DNS Zone Transfer over TLS
RFC 9103, “DNS Zone Transfer over TLS”, is a Proposed Standard document published in August 2021 by W. Toorop, S. Dickinson, S. Sahib, P. Aras, A. Mankin. It updates RFC 1995, RFC 5936, RFC 7766. The canonical text is published by the RFC Editor.
Abstract
DNS zone transfers are transmitted in cleartext, which gives attackers the opportunity to collect the content of a zone by eavesdropping on network connections. The DNS Transaction Signature (TSIG) mechanism is specified to restrict direct zone transfer to authorized clients only, but it does not add confidentiality. This document specifies the use of TLS, rather than cleartext, to prevent zone content collection via passive monitoring of zone transfers: XFR over TLS (XoT). Additionally, this specification updates RFC 1995 and RFC 5936 with respect to efficient use of TCP connections and RFC 7766 with respect to the recommended number of connections between a client and server for each transport.
What “Proposed Standard” means
An entry-level standards-track specification: stable, peer-reviewed and a solid basis for implementation, though it may still evolve before becoming an Internet Standard.
The canonical text of RFC 9103 is hosted at rfc-editor.org. Available in HTML,TXT,PDF,XML.
- RFC 9102 TLS DNSSEC Chain Extension
- RFC 9104 Distribution of Traffic Engineering Extended Administrative Groups Using the Border Gateway Protocol - Link State
- RFC 9101 The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request
- RFC 9105 A YANG Data Model for Terminal Access Controller Access-Control System Plus
- RFC 9100 Sensor Measurement Lists Features and Versions
- RFC 9106 Argon2 Memory-Hard Function for Password Hashing and Proof-of-Work Applications
- RFC 9099 Operational Security Considerations for IPv6 Networks
- RFC 9107 BGP Optimal Route Reflection