RFC 7858

RFC 7858
Title	RFC 7858
Status	Published
Authors	Paul Hoffman, Patrick McManus
Year	2016
Pages	34
Series	RFC

RFC 7858

RFC 7858 is a standards-track specification that defines a method for transporting DNS queries and responses over Transport Layer Security. It formalizes a secure channel for Domain Name System traffic, specifying protocol behavior and framing for confidentiality and integrity. The document was published by the Internet Engineering Task Force and authored by Paul Hoffman and Patrick McManus.

Background and Motivation

This section situates RFC 7858 within developments by the Internet Engineering Task Force, the evolution of the Domain Name System, and the broader push for privacy exemplified by initiatives like Let's Encrypt and policy discussions in institutions such as the European Commission. The motivation draws on concerns raised after surveillance disclosures involving agencies like the National Security Agency and debates in forums including the Internet Governance Forum and the World Wide Web Consortium. Early experimental work from projects at organizations such as Google and Cloudflare influenced the specification alongside transport security research from groups at Mozilla and APNIC.

Specification and Protocol Details

RFC 7858 defines the use of Transport Layer Security as specified in documents by the Internet Engineering Task Force and references cipher suite guidance originating from consortiums like the National Institute of Standards and Technology and standards bodies such as the International Organization for Standardization. The protocol uses port conventions endorsed by the Internet Assigned Numbers Authority and describes message framing compatible with existing Domain Name System wire format. Implementers are guided to follow interoperability practices established in prior RFCs authored by contributors from entities like Verisign, ISC (Internet Systems Consortium), and research groups at Stanford University. The text maps DNS over TLS sessions to session resumption and certificate validation procedures discussed in specifications maintained by the IETF TLS Working Group and consolidates guidance from operators such as Akamai and Comcast.

Security Considerations

The security analysis in RFC 7858 addresses threats documented in advisories issued by organizations including CERT Coordination Center and academic papers from researchers at MIT and Carnegie Mellon University. The document prescribes server authentication via X.509 certificates with expectations aligned to practices from Cab Forum-influenced deployments and verification models used by Google Chrome and Mozilla Firefox. It warns about downgrade attacks similar to those analyzed in reports by ENISA and about metadata leakage discussed in work by the Electronic Frontier Foundation. Recommendations incorporate operational security practices used by teams at Cloudflare and Fastly, and consider law-enforcement and regulatory contexts involving agencies such as the United States Department of Justice and courts in the European Union.

Implementation and Deployment

Deployments of RFC 7858 have been carried out by major operators like Google Public DNS, Quad9, and Cloudflare Public DNS, and influenced client support in software projects maintained by Mozilla and Google. The specification addresses server certificate provisioning approaches used by Let's Encrypt and traditional certificate authorities like DigiCert and discusses operational practices from network operators such as Verizon and CenturyLink. Software implementations appeared in open-source projects from ISC and from commercial vendors including F5 Networks, while testbeds were organized by consortia including ISOC and regional registries like APNIC and RIPE NCC.

Interoperability and Compatibility

RFC 7858 was designed to interoperate with existing DNS infrastructure and transition strategies promoted by engineering teams at IETF working groups and standards bodies such as the IANA and IETF DNSOP Working Group. Compatibility considerations reference legacy resolver behavior studied by researchers at University of California, Berkeley and deployment experience reported by measurement platforms such as APNIC Labs and RIPE Atlas. Cross-vendor testing involved organizations including Cisco Systems and Juniper Networks, and guidance aligns with operational norms published by IETF Operational and Management Area contributors. The specification also notes interactions with alternative privacy-focused protocols advanced by teams at Cloudflare and Mozilla.

Reception and Impact

The publication of RFC 7858 influenced adoption trends tracked by measurement efforts from APNIC Labs and community reports at IETF meetings, and spurred complementary work by researchers at ETH Zurich and University College London. Industry uptake by providers such as Google, Cloudflare, and Quad9 shaped product roadmaps at companies including Mozilla and Cisco Systems. Policy discussions in forums like the Internet Governance Forum and regulatory scrutiny by entities including the European Commission and national regulators were affected by the privacy implications highlighted in the RFC. Subsequent standards and experimental protocols in the DNS privacy ecosystem cited deployment experiences from organizations like Cloudflare and research outputs from Carnegie Mellon University.

Category:Internet standards