DNS over Datagram Transport Layer Security (DTLS), February 2017
Discuss this RFC: Send questions or comments to the mailing list firstname.lastname@example.org
DNS queries and responses are visible to network elements on the path between the DNS client and its server. These queries and responses can contain privacy-sensitive information, which is valuable to protect.
This document proposes the use of Datagram Transport Layer Security (DTLS) for DNS, to protect against passive listeners and certain active attacks. As latency is critical for DNS, this proposal also discusses mechanisms to reduce DTLS round trips and reduce the DTLS handshake size. The proposed mechanism runs over port 853.
For the definition of Status, see RFC 2026.
For the definition of Stream, see RFC 8729.