056 EPP-RDAP Status Mapping Extensible Provisioning Protocol (EPP) and Registration Data Access Protocol (RDAP) Status Mapping A lookup table that makes sure every domain registry status in EPP has a matching label in RDAP. RFC 8063 EPP Key Relay Key Relay Mapping for the Extensible Provisioning Protocol How DNS operators hand DNSSEC keys to each other through the registry's EPP poll queue. RFC 8544 Organization Extension for the Extensible Provisioning Protocol (EPP) An EPP extension that attaches organizations, such as a reseller or privacy proxy, to domains, hosts and contacts. RFC 8618 C-DNS Compacted-DNS (C-DNS): A Format for DNS Packet Capture A compact binary file format for storing huge captures of DNS queries and responses without keeping every raw packet. RFC 8807 EPP login security Login Security Extension for the Extensible Provisioning Protocol (EPP) An EPP extension that lifts the 16-character password cap and lets servers send security warnings at login. RFC 9022 DNRD Escrow Domain Name Registration Data (DNRD) Objects Mapping A standard layout for the backup copy a domain registry hands to an escrow agent, in either XML or CSV form. RFC 9108 YANG DNS Types YANG Types for DNS Classes and Resource Record Types Two DNS registries, DNS CLASSes and RR TYPEs, translated into reusable YANG types. RFC 9154 EPP Transfer Auth Extensible Provisioning Protocol (EPP) Secure Authorization Information for Transfer A way to move a domain between registrars using short-lived, random, hashed transfer codes instead of long-lived passwords. RFC 9233 IDNA2008 Unicode 12 Internationalized Domain Names for Applications 2008 (IDNA2008) and Unicode 12.0.0 Why moving internationalized domain names from Unicode 6.0.0 to 12.0.0 needed no new exceptions, and what changed along the way. RFC 9373 EdDSA for IPSECKEY EdDSA Value for IPSECKEY An IPSECKEY registry value for EdDSA public keys stored in DNS. RFC 9432 DNS Catalog Zones DNS Catalog Zones How a list of zones, published as an ordinary DNS zone, lets secondary name servers set themselves up automatically. RFC 9527 DHCPv6 for HNA DHCPv6 Options for the Homenet Naming Authority DHCPv6 options that let an ISP tell a home router which domain and DNS managers to use for the home network's public names. RFC 9560 RDAP OpenID Connect Federated Authentication for the Registration Data Access Protocol (RDAP) Using OpenID Connect One login at a trusted identity provider, usable with many RDAP servers, so registries can decide who sees what. RFC 9606 DNS resolver information DNS Resolver Information A new DNS record type, RESINFO, lets a resolver describe its own features to the clients that use it. RFC 9660 DNS ZONEVERSION The DNS Zone Version (ZONEVERSION) Option A way for a DNS answer to say which version of the zone it came from. RFC 9704 Local DNS Authority Establishing Local DNS Authority in Validated Split-Horizon Environments How a domain owner can vouch for a network's local DNS resolver, so clients use it only for the names it is allowed to answer. RFC 9824 Compact DNSSEC denial Compact Denial of Existence in DNSSEC How a DNSSEC server can prove a name does not exist by pretending it exists with no data, using one small signed record. RFC 9873 EPP additional email Additional Email Address Extension for the Extensible Provisioning Protocol (EPP) An EPP extension that lets a contact object carry a second email address, ASCII or internationalized. RFC 9877 RDAP geofeed Registration Data Access Protocol (RDAP) Extension for Geofeed Data How an RDAP server points to the geofeed file for an IP network, using a new link type and extension. RFC 2538 CERT RR Storing Certificates in the Domain Name System (DNS) A DNS resource record type for storing cryptographic certificates and revocation lists. RFC 7626 DNS Privacy Considerations Understanding what your DNS queries reveal about you RFC 6895 Domain Name System (DNS) IANA Considerations The rulebook for who may add new record types, classes, opcodes and error codes to the DNS registries. RFC 4931 EPP Domain Extensible Provisioning Protocol (EPP) Domain Name Mapping Using EPP to manage domain names in a registry system RFC 7719 DNS Terminology DNS Terminology A glossary of DNS terms clarified after decades of shifting definitions. RFC 8109 DNS Priming Initializing a DNS Resolver with Priming Queries How resolvers find the root servers when they start. RFC 5205 HIP DNS Host Identity Protocol (HIP) Domain Name System (DNS) Extensions DNS extensions for finding and authenticating Host Identity Protocol nodes RFC 2137 Secure DNS Update Secure Domain Name System Dynamic Update Using digital signatures to control who can change DNS data dynamically. RFC 3915 EPP Grace Period Domain Registry Grace Period Mapping for the Extensible Provisioning Protocol (EPP) How registrars restore a deleted domain name during the redemption grace period, and how grace periods show up in EPP. RFC 810 DoD Internet host table specification Specifies the format for a central host table to map network names and addresses. RFC 4932 EPP Host Extensible Provisioning Protocol (EPP) Host Mapping Using EPP to manage host objects in a domain registry RFC 7816 QNAME Minimisation DNS Query Name Minimisation to Improve Privacy A DNS privacy technique that limits information leakage to authoritative servers. RFC 6304 AS112 AS112 Nameserver Operations A distributed nameserver service that handles reverse DNS queries for private IP addresses. RFC 4641 DNSSEC operations DNSSEC Operational Practices How to safely run and maintain DNS zones with security extensions. RFC 4343 DNS Case Insensitivity Domain Name System (DNS) Case Insensitivity Clarification The exact rules for how DNS treats uppercase and lowercase letters as equivalent. RFC 9975 CDS/CSYNC consistency Clarifications on CDS/CDNSKEY and CSYNC Consistency Parents must check that every nameserver of a child agrees before acting on CDS, CDNSKEY or CSYNC records. RFC 608 Host names on-line A proposal for an online, machine-readable file of host names and addresses. RFC 2537 RSA/MD5 in DNS RSA/MD5 KEYs and SIGs in the Domain Name System (DNS) How to store cryptographic keys and signatures in the DNS. RFC 3845 NSEC Type Bit Map DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format A bigger checklist of which record types exist in DNSSEC. RFC 4635 HMAC-SHA TSIG IDs HMAC SHA (Hashed Message Authentication Code, Secure Hash Algorithm) TSIG Algorithm Identifiers Add identifiers for stronger hash algorithms in DNS TSIG. RFC 1537 Common DNS Data File Configuration Errors Common mistakes system administrators make when writing DNS zone files. RFC 3901 DNS IPv6 Transport DNS IPv6 Transport Operational Guidelines Operational guidelines for DNS queries over mixed IPv4 and IPv6 networks. RFC 1816 .gov Domain Names U.S. Government Internet Domain Names Registration policies for U.S. government Internet domain names. RFC 2052 DNS SRV (Experimental) A DNS RR for specifying the location of services (DNS SRV) DNS records for locating services by protocol and domain. RFC 1637 DNS NSAP RR DNS NSAP Resource Records Adding a new DNS record type to map domain names to OSI NSAP addresses RFC 7958 Root DNSSEC Trust Anchor DNSSEC Trust Anchor Publication for the Root Zone The formats and download locations IANA used to publish the DNSSEC trust anchor for the DNS root zone. RFC 4159 Deprecation of "ip6.int" Discontinue ip6.int for IPv6 reverse mapping and use ip6.arpa RFC 973 Domain system changes and observations Updates and lessons learned from early DNS implementation. RFC 2832 NSI RRP NSI Registry Registrar Protocol (RRP) Version 1.1.0 How registrars tell the DNS registry about new domains and name servers. RFC 3655 Redefinition of DNS Authenticated Data (AD) bit Clarifying what the DNS Authenticated Data bit actually means. RFC 4310 DNSSEC EPP Domain Name System (DNS) Security Extensions Mapping for the Extensible Provisioning Protocol (EPP) Managing DNS security keys through the domain provisioning protocol. RFC 5966 DNS over TCP DNS Transport over TCP - Implementation Requirements Why DNS implementations must support TCP in addition to UDP. RFC 9905 SHA-1 in DNSSEC Deprecating the Use of SHA-1 in DNSSEC Signature Algorithms Deprecating two SHA-1-based algorithms for DNSSEC signing RFC 1348 DNS NSAP RRs DNS NSAP RRs Two experimental DNS record types for storing and finding NSAP addresses. RFC 8909 RDE Registry Data Escrow Specification A standardized format for domain registries to back up their data safely. RFC 1401 Correspondence between the IAB and DISA on the use of DNS Letters on adopting the Domain Name System across the entire Internet RFC 1713 Tools for DNS debugging A guide to practical tools for finding and fixing DNS problems RFC 1956 MIL Domain Registration Registration in the MIL Domain The 1996 policy for registering second-level names under .MIL. RFC 2053 AM Domain The AM (Armenia) Domain Registration and naming rules for Armenia's .AM top-level domain. RFC 2517 WWWSeeker Building Directories from DNS: Experiences from WWWSeeker How to build a directory of companies and their web sites from domain registries RFC 2825 I18N and domain names A Tangled Web: Issues of I18N, Domain Names, and the Other Internet protocols The architectural challenges of putting languages into web addresses. RFC 3071 DNS Domain Categories Reflections on the DNS, RFC 1591, and Categories of Domains Reconsideration of domain allocation policies in a post-web internet. RFC 3197 Applicability Statement for DNS MIB Extensions Why the DNS Server and Resolver MIB extensions were not deployed and should be retired. RFC 4027 DNS Media Types Domain Name System Media Types MIME types for DNS data in binary and text formats RFC 4183 A Suggested Scheme for DNS Resolution of Networks and Gateways Using DNS to find the network containing an IP address and its first-hop routers. RFC 4185 National and Local Characters for DNS Top Level Domain (TLD) Names Letting people in other countries type domain names in their own alphabets. RFC 4339 IPv6 DNS Config IPv6 Host Configuration of DNS Server Information Approaches Three ways IPv6 hosts learn which DNS servers to use. RFC 4367 What's in a Name: False Assumptions about DNS Names Why domain names don't reliably predict what services run on them RFC 5992 Internationalized Domain Names Registration and Administration Guidelines for European Languages Using Cyrillic Character and variant guidelines for domain names written in Cyrillic RFC 6168 Requirements for Management of Name Servers for the DNS A requirements roadmap for unified DNS name server management systems. RFC 6394 DANE use cases Use Cases and Requirements for DNS-Based Authentication of Named Entities (DANE) The scenarios and requirements for letting DNSSEC-signed DNS back up the certificates that TLS clients check. RFC 6563 A6 to Historic Moving A6 to Historic Status Moving the A6 DNS record type to Historic status and explaining why. RFC 6927 Variants in Second-Level Names Registered in Top-Level Domains How registries handle internationalized domain names that look the same. RFC 6950 Architectural Considerations on Application Features in the DNS When should applications use DNS as a database, and when should they use something else? RFC 7043 EUI48/EUI64 RRs Resource Records for EUI-48 and EUI-64 Addresses in the DNS DNS slots for storing hardware device addresses, with serious privacy warnings. RFC 7085 Top-Level Domains That Are Already Dotless A catalog of DNS top-level domains with address records RFC 7108 A Summary of Various Mechanisms Deployed at L-Root for the Identification of Anycast Nodes Methods for identifying which L-Root DNS node answers your query. RFC 7304 A Method for Mitigating Namespace Collisions A documented but explicitly discouraged response to DNS name collisions. RFC 7393 PCP and DDNS Using the Port Control Protocol (PCP) to Update Dynamic DNS Keeping a home server reachable when an address-sharing network gives it a non-standard port instead of the usual one. RFC 7745 Reverse DNS XML Schemas XML Schemas for Reverse DNS Management Standard format for updating reverse DNS through a web service RFC 8222 DNS-SD Labels Selecting Labels for Use with Conventional DNS and Other Resolution Systems in DNS-Based Service Discovery How to choose names that work across DNS and mDNS without confusion. RFC 8228 LGR Variant Guidance Guidance on Designing Label Generation Rulesets (LGRs) Supporting Variant Labels Designing rules for variant labels in internationalized domain names. RFC 8324 DNS rethink DNS Privacy, Authorization, Special Uses, Encoding, Characters, Matching, and Root Structure: Time for Another Look? Can the 30-year-old domain name system be redesigned, or should its scope be limited? RFC 8483 Yeti DNS Yeti DNS Testbed A global testbed for experimenting with DNS root server changes safely. RFC 8501 Reverse DNS in IPv6 for Internet Service Providers Practical approaches for Internet Service Providers to manage reverse DNS lookups in IPv6 networks. RFC 8567 Customer Management DNS Resource Records An April 1st joke proposes storing customer secrets in public DNS records. RFC 8882 DNS-Based Service Discovery (DNS-SD) Privacy and Security Requirements What privacy and security features DNS-based service discovery needs to protect users on public networks. RFC 9095 EPP Strict Bundling Extensible Provisioning Protocol (EPP) Domain Name Mapping Extension for Strict Bundling Registration Provisioning related domain names as an atomic group through EPP RFC 9267 DNS RR Anti-Patterns Common Implementation Anti-Patterns Related to Domain Name System (DNS) Resource Record (RR) Processing Common mistakes in DNS implementations that lead to crashes or attacks. RFC 9498 GNU Name System The GNU Name System Decentralized, censorship-resistant DNS alternative using key blinding and cryptographic zone management. RFC 10023 _for-sale DNS name The "_for-sale" Underscored and Globally Scoped DNS Node Name A simple DNS record to advertise that a domain name is for sale. RFC 811 Hostnames Server A text query service for looking up internet host names and addresses RFC 1386 The US Domain How the United States domain space is organized by geography RFC 1811 .gov Domain Names U.S. Government Internet Domain Names Rules for registering U.S. federal government names under .GOV. RFC 2010 Root Server Criteria Operational Criteria for Root Name Servers The rules for running a bulletproof DNS root name server. RFC 2541 DNS Security Operational Considerations How to generate, protect, and rotate the cryptographic keys that secure DNS. RFC 7706 Root on Loopback Decreasing Access Time to Root Servers by Running One on Loopback How a resolver can keep its own copy of the DNS root zone on a loopback address, and why the RFC warns against doing it lightly. RFC 6305 PRISONER.IANA.ORG I'm Being Attacked by PRISONER.IANA.ORG! Why a firewall may log traffic from PRISONER.IANA.ORG, and why it is usually not an attack. RFC 6604 xNAME RCODE and Status Bits Clarification Clarifying DNS response codes and status bits after name redirection. RFC 6725 DNSKEY algorithm updates DNS Security (DNSSEC) DNSKEY Algorithm IANA Registry Updates Reserves three DNSSEC algorithm numbers and updates registry references. RFC 9906 ECC-GOST in DNSSEC Deprecate Usage of ECC-GOST within DNSSEC Retires two older GOST algorithms from DNSSEC signing and validation. RFC 9910 RDAP RIR search Registration Data Access Protocol (RDAP) Regional Internet Registry (RIR) Search How to search for IP address and autonomous system registrations using the standard RDAP protocol. RFC 1664 Using the Internet DNS to Distribute RFC1327 Mail Address Mapping Tables Using DNS to store email address translation between two mail systems RFC 5006 RA DNS Option IPv6 Router Advertisement Option for DNS Configuration Routers advertise DNS server addresses alongside IPv6 network configuration. RFC 1788 ICMP Domain Names ICMP Domain Name Messages Two ICMP messages that ask an IP address directly for its own domain name. RFC 3632 RRP VeriSign Registry Registrar Protocol (RRP) Version 2.0.0 Updates to the protocol registrars use to manage domain names with a registry. RFC 7793 Shared Address Space DNS Adding 100.64.0.0/10 Prefixes to the IPv4 Locally-Served DNS Zones Registry Keeping private reverse DNS queries out of the global system. RFC 6195 DNS IANA Domain Name System (DNS) IANA Considerations How IANA allocates DNS parameter registry values RFC 3090 DNS Security Extension Clarification on Zone Status How to define whether a DNS zone is secured by DNSSEC. RFC 5395 Domain Name System (DNS) IANA Considerations The rulebook IANA follows when it hands out new DNS record types, classes, opcodes and error codes. RFC 1712 DNS GPOS DNS Encoding of Geographical Location A DNS record type for storing where on Earth a computer is located. RFC 1876 DNS LOC A Means for Expressing Location Information in the Domain Name System Putting location coordinates into the Domain Name System RFC 2345 Domain Names and Company Name Retrieval A simple way to find company websites by looking up company names RFC 3123 DNS APL A DNS RR Type for Lists of Address Prefixes (APL RR) A DNS record type for publishing lists of IPv4 and IPv6 address prefixes. RFC 4471 DNS name neighbors Derivation of DNS Name Predecessor and Successor Computing the canonically-ordered predecessor and successor of a DNS name. RFC 6593 Service Undiscovery Service Undiscovery Using Hide-and-Go-Seek for the Domain Pseudonym System (DPS) An April 1st joke about hiding services from discovery. RFC 7314 EDNS EXPIRE Extension Mechanisms for DNS (EDNS) EXPIRE Option An EDNS option to preserve DNS zone expiry through secondary servers. RFC 7901 DNS CHAIN Query CHAIN Query Requests in DNS Get the full validation chain in one query instead of many. RFC 9539 Opportunistic DNS crypto Unilateral Opportunistic Deployment of Encrypted Recursive-to-Authoritative DNS Encrypt DNS queries between resolvers and authoritative servers without prior coordination. RFC 2929 Domain Name System (DNS) IANA Considerations Rules for registering new DNS protocol codes RFC 5509 SIP IM/presence SRV Internet Assigned Numbers Authority (IANA) Registration of Instant Messaging and Presence DNS SRV RRs for the Session Initiation Protocol (SIP) Registers the SIP protocol label for instant messaging and presence DNS lookups. RFC 8495 EPP Allocation Token Allocation Token Extension for the Extensible Provisioning Protocol (EPP) A credential extension for authorizing allocation of objects in domain registries. RFC 8748 EPP fee extension Registry Fee Extension for the Extensible Provisioning Protocol (EPP) Let registries tell clients what domain operations will cost. RFC 9167 EPP Maintenance Registry Maintenance Notification for the Extensible Provisioning Protocol (EPP) How registry servers notify registrars about scheduled maintenance events. RFC 2240 Domain allocation A Legal Basis for Domain Name Allocation A proposal to allocate domain names fairly using legal company registration. RFC 627 ASCII text file of hostnames Announcement of the NIC's official ASCII host-name file. RFC 830 Distributed system for Internet name service An early proposal for a distributed name service architecture for the Internet. RFC 849 Suggestions for improved host table distribution A request for comments on improving distribution of the Internet host table. RFC 6804 DISCOVER opcode DISCOVER: Supporting Multicast DNS Queries An experimental DNS opcode for multicast resource discovery in disconnected networks.