draft-ietf-dnsop-dns-tcp-requirements-03.txt		draft-ietf-dnsop-dns-tcp-requirements-04.txt
	Domain Name System Operations J. Kristoff		Domain Name System Operations J. Kristoff
	Internet-Draft DePaul University		Internet-Draft DePaul University
	Updates: 1123 (if approved) D. Wessels		Updates: 1123 (if approved) D. Wessels
	Intended status: Best Current Practice Verisign		Intended status: Best Current Practice Verisign
	Expires: July 6, 2019 January 2, 2019		Expires: December 26, 2019 June 24, 2019
	DNS Transport over TCP - Operational Requirements		DNS Transport over TCP - Operational Requirements
	draft-ietf-dnsop-dns-tcp-requirements-03		draft-ietf-dnsop-dns-tcp-requirements-04
	Abstract		Abstract
	This document encourages the practice of permitting DNS messages to		This document encourages the practice of permitting DNS messages to
	be carried over TCP on the Internet. It also considers the		be carried over TCP on the Internet. It also considers the
	consequences with this form of DNS communication and the potential		consequences with this form of DNS communication and the potential
	operational issues that can arise when this best common practice is		operational issues that can arise when this best common practice is
	not upheld.		not upheld.
	Status of This Memo		Status of This Memo
	skipping to change at page 1, line 35 ¶		skipping to change at page 1, line 35 ¶
	Internet-Drafts are working documents of the Internet Engineering		Internet-Drafts are working documents of the Internet Engineering
	Task Force (IETF). Note that other groups may also distribute		Task Force (IETF). Note that other groups may also distribute
	working documents as Internet-Drafts. The list of current Internet-		working documents as Internet-Drafts. The list of current Internet-
	Drafts is at https://datatracker.ietf.org/drafts/current/.		Drafts is at https://datatracker.ietf.org/drafts/current/.
	Internet-Drafts are draft documents valid for a maximum of six months		Internet-Drafts are draft documents valid for a maximum of six months
	and may be updated, replaced, or obsoleted by other documents at any		and may be updated, replaced, or obsoleted by other documents at any
	time. It is inappropriate to use Internet-Drafts as reference		time. It is inappropriate to use Internet-Drafts as reference
	material or to cite them other than as "work in progress."		material or to cite them other than as "work in progress."
	This Internet-Draft will expire on July 6, 2019.		This Internet-Draft will expire on December 26, 2019.
	Copyright Notice		Copyright Notice
	Copyright (c) 2019 IETF Trust and the persons identified as the		Copyright (c) 2019 IETF Trust and the persons identified as the
	document authors. All rights reserved.		document authors. All rights reserved.
	This document is subject to BCP 78 and the IETF Trust's Legal		This document is subject to BCP 78 and the IETF Trust's Legal
	Provisions Relating to IETF Documents		Provisions Relating to IETF Documents
	(https://trustee.ietf.org/license-info) in effect on the date of		(https://trustee.ietf.org/license-info) in effect on the date of
	publication of this document. Please review these documents		publication of this document. Please review these documents
	carefully, as they describe your rights and restrictions with respect		carefully, as they describe your rights and restrictions with respect
	to this document. Code Components extracted from this document must		to this document. Code Components extracted from this document must
	include Simplified BSD License text as described in Section 4.e of		include Simplified BSD License text as described in Section 4.e of
	the Trust Legal Provisions and are provided without warranty as		the Trust Legal Provisions and are provided without warranty as
	described in the Simplified BSD License.		described in the Simplified BSD License.
	Table of Contents		Table of Contents
	1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3		1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
	1.1. Requirements Language . . . . . . . . . . . . . . . . . . 3		1.1. Requirements Language . . . . . . . . . . . . . . . . . . 4
	2. Background . . . . . . . . . . . . . . . . . . . . . . . . . 3		2. Background . . . . . . . . . . . . . . . . . . . . . . . . . 4
	2.1. Uneven Transport Usage and Preference . . . . . . . . . . 4		2.1. Uneven Transport Usage and Preference . . . . . . . . . . 4
	2.2. Waiting for Large Messages and Reliability . . . . . . . 4		2.2. Waiting for Large Messages and Reliability . . . . . . . 5
	2.3. EDNS0 . . . . . . . . . . . . . . . . . . . . . . . . . . 5		2.3. EDNS0 . . . . . . . . . . . . . . . . . . . . . . . . . . 5
	2.4. Fragmentation and Truncation . . . . . . . . . . . . . . 5		2.4. Fragmentation and Truncation . . . . . . . . . . . . . . 6
	2.5. "Only Zone Transfers Use TCP" . . . . . . . . . . . . . . 6		2.5. "Only Zone Transfers Use TCP" . . . . . . . . . . . . . . 7
	3. DNS over TCP Requirements . . . . . . . . . . . . . . . . . . 7		3. DNS over TCP Requirements . . . . . . . . . . . . . . . . . . 7
	4. Network and System Considerations . . . . . . . . . . . . . . 8		4. Network and System Considerations . . . . . . . . . . . . . . 8
	4.1. Connection Admission . . . . . . . . . . . . . . . . . . 8		4.1. Connection Admission . . . . . . . . . . . . . . . . . . 8
	4.2. Connection Management . . . . . . . . . . . . . . . . . . 9		4.2. Connection Management . . . . . . . . . . . . . . . . . . 9
	4.3. Connection Termination . . . . . . . . . . . . . . . . . 10		4.3. Connection Termination . . . . . . . . . . . . . . . . . 10
	5. DNS over TCP Filtering Risks . . . . . . . . . . . . . . . . 10		5. DNS over TCP Filtering Risks . . . . . . . . . . . . . . . . 10
	5.1. DNS Wedgie . . . . . . . . . . . . . . . . . . . . . . . 11		5.1. DNS Wedgie . . . . . . . . . . . . . . . . . . . . . . . 11
	5.2. DNS Root Zone KSK Rollover . . . . . . . . . . . . . . . 11		5.2. DNS Root Zone KSK Rollover . . . . . . . . . . . . . . . 11
	5.3. DNS-over-TLS . . . . . . . . . . . . . . . . . . . . . . 11		5.3. DNS-over-TLS . . . . . . . . . . . . . . . . . . . . . . 11
	6. Logging and Monitoring . . . . . . . . . . . . . . . . . . . 12		6. Logging and Monitoring . . . . . . . . . . . . . . . . . . . 12
	7. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 12		7. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 12
	8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 12		8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 13
	9. Security Considerations . . . . . . . . . . . . . . . . . . . 12		9. Security Considerations . . . . . . . . . . . . . . . . . . . 13
	10. Privacy Considerations . . . . . . . . . . . . . . . . . . . 13		10. Privacy Considerations . . . . . . . . . . . . . . . . . . . 13
	11. References . . . . . . . . . . . . . . . . . . . . . . . . . 13		11. Examples . . . . . . . . . . . . . . . . . . . . . . . . . . 13
	11.1. Normative References . . . . . . . . . . . . . . . . . . 13		12. References . . . . . . . . . . . . . . . . . . . . . . . . . 13
	11.2. Informative References . . . . . . . . . . . . . . . . . 13		12.1. Normative References . . . . . . . . . . . . . . . . . . 13
	Appendix A. Standards Related to DNS Transport over TCP . . . . 18		12.2. Informative References . . . . . . . . . . . . . . . . . 13
	A.1. TODO - additional, relevant RFCs . . . . . . . . . . . . 18		Appendix A. Standards Related to DNS Transport over TCP . . . . 19
	A.2. IETF RFC 5936 - DNS Zone Transfer Protocol (AXFR) . . . . 18		A.1. IETF RFC 1035 - DOMAIN NAMES - IMPLEMENTATION AND
	A.3. IETF RFC 6304 - AS112 Nameserver Operations . . . . . . . 18		SPECIFICATION . . . . . . . . . . . . . . . . . . . . . . 19
	A.4. IETF RFC 6762 - Multicast DNS . . . . . . . . . . . . . . 18		A.2. IETF RFC 1536 - Common DNS Implementation Errors and
	A.5. IETF RFC 6950 - Architectural Considerations on		Suggested Fixes . . . . . . . . . . . . . . . . . . . . . 19
	Application Features in the DNS . . . . . . . . . . . . . 18		A.3. IETF RFC 1995 - Incremental Zone Transfer in DNS . . . . 19
	A.6. IETF RFC 7477 - Child-to-Parent Synchronization in DNS . 18		A.4. IETF RFC 1996 - A Mechanism for Prompt Notification of
	A.7. IETF RFC 7720 - DNS Root Name Service Protocol and		Zone Changes (DNS NOTIFY) . . . . . . . . . . . . . . . . 20
	Deployment Requirements . . . . . . . . . . . . . . . . . 19		A.5. IETF RFC 2181 - Clarifications to the DNS Specification . 20
	A.8. IETF RFC 7766 - DNS Transport over TCP - Implementation		A.6. IETF RFC 2694 - DNS extensions to Network Address
	Requirements . . . . . . . . . . . . . . . . . . . . . . 19		Translators (DNS_ALG) . . . . . . . . . . . . . . . . . . 20
	A.9. IETF RFC 7828 - The edns-tcp-keepalive EDNS0 Option . . . 19		A.7. IETF RFC 3225 - Indicating Resolver Support of DNSSEC . . 20
	A.10. IETF RFC 7858 - Specification for DNS over Transport		A.8. IETF RFC 3326 - DNSSEC and IPv6 A6 aware server/resolver
	Layer Security (TLS) . . . . . . . . . . . . . . . . . . 19		message size requirements . . . . . . . . . . . . . . . . 20
	A.11. IETF RFC 7873 - Domain Name System (DNS) Cookies . . . . 19		A.9. IETF RFC 4472 - Operational Considerations and Issues
	A.12. IETF RFC 7901 - CHAIN Query Requests in DNS . . . . . . . 20		with IPv6 DNS . . . . . . . . . . . . . . . . . . . . . . 21
	A.13. IETF RFC 8027 - DNSSEC Roadblock Avoidance . . . . . . . 20		A.10. IETF RFC 5452 - Measures for Making DNS More Resilient
	A.14. IETF RFC 8094 - DNS over Datagram Transport Layer		against Forged Answers . . . . . . . . . . . . . . . . . 21
	Security (DTLS) . . . . . . . . . . . . . . . . . . . . . 20		A.11. IETF RFC 5507 - Design Choices When Expanding the DNS . . 21
	A.15. IETF RFC 8162 - Using Secure DNS to Associate		A.12. IETF RFC 5625 - DNS Proxy Implementation Guidelines . . . 21
	Certificates with Domain Names for S/MIME . . . . . . . . 20		A.13. IETF RFC 5936 - DNS Zone Transfer Protocol (AXFR) . . . . 21
	A.16. IETF RFC 8324 - DNS Privacy, Authorization, Special Uses,		A.14. IETF RFC 5966 - DNS Transport over TCP - Implementation
			Requirements . . . . . . . . . . . . . . . . . . . . . . 22
			A.15. IETF RFC 6304 - AS112 Nameserver Operations . . . . . . . 22
			A.16. IETF RFC 6762 - Multicast DNS . . . . . . . . . . . . . . 22
			A.17. IETF RFC 6891 - Extension Mechanisms for DNS (EDNS(0)) . 22
			A.18. IETF RFC 6950 - Architectural Considerations on
			Application Features in the DNS . . . . . . . . . . . . . 22
			A.19. IETF RFC 7477 - Child-to-Parent Synchronization in DNS . 22
			A.20. IETF RFC 7720 - DNS Root Name Service Protocol and
			Deployment Requirements . . . . . . . . . . . . . . . . . 23
			A.21. IETF RFC 7766 - DNS Transport over TCP - Implementation
			Requirements . . . . . . . . . . . . . . . . . . . . . . 23
			A.22. IETF RFC 7828 - The edns-tcp-keepalive EDNS0 Option . . . 23
			A.23. IETF RFC 7858 - Specification for DNS over Transport
			Layer Security (TLS) . . . . . . . . . . . . . . . . . . 23
			A.24. IETF RFC 7873 - Domain Name System (DNS) Cookies . . . . 23
			A.25. IETF RFC 7901 - CHAIN Query Requests in DNS . . . . . . . 24
			A.26. IETF RFC 8027 - DNSSEC Roadblock Avoidance . . . . . . . 24
			A.27. IETF RFC 8094 - DNS over Datagram Transport Layer
			Security (DTLS) . . . . . . . . . . . . . . . . . . . . . 24
			A.28. IETF RFC 8162 - Using Secure DNS to Associate
			Certificates with Domain Names for S/MIME . . . . . . . . 24
			A.29. IETF RFC 8324 - DNS Privacy, Authorization, Special Uses,
	Encoding, Characters, Matching, and Root Structure: Time		Encoding, Characters, Matching, and Root Structure: Time
	for Another Look? . . . . . . . . . . . . . . . . . . . . 20		for Another Look? . . . . . . . . . . . . . . . . . . . . 24
	A.17. IETF RFC 8467 - Padding Policies for Extension Mechanisms		A.30. IETF RFC 8467 - Padding Policies for Extension Mechanisms
	for DNS (EDNS(0)) . . . . . . . . . . . . . . . . . . . . 21		for DNS (EDNS(0)) . . . . . . . . . . . . . . . . . . . . 25
	A.18. IETF RFC 8483 - Yeti DNS Testbed . . . . . . . . . . . . 21		A.31. IETF RFC 8483 - Yeti DNS Testbed . . . . . . . . . . . . 25
	A.19. IETF RFC 8484 - DNS Queries over HTTPS (DoH) . . . . . . 21		A.32. IETF RFC 8484 - DNS Queries over HTTPS (DoH) . . . . . . 25
	Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 21		A.33. IETF RFC 8490 - DNS Stateful Operations . . . . . . . . . 25
			Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 25
	1. Introduction		1. Introduction
	DNS messages may be delivered using UDP or TCP communications. While		DNS messages may be delivered using UDP or TCP communications. While
	most DNS transactions are carried over UDP, some operators have been		most DNS transactions are carried over UDP, some operators have been
	led to believe that any DNS over TCP traffic is unwanted or		led to believe that any DNS over TCP traffic is unwanted or
	unnecessary for general DNS operation. As usage and features have		unnecessary for general DNS operation. When DNS over TCP has been
	evolved, TCP transport has become increasingly important for correct		restricted, a variety of communication failures and debugging
	and safe operation of the Internet DNS. Reflecting modern usage, the		challenges often arise. As DNS and new naming system features have
	DNS standards were recently updated to declare support for TCP is now		evolved, TCP as a transport has become increasingly important for the
	a required part of the DNS implementation specifications in		correct and safe operation of an Internet DNS. Reflecting modern
	[RFC7766]. This document is the formal requirements equivalent for		usage, the DNS standards were recently updated to declare support for
	the operational community, encouraging operators to ensure DNS over		TCP is now a required part of the DNS implementation
	TCP communications support is on par with DNS over UDP		specifications.[RFC7766] This document is the formal requirements
			equivalent for the operational community, encouraging system
			administrators, network engineers, and security staff to ensure DNS
			over TCP communications support is on par with DNS over UDP
	communications.		communications.
	1.1. Requirements Language		1.1. Requirements Language
	The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",		The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
	"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this		"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
	document are to be interpreted as described in RFC 2119 [RFC2119].		document are to be interpreted as described in RFC 2119 [RFC2119].
	2. Background		2. Background
	The curious state of disagreement in operational best practices and		The curious state of disagreement in operational best practices and
	guidance for DNS transport protocols derives from conflicting		guidance for DNS transport protocols derives from conflicting
	messages operators have gotten from other operators, implementors,		messages operators have gotten from other operators, implementors,
	and even the IETF. Sometimes these mixed signals have been explicit,		and even the IETF. Sometimes these mixed signals have been explicit,
	on other occasions they have suspiciously implicit. Here we		on other occasions they have suspiciously implicit. This section
	summarize our interpretation of the storied and conflicting history		presents an interpretation of the storied and conflicting history
	that has brought us to this document.		that led to this document.
	2.1. Uneven Transport Usage and Preference		2.1. Uneven Transport Usage and Preference
	In the original suite of DNS specifications, [RFC1034] and [RFC1035]		In the original suite of DNS specifications, [RFC1034] and [RFC1035]
	clearly specified that DNS messages could be carried in either UDP or		clearly specified that DNS messages could be carried in either UDP or
	TCP, but they also made clear a preference for UDP as the transport		TCP, but they also stated a preference for UDP as the best transport
	for queries in the general case. As stated in [RFC1035]:		for queries in the general case. As stated in [RFC1035]:
	"While virtual circuits can be used for any DNS activity,		"While virtual circuits can be used for any DNS activity,
	datagrams are preferred for queries due to their lower overhead		datagrams are preferred for queries due to their lower overhead
	and better performance."		and better performance."
	Another early, important, and influential document, [RFC1123],		Another early, important, and influential document, [RFC1123], marked
	detailed the preference for UDP more explicitly:		the preference for a transport protocol more explicitly:
	"DNS resolvers and recursive servers MUST support UDP, and SHOULD		"DNS resolvers and recursive servers MUST support UDP, and SHOULD
	support TCP, for sending (non-zone-transfer) queries."		support TCP, for sending (non-zone-transfer) queries."
	and further stipulated:		and further stipulated:
	"A name server MAY limit the resources it devotes to TCP queries,		"A name server MAY limit the resources it devotes to TCP queries,
	but it SHOULD NOT refuse to service a TCP query just because it		but it SHOULD NOT refuse to service a TCP query just because it
	would have succeeded with UDP."		would have succeeded with UDP."
	Culminating in [RFC1536], DNS over TCP came to be associated		Culminating in [RFC1536], DNS over TCP came to be associated
	primarily with the zone transfer mechanism, while most DNS queries		primarily with the zone transfer mechanism, while most DNS queries
	and responses were seen as the dominion of UDP.		and responses were seen as the dominion of UDP.
	2.2. Waiting for Large Messages and Reliability		2.2. Waiting for Large Messages and Reliability
	In the original specifications, the maximum DNS over UDP message size		In the original specifications, the maximum DNS over UDP message size
	was enshrined at 512 bytes. However, even while [RFC1123] made a		was enshrined at 512 bytes. However, even while [RFC1123] preferred
	clear preference for UDP, it foresaw DNS over TCP becoming more		UDP for non-zone transfer queries, it foresaw DNS over TCP becoming
	popular in the future to overcome this limitation:		more popular in the future to overcome this limitation:
	"[...] it is also clear that some new DNS record types defined in		"[...] it is also clear that some new DNS record types defined in
	the future will contain information exceeding the 512 byte limit		the future will contain information exceeding the 512 byte limit
	that applies to UDP, and hence will require TCP.		that applies to UDP, and hence will require TCP.
	At least two new, widely anticipated developments were set to elevate		At least two new, widely anticipated developments were set to elevate
	the need for DNS over TCP transactions. The first was dynamic		the need for DNS over TCP transactions. The first was dynamic
	updates defined in [RFC2136] and the second was the set of extensions		updates defined in [RFC2136] and the second was the set of extensions
	collectively known as DNSSEC originally specified in [RFC2541]. The		collectively known as DNSSEC originally specified in [RFC2541]. The
	former suggested "requestors who require an accurate response code		former suggested "requestors who require an accurate response code
	skipping to change at page 5, line 4 ¶		skipping to change at page 5, line 25 ¶
	At least two new, widely anticipated developments were set to elevate		At least two new, widely anticipated developments were set to elevate
	the need for DNS over TCP transactions. The first was dynamic		the need for DNS over TCP transactions. The first was dynamic
	updates defined in [RFC2136] and the second was the set of extensions		updates defined in [RFC2136] and the second was the set of extensions
	collectively known as DNSSEC originally specified in [RFC2541]. The		collectively known as DNSSEC originally specified in [RFC2541]. The
	former suggested "requestors who require an accurate response code		former suggested "requestors who require an accurate response code
	must use TCP", while the later warned "[...] larger keys increase the		must use TCP", while the later warned "[...] larger keys increase the
	size of KEY and SIG RRs. This increases the chance of DNS UDP packet		size of KEY and SIG RRs. This increases the chance of DNS UDP packet
	overflow and the possible necessity for using higher overhead TCP in		overflow and the possible necessity for using higher overhead TCP in
	responses."		responses."
	Yet defying some expectations, DNS over TCP remained little used in		Yet defying some expectations, DNS over TCP remained little used in
	real traffic across the Internet. Dynamic updates saw little		real traffic across the Internet. Dynamic updates saw little
	deployment between autonomous networks. Around the time DNSSEC was		deployment between autonomous networks. Around the time DNSSEC was
	first defined, another new feature helped solidify UDP's transport		first defined, another new feature helped solidify UDP transport
	dominance for message transactions.		dominance for message transactions.
	2.3. EDNS0		2.3. EDNS0
	In 1999 the IETF published the Extension Mechanisms for DNS (EDNS0)		In 1999 the IETF published the Extension Mechanisms for DNS (EDNS0)
	in [RFC2671] (superseded in 2013 by an update in [RFC6891]). This		in [RFC2671] (superseded in 2013 by an update in [RFC6891]). This
	document standardized a way for communicating DNS nodes to perform		document standardized a way for communicating DNS nodes to perform
	rudimentary capabilities negotiation. One such capability written		rudimentary capabilities negotiation. One such capability written
	into the base specification and present in every ENDS0 compatible		into the base specification and present in every ENDS0 compatible
	message is the value of the maximum UDP payload size the sender can		message is the value of the maximum UDP payload size the sender can
	support. This unsigned 16-bit field specifies in bytes the maximum		support. This unsigned 16-bit field specifies in bytes the maximum
	(possibly fragmented) DNS message size a node is capable of		(possibly fragmented) DNS message size a node is capable of
	receiving. In practice, typical values are a subset of the 512 to		receiving. In practice, typical values are a subset of the 512 to
	4096 byte range. EDNS0 became widely deployed over the next several		4096 byte range. EDNS0 became widely deployed over the next several
	years and numerous surveys have shown many systems currently support		years and numerous surveys have shown many systems currently support
	larger UDP MTUs [CASTRO2010], [NETALYZR] with EDNS0.		larger UDP MTUs [CASTRO2010], [NETALYZR] with EDNS0.
	The natural effect of EDNS0 deployment meant DNS messages larger than		The natural effect of EDNS0 deployment meant DNS messages larger than
	512 bytes would be less reliant on TCP than they might otherwise have		512 bytes would be less reliant on TCP than they might otherwise have
	been. While a non-negligible population of DNS systems lack EDNS0 or		been. While a non-negligible population of DNS systems lacked EDNS0
	may still fall back to TCP for some transactions, DNS over TCP		or fall back to TCP when necessary, DNS over TCP transactions
	transactions remain a very small fraction of overall DNS traffic		remained a very small fraction of overall DNS traffic [VERISIGN].
	[VERISIGN].
	2.4. Fragmentation and Truncation		2.4. Fragmentation and Truncation
	Although EDNS0 provides a way for endpoints to signal support for DNS		Although EDNS0 provides a way for endpoints to signal support for DNS
	messages exceeding 512 bytes, the realities of a diverse and		messages exceeding 512 bytes, the realities of a diverse and
	inconsistently deployed Internet may result in some large messages		inconsistently deployed Internet may result in some large messages
	being unable to reach their destination. Any IP datagram whose size		being unable to reach their destination. Any IP datagram whose size
	exceeds the MTU of a link it transits will be fragmented and then		exceeds the MTU of a link it transits will be fragmented and then
	reassembled by the receiving host. Unfortunately, it is not uncommon		reassembled by the receiving host. Unfortunately, it is not uncommon
	for middleboxes and firewalls to block IP fragments. If one or more		for middleboxes and firewalls to block IP fragments. If one or more
	fragments do not arrive, the application does not receive the message		fragments do not arrive, the application does not receive the message
	and the request times out.		and the request times out.
	For IPv4-connected hosts, the de-facto MTU is often the Ethernet		For IPv4-connected hosts, the de-facto MTU is often the Ethernet
	payload size of 1500 bytes. This means that the largest unfragmented		payload size of 1500 bytes. This means that the largest unfragmented
	UDP DNS message that can be sent over IPv4 is likely 1472 bytes. For		UDP DNS message that can be sent over IPv4 is likely 1472 bytes. For
	IPv6, the situation is a little more complicated. First, IPv6		IPv6, the situation is a little more complicated. First, IPv6
	headers are 40 bytes (versus 20 without option in IPv4). Second, it		headers are 40 bytes (versus 20 without options in IPv4). Second, it
	seems as though some people have mis-interpreted IPv6's required		seems as though some people have mis-interpreted IPv6's required
	minimum MTU of 1280 as a required maximum. Third, fragmentation in		minimum MTU of 1280 as a required maximum. Third, fragmentation in
	IPv6 can only be done by the host originating the datagram. The need		IPv6 can only be done by the host originating the datagram. The need
	to fragment is conveyed in an ICMPv6 "packet too big" message. The		to fragment is conveyed in an ICMPv6 "packet too big" message. The
	originating host indicates a fragmented datagram with IPv6 extension		originating host indicates a fragmented datagram with IPv6 extension
	headers. Unfortunately, it is quite common for both ICMPv6 and IPv6		headers. Unfortunately, it is quite common for both ICMPv6 and IPv6
	extension headers to be blocked by middleboxes. According to		extension headers to be blocked by middleboxes. According to
	[HUSTON] some 35% of IPv6-capable recursive resolvers are unable to		[HUSTON] some 35% of IPv6-capable recursive resolvers were unable to
	receive a fragmented IPv6 packet.		receive a fragmented IPv6 packet.
	The practical consequence of all this is that DNS requestors must be		The practical consequence of all this is that DNS requestors must be
	prepared to retry queries with different EDNS0 maximum message size		prepared to retry queries with different EDNS0 maximum message size
	values. Administrators of BIND are likely to be familiar with seeing		values. Administrators of BIND are likely to be familiar with seeing
	"success resolving ... after reducing the advertised EDNS0 UDP packet		"success resolving ... after reducing the advertised EDNS0 UDP packet
	size to 512 octets" messages in their system logs.		size to 512 octets" messages in their system logs.
	Often, reducing the EDNS0 UDP packet size leads to a successful		Often, reducing the EDNS0 UDP packet size leads to a successful
	response. That is, the necessary data fits within the smaller		response. That is, the necessary data fits within the smaller
	skipping to change at page 6, line 40 ¶		skipping to change at page 7, line 12 ¶
	easily in 512 bytes. The KSK Rollover design team [DESIGNTEAM] spent		easily in 512 bytes. The KSK Rollover design team [DESIGNTEAM] spent
	a lot of time thinking and worrying about response sizes. There is		a lot of time thinking and worrying about response sizes. There is
	growing sentiment in the DNSSEC community that RSA key sizes beyond		growing sentiment in the DNSSEC community that RSA key sizes beyond
	2048-bits are impractical and that critical infrastructure zones		2048-bits are impractical and that critical infrastructure zones
	should transition to elliptic curve algorithms to keep response sizes		should transition to elliptic curve algorithms to keep response sizes
	manageable.		manageable.
	2.5. "Only Zone Transfers Use TCP"		2.5. "Only Zone Transfers Use TCP"
	Today, the majority of the DNS community expects, or at least has a		Today, the majority of the DNS community expects, or at least has a
	desire, to see DNS over TCP transactions to occur without		desire, to see DNS over TCP transactions occur without interference.
	interference. However there has also been a long held belief by some		However there has also been a long held belief by some operators,
	operators, particularly for security-related reasons, that DNS over		particularly for security-related reasons, that DNS over TCP services
	TCP services should be purposely limited or not provided at all		should be purposely limited or not provided at all [CHES94],
	[CHES94], [DJBDNS]. A popular meme has also held the imagination of		[DJBDNS]. A popular meme has also held the imagination of some that
	some that DNS over TCP is only ever used for zone transfers and is		DNS over TCP is only ever used for zone transfers and is generally
	generally unnecessary otherwise, with filtering all DNS over TCP		unnecessary otherwise, with filtering all DNS over TCP traffic even
	traffic even described as a best practice.		described as a best practice.
	The position on restricting DNS over TCP had some justification given		The position on restricting DNS over TCP had some justification given
	that historic implementations of DNS nameservers provided very little		that historic implementations of DNS nameservers provided very little
	in the way of TCP connection management (for example see		in the way of TCP connection management (for example see
	Section 6.1.2 of [RFC7766] for more details). However modern		Section 6.1.2 of [RFC7766] for more details). However modern
	standards and implementations are moving to align with the more		standards and implementations are nearing parity with the more
	sophisticated TCP management techniques employed by, for example,		sophisticated TCP management techniques employed by, for example,
	HTTP(S) servers and load balancers.		HTTP(S) servers and load balancers.
	3. DNS over TCP Requirements		3. DNS over TCP Requirements
	An average increase in DNS message size, the continued development of		An average increase in DNS message size, the continued development of
	new DNS features and a denial of service mitigation technique (see		new DNS features [Appendix A], and a denial of service mitigation
	Section 9) have suggested that DNS over TCP transactions are as		technique [Section 9] have suggested that DNS over TCP transactions
	important to the correct and safe operation of the Internet DNS as		are as important to the correct and safe operation of the Internet
	ever, if not more so. Furthermore, there has been serious research		DNS as ever, if not more so. Furthermore, there has been serious
	that has suggested connection-oriented DNS transactions may provide		research that argues connection-oriented DNS transactions may provide
	security and privacy advantages over UDP transport [TDNS]. In fact,		security and privacy advantages over UDP transport. [TDNS] In fact
	[RFC7858], a Standards Track document is just this sort of		[RFC7858], a Standards Track document, is just this sort of
	specification. Therefore, we now believe it is undesirable for		specification. Therefore, this document makes explicit that it is
	network operators to artificially inhibit the potential utility and		undesirable for network operators to artificially inhibit DNS over
	advances in the DNS such as these.		TCP transport.
	TODO: I think the text below needs some work/discussion because 7766
	already updated 1123 in a very similar way except that 7766 speaks of
	"implement" and this one speaks of "service". 1123 speaks of
	"support" and doesn't distinguish between implement/service.
	Section 6.1.3.2 in [RFC1123] is updated: All general-purpose DNS		Section 6.1.3.2 in [RFC1123] is updated: All DNS resolvers and
	servers MUST be able to service both UDP and TCP queries.		servers MUST support and service both UDP and TCP queries.
	o Authoritative servers MUST service TCP queries so that they do not		o Authoritative servers MUST support and service all TCP queries so
	limit the size of responses to what fits in a single UDP packet.		that they do not limit the size of responses to what fits in a
			single UDP packet.
	o Recursive servers (or forwarders) MUST service TCP queries so that		o Recursive servers (or forwarders) MUST support and service all TCP
	they do not prevent large responses from a TCP-capable server from		queries so that they do not prevent large responses from a TCP-
	reaching its TCP-capable clients.		capable server from reaching its TCP-capable clients.
	Regarding the choice of limiting the resources a server devotes to		Regarding the choice of limiting the resources a server devotes to
	queries, Section 6.1.3.2 in [RFC1123] also says:		queries, Section 6.1.3.2 in [RFC1123] also says:
	"A name server MAY limit the resources it devotes to TCP queries,		"A name server MAY limit the resources it devotes to TCP queries,
	but it SHOULD NOT refuse to service a TCP query just because it		but it SHOULD NOT refuse to service a TCP query just because it
	would have succeeded with UDP."		would have succeeded with UDP."
	This requirement is hereby updated: A name server MAY limit the the		This requirement is hereby updated: A name server MAY limit the the
	resources it devotes to queries, but it MUST NOT refuse to service a		resources it devotes to queries, but it MUST NOT refuse to service a
	query just because it would have succeeded with another transport		query just because it would have succeeded with another transport
	protocol.		protocol.
	Filtering of DNS over TCP is considered harmful in the general case.		Filtering of DNS over TCP is considered harmful in the general case.
	DNS resolver and server operators MUST provide DNS service over both		DNS resolver and server operators MUST suport and provide DNS service
	UDP and TCP transports. Likewise, network operators MUST allow DNS		over both UDP and TCP transports. Likewise, network operators MUST
	service over both UDP and TCP transports. It must be acknowledged		allow DNS service over both UDP and TCP transports. It is
	that DNS over TCP service can pose operational challenges that are		acknowledged that DNS over TCP service can pose operational
	not present when running DNS over UDP alone, and vice-versa.		challenges that are not present when running DNS over UDP alone, and
	However, it is the aim of this document to argue that the potential		vice-versa. However, it is the aim of this document to argue that
	damage incurred by prohibiting DNS over TCP service is more		the potential damage incurred by prohibiting DNS over TCP service is
	detrimental to the continued utility and success of the DNS than when		more detrimental to the continued utility and success of the DNS than
	its usage is allowed.		when its usage is allowed.
	4. Network and System Considerations		4. Network and System Considerations
	This section describes measures that systems and applications can		This section describes measures that systems and applications can
	take to optimize performance over TCP and to protect themselves from		take to optimize performance over TCP and to protect themselves from
	TCP-based resource exhaustion and attacks.		TCP-based resource exhaustion and attacks.
	4.1. Connection Admission		4.1. Connection Admission
	The SYN flooding attack is a denial-of-service method affecting hosts		The SYN flooding attack is a denial-of-service method affecting hosts
	skipping to change at page 9, line 41 ¶		skipping to change at page 10, line 12 ¶
	used to ensure that a single or small set of users can not consume		used to ensure that a single or small set of users can not consume
	all TCP resources and deny service to other users. Operators SHOULD		all TCP resources and deny service to other users. Operators SHOULD
	ensure this limit is configured appropriately, based on their number		ensure this limit is configured appropriately, based on their number
	of diversity of users.		of diversity of users.
	DNS server software SHOULD provide a configurable timeout for idle		DNS server software SHOULD provide a configurable timeout for idle
	TCP connections. For very busy name servers this might be set to a		TCP connections. For very busy name servers this might be set to a
	low value, such as a few seconds. For less busy servers it might be		low value, such as a few seconds. For less busy servers it might be
	set to a higher value, such as tens of seconds. DNS clients and		set to a higher value, such as tens of seconds. DNS clients and
	servers SHOULD signal their timeout values using the edns-tcp-		servers SHOULD signal their timeout values using the edns-tcp-
	keepalive option [RFC7828].		keepalive option.[RFC7828]
	DNS server software MAY provide a configurable limit on the number of		DNS server software MAY provide a configurable limit on the number of
	transactions per TCP connection. This document does not offer advice		transactions per TCP connection. This document does not offer advice
	on particular values for such a limit.		on particular values for such a limit.
	Similarly, DNS server software MAY provide a configurable limit on		Similarly, DNS server software MAY provide a configurable limit on
	the total duration of a TCP connection. This document does not offer		the total duration of a TCP connection. This document does not offer
	advice on particular values for such a limit.		advice on particular values for such a limit.
	Since clients may not be aware of server-imposed limits, clients		Since clients may not be aware of server-imposed limits, clients
	skipping to change at page 10, line 39 ¶		skipping to change at page 11, line 8 ¶
	Networks that filter DNS over TCP risk losing access to significant		Networks that filter DNS over TCP risk losing access to significant
	or important pieces of the DNS name space. For a variety of reasons		or important pieces of the DNS name space. For a variety of reasons
	a DNS answer may require a DNS over TCP query. This may include		a DNS answer may require a DNS over TCP query. This may include
	large message sizes, lack of EDNS0 support, DDoS mitigation		large message sizes, lack of EDNS0 support, DDoS mitigation
	techniques, or perhaps some future capability that is as yet		techniques, or perhaps some future capability that is as yet
	unforeseen will also demand TCP transport.		unforeseen will also demand TCP transport.
	For example, [RFC7901] describes a latency-avoiding technique that		For example, [RFC7901] describes a latency-avoiding technique that
	sends extra data in DNS responses. This makes responses larger and		sends extra data in DNS responses. This makes responses larger and
	potentially increases the risk of DDoS reflection attacks. The		potentially increases the risk of DDoS reflection attacks. The
	specification mandates the use of TCP or DNS Cookies ([RFC7873]).		specification mandates the use of TCP or DNS Cookies.[RFC7873]
	Even if any or all particular answers have consistently been returned		Even if any or all particular answers have consistently been returned
	successfully with UDP in the past, this continued behavior cannot be		successfully with UDP in the past, this continued behavior cannot be
	guaranteed when DNS messages are exchanged between autonomous		guaranteed when DNS messages are exchanged between autonomous
	systems. Therefore, filtering of DNS over TCP is considered harmful		systems. Therefore, filtering of DNS over TCP is considered harmful
	and contrary to the safe and successful operation of the Internet.		and contrary to the safe and successful operation of the Internet.
	This section enumerates some of the known risks we know about at the		This section enumerates some of the known risks known at the time of
	time of this writing when networks filter DNS over TCP.		this writing when networks filter DNS over TCP.
	5.1. DNS Wedgie		5.1. DNS Wedgie
	Networks that filter DNS over TCP may inadvertently cause problems		Networks that filter DNS over TCP may inadvertently cause problems
	for third party resolvers as experienced by [TOYAMA]. If for		for third party resolvers as experienced by [TOYAMA]. If for
	instance a resolver receives a truncated answer from a server, but		instance a resolver receives a truncated answer from a server, but
	when the resolver resends the query using TCP and the TCP response		when the resolver resends the query using TCP and the TCP response
	never arrives, not only will full answer be unavailable, but the		never arrives, not only will a complete answer be unavailable, but
	resolver will incur the full extent of TCP retransmissions and time		the resolver will incur the full extent of TCP retransmissions and
	outs. This situation might place extreme strain on resolver		time outs. This situation might place extreme strain on resolver
	resources. If the number and frequency of these truncated answers		resources. If the number and frequency of these truncated answers
	are sufficiently high, we refer to the steady-state of lost resources		are sufficiently high, the steady-state of lost resources as a result
	as a result a "DNS" wedgie". A DNS wedgie is often not easily or		is a "DNS" wedgie". A DNS wedgie is generally not easily or
	completely mitigated by the affected DNS resolver operator.		completely mitigated by the affected DNS resolver operator.
	5.2. DNS Root Zone KSK Rollover		5.2. DNS Root Zone KSK Rollover
	Recent plans for a new root zone DNSSEC KSK have highlighted a		Recent plans for a new root zone DNSSEC KSK have highlighted a
	potential problem in retrieving the keys [LEWIS]. Some packets in		potential problem in retrieving the keys.[LEWIS] Some packets in the
	the KSK rollover process will be larger than 1280 bytes, the IPv6		KSK rollover process will be larger than 1280 bytes, the IPv6 minimum
	minimum MTU for links carrying IPv6 traffic.[RFC2460] While studies		MTU for links carrying IPv6 traffic.[RFC2460] While studies have
	have shown that problems due to fragment filtering or an inability to		shown that problems due to fragment filtering or an inability to
	generate and receive these larger messages are negligible, any DNS		generate and receive these larger messages are negligible, any DNS
	server that is unable to receive large DNS over UDP messages or		server that is unable to receive large DNS over UDP messages or
	perform DNS over TCP may experience severe disruption of DNS service		perform DNS over TCP may experience severe disruption of DNS service
	if performing DNSSEC validation.		if performing DNSSEC validation.
	TODO: Is this "overcome by events" now? We've had 1414 byte DNSKEY		TODO: Is this "overcome by events" now? We've had 1414 byte DNSKEY
	responses at the three ZSK rollover periods since KSK-2017 became		responses at the three ZSK rollover periods since KSK-2017 became
	published in the root zone.		published in the root zone.
	5.3. DNS-over-TLS		5.3. DNS-over-TLS
	skipping to change at page 12, line 38 ¶		skipping to change at page 12, line 48 ¶
	This document was initially motivated by feedback from students who		This document was initially motivated by feedback from students who
	pointed out that they were hearing contradictory information about		pointed out that they were hearing contradictory information about
	filtering DNS over TCP messages. Thanks in particular to a teaching		filtering DNS over TCP messages. Thanks in particular to a teaching
	colleague, JPL, who perhaps unknowingly encouraged the initial		colleague, JPL, who perhaps unknowingly encouraged the initial
	research into the differences of what the community has historically		research into the differences of what the community has historically
	said and did. Thanks to all the NANOG 63 attendees who provided		said and did. Thanks to all the NANOG 63 attendees who provided
	feedback to an early talk on this subject.		feedback to an early talk on this subject.
	The following individuals provided an array of feedback to help		The following individuals provided an array of feedback to help
	improve this document: Sara Dickinson, Bob Harold, Tatuya Jinmei, and		improve this document: Sara Dickinson, Bob Harold, Tatuya Jinmei, and
	Paul Hoffman. The authors are indebted to their contributions. Any		Paul Hoffman. The authors are also indebted to the contributions
	remaining errors or imperfections are the sole responsibility of the		stemming from discussion in the tcpm working group meeting at IETF
	document authors.		104. Any remaining errors or imperfections are the sole
			responsibility of the document authors.
	8. IANA Considerations		8. IANA Considerations
	This memo includes no request to IANA.		This memo includes no request to IANA.
	9. Security Considerations		9. Security Considerations
	Ironically, returning truncated DNS over UDP answers in order to		Ironically, returning truncated DNS over UDP answers in order to
	induce a client query to switch to DNS over TCP has become a common		induce a client query to switch to DNS over TCP has become a common
	response to source address spoofed, DNS denial-of-service attacks		response to source address spoofed, DNS denial-of-service attacks
	skipping to change at page 13, line 18 ¶		skipping to change at page 13, line 30 ¶
	DNS over TCP is not unlike many other Internet TCP services. TCP		DNS over TCP is not unlike many other Internet TCP services. TCP
	threats and many mitigation strategies have been well documented in a		threats and many mitigation strategies have been well documented in a
	series of documents such as [RFC4953], [RFC4987], [RFC5927], and		series of documents such as [RFC4953], [RFC4987], [RFC5927], and
	[RFC5961].		[RFC5961].
	10. Privacy Considerations		10. Privacy Considerations
	TODO: Does this document warrant privacy considerations?		TODO: Does this document warrant privacy considerations?
	11. References		11. Examples
	11.1. Normative References		Suggestion from IETF104 to include example config snippets ala 7706.
			12. References
			12.1. Normative References
	[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate		[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
	Requirement Levels", BCP 14, RFC 2119,		Requirement Levels", BCP 14, RFC 2119,
	DOI 10.17487/RFC2119, March 1997,		DOI 10.17487/RFC2119, March 1997,
	<https://www.rfc-editor.org/info/rfc2119>.		<https://www.rfc-editor.org/info/rfc2119>.
	11.2. Informative References		12.2. Informative References
	[CASTRO2010]		[CASTRO2010]
	Castro, S., Zhang, M., John, W., Wessels, D., and k.		Castro, S., Zhang, M., John, W., Wessels, D., and k.
	claffy, "Understanding and preparing for DNS evolution",		claffy, "Understanding and preparing for DNS evolution",
	2010.		2010.
	[CHES94] Cheswick, W. and S. Bellovin, "Firewalls and Internet		[CHES94] Cheswick, W. and S. Bellovin, "Firewalls and Internet
	Security: Repelling the Wily Hacker", 1994.		Security: Repelling the Wily Hacker", 1994.
	[CLOUDFLARE]		[CLOUDFLARE]
	skipping to change at page 14, line 35 ¶		skipping to change at page 15, line 5 ¶
	[RFC1123] Braden, R., Ed., "Requirements for Internet Hosts -		[RFC1123] Braden, R., Ed., "Requirements for Internet Hosts -
	Application and Support", STD 3, RFC 1123,		Application and Support", STD 3, RFC 1123,
	DOI 10.17487/RFC1123, October 1989,		DOI 10.17487/RFC1123, October 1989,
	<https://www.rfc-editor.org/info/rfc1123>.		<https://www.rfc-editor.org/info/rfc1123>.
	[RFC1536] Kumar, A., Postel, J., Neuman, C., Danzig, P., and S.		[RFC1536] Kumar, A., Postel, J., Neuman, C., Danzig, P., and S.
	Miller, "Common DNS Implementation Errors and Suggested		Miller, "Common DNS Implementation Errors and Suggested
	Fixes", RFC 1536, DOI 10.17487/RFC1536, October 1993,		Fixes", RFC 1536, DOI 10.17487/RFC1536, October 1993,
	<https://www.rfc-editor.org/info/rfc1536>.		<https://www.rfc-editor.org/info/rfc1536>.
			[RFC1995] Ohta, M., "Incremental Zone Transfer in DNS", RFC 1995,
			DOI 10.17487/RFC1995, August 1996,
			<https://www.rfc-editor.org/info/rfc1995>.
			[RFC1996] Vixie, P., "A Mechanism for Prompt Notification of Zone
			Changes (DNS NOTIFY)", RFC 1996, DOI 10.17487/RFC1996,
			August 1996, <https://www.rfc-editor.org/info/rfc1996>.
	[RFC2136] Vixie, P., Ed., Thomson, S., Rekhter, Y., and J. Bound,		[RFC2136] Vixie, P., Ed., Thomson, S., Rekhter, Y., and J. Bound,
	"Dynamic Updates in the Domain Name System (DNS UPDATE)",		"Dynamic Updates in the Domain Name System (DNS UPDATE)",
	RFC 2136, DOI 10.17487/RFC2136, April 1997,		RFC 2136, DOI 10.17487/RFC2136, April 1997,
	<https://www.rfc-editor.org/info/rfc2136>.		<https://www.rfc-editor.org/info/rfc2136>.
			[RFC2181] Elz, R. and R. Bush, "Clarifications to the DNS
			Specification", RFC 2181, DOI 10.17487/RFC2181, July 1997,
			<https://www.rfc-editor.org/info/rfc2181>.
	[RFC2460] Deering, S. and R. Hinden, "Internet Protocol, Version 6		[RFC2460] Deering, S. and R. Hinden, "Internet Protocol, Version 6
	(IPv6) Specification", RFC 2460, DOI 10.17487/RFC2460,		(IPv6) Specification", RFC 2460, DOI 10.17487/RFC2460,
	December 1998, <https://www.rfc-editor.org/info/rfc2460>.		December 1998, <https://www.rfc-editor.org/info/rfc2460>.
	[RFC2541] Eastlake 3rd, D., "DNS Security Operational		[RFC2541] Eastlake 3rd, D., "DNS Security Operational
	Considerations", RFC 2541, DOI 10.17487/RFC2541, March		Considerations", RFC 2541, DOI 10.17487/RFC2541, March
	1999, <https://www.rfc-editor.org/info/rfc2541>.		1999, <https://www.rfc-editor.org/info/rfc2541>.
	[RFC2671] Vixie, P., "Extension Mechanisms for DNS (EDNS0)",		[RFC2671] Vixie, P., "Extension Mechanisms for DNS (EDNS0)",
	RFC 2671, DOI 10.17487/RFC2671, August 1999,		RFC 2671, DOI 10.17487/RFC2671, August 1999,
	<https://www.rfc-editor.org/info/rfc2671>.		<https://www.rfc-editor.org/info/rfc2671>.
			[RFC2694] Srisuresh, P., Tsirtsis, G., Akkiraju, P., and A.
			Heffernan, "DNS extensions to Network Address Translators
			(DNS_ALG)", RFC 2694, DOI 10.17487/RFC2694, September
			1999, <https://www.rfc-editor.org/info/rfc2694>.
			[RFC3225] Conrad, D., "Indicating Resolver Support of DNSSEC",
			RFC 3225, DOI 10.17487/RFC3225, December 2001,
			<https://www.rfc-editor.org/info/rfc3225>.
			[RFC3226] Gudmundsson, O., "DNSSEC and IPv6 A6 aware server/resolver
			message size requirements", RFC 3226,
			DOI 10.17487/RFC3226, December 2001,
			<https://www.rfc-editor.org/info/rfc3226>.
			[RFC4472] Durand, A., Ihren, J., and P. Savola, "Operational
			Considerations and Issues with IPv6 DNS", RFC 4472,
			DOI 10.17487/RFC4472, April 2006,
			<https://www.rfc-editor.org/info/rfc4472>.
	[RFC4953] Touch, J., "Defending TCP Against Spoofing Attacks",		[RFC4953] Touch, J., "Defending TCP Against Spoofing Attacks",
	RFC 4953, DOI 10.17487/RFC4953, July 2007,		RFC 4953, DOI 10.17487/RFC4953, July 2007,
	<https://www.rfc-editor.org/info/rfc4953>.		<https://www.rfc-editor.org/info/rfc4953>.
	[RFC4987] Eddy, W., "TCP SYN Flooding Attacks and Common		[RFC4987] Eddy, W., "TCP SYN Flooding Attacks and Common
	Mitigations", RFC 4987, DOI 10.17487/RFC4987, August 2007,		Mitigations", RFC 4987, DOI 10.17487/RFC4987, August 2007,
	<https://www.rfc-editor.org/info/rfc4987>.		<https://www.rfc-editor.org/info/rfc4987>.
	[RFC5077] Salowey, J., Zhou, H., Eronen, P., and H. Tschofenig,		[RFC5077] Salowey, J., Zhou, H., Eronen, P., and H. Tschofenig,
	"Transport Layer Security (TLS) Session Resumption without		"Transport Layer Security (TLS) Session Resumption without
	Server-Side State", RFC 5077, DOI 10.17487/RFC5077,		Server-Side State", RFC 5077, DOI 10.17487/RFC5077,
	January 2008, <https://www.rfc-editor.org/info/rfc5077>.		January 2008, <https://www.rfc-editor.org/info/rfc5077>.
			[RFC5452] Hubert, A. and R. van Mook, "Measures for Making DNS More
			Resilient against Forged Answers", RFC 5452,
			DOI 10.17487/RFC5452, January 2009,
			<https://www.rfc-editor.org/info/rfc5452>.
			[RFC5507] IAB, Faltstrom, P., Ed., Austein, R., Ed., and P. Koch,
			Ed., "Design Choices When Expanding the DNS", RFC 5507,
			DOI 10.17487/RFC5507, April 2009,
			<https://www.rfc-editor.org/info/rfc5507>.
			[RFC5625] Bellis, R., "DNS Proxy Implementation Guidelines",
			BCP 152, RFC 5625, DOI 10.17487/RFC5625, August 2009,
			<https://www.rfc-editor.org/info/rfc5625>.
	[RFC5927] Gont, F., "ICMP Attacks against TCP", RFC 5927,		[RFC5927] Gont, F., "ICMP Attacks against TCP", RFC 5927,
	DOI 10.17487/RFC5927, July 2010,		DOI 10.17487/RFC5927, July 2010,
	<https://www.rfc-editor.org/info/rfc5927>.		<https://www.rfc-editor.org/info/rfc5927>.
	[RFC5936] Lewis, E. and A. Hoenes, Ed., "DNS Zone Transfer Protocol		[RFC5936] Lewis, E. and A. Hoenes, Ed., "DNS Zone Transfer Protocol
	(AXFR)", RFC 5936, DOI 10.17487/RFC5936, June 2010,		(AXFR)", RFC 5936, DOI 10.17487/RFC5936, June 2010,
	<https://www.rfc-editor.org/info/rfc5936>.		<https://www.rfc-editor.org/info/rfc5936>.
	[RFC5961] Ramaiah, A., Stewart, R., and M. Dalal, "Improving TCP's		[RFC5961] Ramaiah, A., Stewart, R., and M. Dalal, "Improving TCP's
	Robustness to Blind In-Window Attacks", RFC 5961,		Robustness to Blind In-Window Attacks", RFC 5961,
	DOI 10.17487/RFC5961, August 2010,		DOI 10.17487/RFC5961, August 2010,
	<https://www.rfc-editor.org/info/rfc5961>.		<https://www.rfc-editor.org/info/rfc5961>.
			[RFC5966] Bellis, R., "DNS Transport over TCP - Implementation
			Requirements", RFC 5966, DOI 10.17487/RFC5966, August
			2010, <https://www.rfc-editor.org/info/rfc5966>.
	[RFC6304] Abley, J. and W. Maton, "AS112 Nameserver Operations",		[RFC6304] Abley, J. and W. Maton, "AS112 Nameserver Operations",
	RFC 6304, DOI 10.17487/RFC6304, July 2011,		RFC 6304, DOI 10.17487/RFC6304, July 2011,
	<https://www.rfc-editor.org/info/rfc6304>.		<https://www.rfc-editor.org/info/rfc6304>.
	[RFC6762] Cheshire, S. and M. Krochmal, "Multicast DNS", RFC 6762,		[RFC6762] Cheshire, S. and M. Krochmal, "Multicast DNS", RFC 6762,
	DOI 10.17487/RFC6762, February 2013,		DOI 10.17487/RFC6762, February 2013,
	<https://www.rfc-editor.org/info/rfc6762>.		<https://www.rfc-editor.org/info/rfc6762>.
	[RFC6891] Damas, J., Graff, M., and P. Vixie, "Extension Mechanisms		[RFC6891] Damas, J., Graff, M., and P. Vixie, "Extension Mechanisms
	for DNS (EDNS(0))", STD 75, RFC 6891,		for DNS (EDNS(0))", STD 75, RFC 6891,
	skipping to change at page 17, line 27 ¶		skipping to change at page 18, line 46 ¶
	October 2018, <https://www.rfc-editor.org/info/rfc8467>.		October 2018, <https://www.rfc-editor.org/info/rfc8467>.
	[RFC8483] Song, L., Ed., Liu, D., Vixie, P., Kato, A., and S. Kerr,		[RFC8483] Song, L., Ed., Liu, D., Vixie, P., Kato, A., and S. Kerr,
	"Yeti DNS Testbed", RFC 8483, DOI 10.17487/RFC8483,		"Yeti DNS Testbed", RFC 8483, DOI 10.17487/RFC8483,
	October 2018, <https://www.rfc-editor.org/info/rfc8483>.		October 2018, <https://www.rfc-editor.org/info/rfc8483>.
	[RFC8484] Hoffman, P. and P. McManus, "DNS Queries over HTTPS		[RFC8484] Hoffman, P. and P. McManus, "DNS Queries over HTTPS
	(DoH)", RFC 8484, DOI 10.17487/RFC8484, October 2018,		(DoH)", RFC 8484, DOI 10.17487/RFC8484, October 2018,
	<https://www.rfc-editor.org/info/rfc8484>.		<https://www.rfc-editor.org/info/rfc8484>.
			[RFC8490] Bellis, R., Cheshire, S., Dickinson, J., Dickinson, S.,
			Lemon, T., and T. Pusateri, "DNS Stateful Operations",
			RFC 8490, DOI 10.17487/RFC8490, March 2019,
			<https://www.rfc-editor.org/info/rfc8490>.
	[RRL] Vixie, P. and V. Schryver, "DNS Response Rate Limiting		[RRL] Vixie, P. and V. Schryver, "DNS Response Rate Limiting
	(DNS RRL)", ISC-TN 2012-1 Draft1, April 2012.		(DNS RRL)", ISC-TN 2012-1 Draft1, April 2012.
	[Stevens] Stevens, W., Fenner, B., and A. Rudoff, "UNIX Network		[Stevens] Stevens, W., Fenner, B., and A. Rudoff, "UNIX Network
	Programming Volume 1, Third Edition: The Sockets		Programming Volume 1, Third Edition: The Sockets
	Networking API", November 2003.		Networking API", November 2003.
	[TDNS] Zhu, L., Heidemann, J., Wessels, D., Mankin, A., and N.		[TDNS] Zhu, L., Heidemann, J., Wessels, D., Mankin, A., and N.
	Somaiya, "Connection-oriented DNS to Improve Privacy and		Somaiya, "Connection-oriented DNS to Improve Privacy and
	Security", 2015.		Security", 2015.
	skipping to change at page 18, line 13 ¶		skipping to change at page 19, line 34 ¶
	<https://en.wikipedia.org/wiki/TCP_Fast_Open>.		<https://en.wikipedia.org/wiki/TCP_Fast_Open>.
	Appendix A. Standards Related to DNS Transport over TCP		Appendix A. Standards Related to DNS Transport over TCP
	This section enumerates all known IETF RFC documents that are		This section enumerates all known IETF RFC documents that are
	currently of status standard, informational, best common practice or		currently of status standard, informational, best common practice or
	experimental and either implicitly or explicitly make assumptions or		experimental and either implicitly or explicitly make assumptions or
	statements about the use of TCP as a transport for the DNS germane to		statements about the use of TCP as a transport for the DNS germane to
	this document.		this document.
	A.1. TODO - additional, relevant RFCs		A.1. IETF RFC 1035 - DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION
	A.2. IETF RFC 5936 - DNS Zone Transfer Protocol (AXFR)		The internet standard [RFC1035] is the base DNS specification that
			explicitly defines support for DNS over TCP.
			A.2. IETF RFC 1536 - Common DNS Implementation Errors and Suggested
			Fixes
			The informational document [RFC1536] states UDP is the "chosen
			protocol for communication though TCP is used for zone transfers."
			That statement should now be considered in its historical context and
			is no longer a proper reflection of modern expectations.
			A.3. IETF RFC 1995 - Incremental Zone Transfer in DNS
			The [RFC1995] standards track document documents the use of TCP as
			the fallback transport when IXFR responses do not fit into a single
			UDP response. As with AXFR, IXFR messages are typically delivered
			over TCP by default in practice. XXX: is this an accurate statement?
			A.4. IETF RFC 1996 - A Mechanism for Prompt Notification of Zone
			Changes (DNS NOTIFY)
			The [RFC1996] standards track document suggests a zone master may
			decide to issue NOTIFY messages over TCP. In practice NOTIFY
			messages are generally sent over UDP, but this specification leaves
			open the possibility that the choice of transport protocol is up to
			the master, and therefore a slave ought to be able to operate over
			both UDP and TCP.
			A.5. IETF RFC 2181 - Clarifications to the DNS Specification
			The [RFC2181] standards track document includes clarifying text on
			how a client should react to the TC flag set on responses. It is
			advised the the response should be discarded and the query resent
			using TCP.
			A.6. IETF RFC 2694 - DNS extensions to Network Address Translators
			(DNS_ALG)
			The informational document [RFC2694] enumerates considerations for
			network address translation (NAT) middle boxes to properly handle DNS
			traffic. This document is noteworthy in its suggestion that DNS over
			TCP is "[t]ypically" used for zone transfer requests, further
			evidence that helps explain why DNS over TCP may often have been
			treated very differently than DNS over UDP in operational networks.
			A.7. IETF RFC 3225 - Indicating Resolver Support of DNSSEC
			The [RFC3225] standards track document makes statements indicating
			DNS over TCP is "detrimental" as a result of increased traffic,
			latency, and server load. This document is a companion to the next
			document in the RFC series expressing the requirement for EDNS0
			support for DNSSEC.
			A.8. IETF RFC 3326 - DNSSEC and IPv6 A6 aware server/resolver message
			size requirements
			The [RFC3226] standards track document, although updated by later
			DNSSEC strongly argued in favor of UDP messages over TCP largely for
			performance reasons. The document declares EDNS0 a requirement for
			DNSSEC servers and advocated packet fragmentation may be preferable
			to TCP in certain situations
			A.9. IETF RFC 4472 - Operational Considerations and Issues with IPv6
			DNS
			This informational document [RFC4472] notes that IPv6 data may
			increase DNS responses beyond what would fit in a UDP message.
			Particularly noteworthy, perhaps less common today then when this
			document was written, refers to implementations that truncate data
			without setting the TC bit to encourge the client to resend the query
			using TCP.
			A.10. IETF RFC 5452 - Measures for Making DNS More Resilient against
			Forged Answers
			This informational document [RFC5452] arose as public DNS systems
			began to experience widespread abuse from spoofed queries, resulting
			in amplification and reflection attacks against unwitting victims.
			One of the leading justifications for supporting DNS over TCP to
			thwart these attacks is briefly described in this document's 9.3
			Spoof Detection and Countermeasure section.
			A.11. IETF RFC 5507 - Design Choices When Expanding the DNS
			This informational document [RFC5507] was largely an attempt to
			dissuade new DNS data types from overloading the TXT resource record
			type. In so doing it summarizes the conventional wisdom of DNS
			design and implementation practices. The authors suggest TCP
			overhead and stateful properties pose challenges compared to UDP, and
			imply that UDP is generally preferred for performance and robustness.
			A.12. IETF RFC 5625 - DNS Proxy Implementation Guidelines
			This best current practice document [RFC5625] provides DNS proxy
			implementation guidance including the mandate that a proxy "MUST
			[...] be prepared to receive and forward queries over TCP" even
			though it suggests historically TCP transport has not been strictly
			mandatory in stub resolvers or recursive servers.
			A.13. IETF RFC 5936 - DNS Zone Transfer Protocol (AXFR)
	The [RFC5936] standards track document provides a detailed		The [RFC5936] standards track document provides a detailed
	specification for the zone transfer protocol, as originally outlined		specification for the zone transfer protocol, as originally outlined
	in the early DNS standards. AXFR operation is limited to TCP and not		in the early DNS standards. AXFR operation is limited to TCP and not
	specified for UDP. This document discusses TCP usage at length.		specified for UDP. This document discusses TCP usage at length.
	A.3. IETF RFC 6304 - AS112 Nameserver Operations		A.14. IETF RFC 5966 - DNS Transport over TCP - Implementation
			Requirements
			This standards track document [RFC5966] instructs DNS implementers to
			provide support for carrying DNS over TCP messages in their software.
			The authors explicitly make no recommendations to operators, which we
			seek to address here.
			A.15. IETF RFC 6304 - AS112 Nameserver Operations
	[RFC6304] is an informational document enumerating the requirements		[RFC6304] is an informational document enumerating the requirements
	for operation of AS112 project DNS servers. New AS112 nodes are		for operation of AS112 project DNS servers. New AS112 nodes are
	tested for their ability to provide service on both UDP and TCP		tested for their ability to provide service on both UDP and TCP
	transports, with the implication that TCP service is an expected part		transports, with the implication that TCP service is an expected part
	of normal operations.		of normal operations.
	A.4. IETF RFC 6762 - Multicast DNS		A.16. IETF RFC 6762 - Multicast DNS
	This standards track document [RFC6762] the TC bit is deemed to have		In this standards track document [RFC6762] the TC bit is deemed to
	essentially the same meaning as described in the original DNS		have essentially the same meaning as described in the original DNS
	specifications. That is, if a response with the TCP bit set is		specifications. That is, if a response with the TCP bit set is
	receiver "[...] the querier SHOULD reissue its query using TCP in		receiver "[...] the querier SHOULD reissue its query using TCP in
	order to receive the larger response."		order to receive the larger response."
	A.5. IETF RFC 6950 - Architectural Considerations on Application		A.17. IETF RFC 6891 - Extension Mechanisms for DNS (EDNS(0))
	Features in the DNS
			This standards track document [RFC6891] helped slow the use and need
			for DNS over TCP messages. This document highlights concerns over
			server load and scalability in widespread use of DNS over TCP.
			A.18. IETF RFC 6950 - Architectural Considerations on Application
			Features in the DNS
	An informational document [RFC6950] that draws attention to large		An informational document [RFC6950] that draws attention to large
	data in the DNS. TCP is referenced in the context as a common		data in the DNS. TCP is referenced in the context as a common
	fallback mechnanism and counter to some spoofing attacks.		fallback mechnanism and counter to some spoofing attacks.
	A.6. IETF RFC 7477 - Child-to-Parent Synchronization in DNS		A.19. IETF RFC 7477 - Child-to-Parent Synchronization in DNS
	This standards track document [RFC7477] specifies a RRType and		This standards track document [RFC7477] specifies a RRType and
	protocol to signal and synchronize NS, A, and AAAA resource record		protocol to signal and synchronize NS, A, and AAAA resource record
	changes from a child to parent zone. Since this protocol may require		changes from a child to parent zone. Since this protocol may require
	multiple requests and responses, it recommends utilizing DNS over TCP		multiple requests and responses, it recommends utilizing DNS over TCP
	to ensure the conversation takes place between a consistent pair of		to ensure the conversation takes place between a consistent pair of
	end nodes.		end nodes.
	A.7. IETF RFC 7720 - DNS Root Name Service Protocol and Deployment		A.20. IETF RFC 7720 - DNS Root Name Service Protocol and Deployment
	Requirements		Requirements
	This best current practice[RFC7720] declares root name service "MUST		This best current practice[RFC7720] declares root name service "MUST
	support UDP [RFC768] and TCP [RFC793] transport of DNS queries and		support UDP [RFC768] and TCP [RFC793] transport of DNS queries and
	responses."		responses."
	A.8. IETF RFC 7766 - DNS Transport over TCP - Implementation		A.21. IETF RFC 7766 - DNS Transport over TCP - Implementation
	Requirements		Requirements
	The standards track document [RFC7766] might be considered the direct		The standards track document [RFC7766] might be considered the direct
	ancestor of this operational requirements document. The		ancestor of this operational requirements document. The
	implementation requirements document codifies mandatory support for		implementation requirements document codifies mandatory support for
	DNS over TCP in compliant DNS software.		DNS over TCP in compliant DNS software.
	A.9. IETF RFC 7828 - The edns-tcp-keepalive EDNS0 Option		A.22. IETF RFC 7828 - The edns-tcp-keepalive EDNS0 Option
	This standards track document [RFC7828] defines an EDNS0 option to		This standards track document [RFC7828] defines an EDNS0 option to
	negotiate an idle timeout value for long-lived DNS over TCP		negotiate an idle timeout value for long-lived DNS over TCP
	connections. Consequently, this document is only applicable and		connections. Consequently, this document is only applicable and
	relevant to DNS over TCP sessions and between implementations that		relevant to DNS over TCP sessions and between implementations that
	support this option.		support this option.
	A.10. IETF RFC 7858 - Specification for DNS over Transport Layer		A.23. IETF RFC 7858 - Specification for DNS over Transport Layer
	Security (TLS)		Security (TLS)
	This standards track document [RFC7858] defines a method for putting		This standards track document [RFC7858] defines a method for putting
	DNS messages into a TCP-based encrypted channel using TLS. This		DNS messages into a TCP-based encrypted channel using TLS. This
	specification is noteworthy for explicitly targetting the stub-to-		specification is noteworthy for explicitly targetting the stub-to-
	recursive traffic, but does not preclude its application from		recursive traffic, but does not preclude its application from
	recursive-to-authoritative traffic.		recursive-to-authoritative traffic.
	A.11. IETF RFC 7873 - Domain Name System (DNS) Cookies		A.24. IETF RFC 7873 - Domain Name System (DNS) Cookies
	This standards track document [RFC7873] describes an EDNS0 option to		This standards track document [RFC7873] describes an EDNS0 option to
	provide additional protection against query and answer forgery. This		provide additional protection against query and answer forgery. This
	specification mentions DNS over TCP as a reasonable fallback		specification mentions DNS over TCP as a reasonable fallback
	mechanism when DNS Cookies are not available. The specification does		mechanism when DNS Cookies are not available. The specification does
	make mention of DNS over TCP processing in two specific situations.		make mention of DNS over TCP processing in two specific situations.
	In one, when a server receives only a client cookie in a request, the		In one, when a server receives only a client cookie in a request, the
	server should consider whether the request arrived over TCP and if		server should consider whether the request arrived over TCP and if
	so, it should consider accepting TCP as sufficient to authenticate		so, it should consider accepting TCP as sufficient to authenticate
	the request and respond accordingly. In another, when a client		the request and respond accordingly. In another, when a client
	receives a BADCOOKIE reply using a fresh server cookie, the client		receives a BADCOOKIE reply using a fresh server cookie, the client
	should retry using TCP as the transport.		should retry using TCP as the transport.
	A.12. IETF RFC 7901 - CHAIN Query Requests in DNS		A.25. IETF RFC 7901 - CHAIN Query Requests in DNS
	This experimental specification [RFC7901] describes an EDNS0 option		This experimental specification [RFC7901] describes an EDNS0 option
	that can be used by a security-aware validating resolver to request		that can be used by a security-aware validating resolver to request
	and obtain a complete DNSSEC validation path for any single query.		and obtain a complete DNSSEC validation path for any single query.
	This document requires the use of DNS over TCP or a source IP address		This document requires the use of DNS over TCP or a source IP address
	verified transport mechanism such as EDNS-COOKIE.[RFC7873]		verified transport mechanism such as EDNS-COOKIE.[RFC7873]
	A.13. IETF RFC 8027 - DNSSEC Roadblock Avoidance		A.26. IETF RFC 8027 - DNSSEC Roadblock Avoidance
	This document [RFC8027] details observed problems with DNSSEC		This document [RFC8027] details observed problems with DNSSEC
	deployment and mitigation techniques. Network traffic blocking and		deployment and mitigation techniques. Network traffic blocking and
	restrictions, including DNS over TCP messages, are highlighted as one		restrictions, including DNS over TCP messages, are highlighted as one
	reason for DNSSEC deployment issues. While this document suggests		reason for DNSSEC deployment issues. While this document suggests
	these sorts of problems are due to "non-compliant infrastructure" and		these sorts of problems are due to "non-compliant infrastructure" and
	is of type BCP, the scope of the document is limited to detection and		is of type BCP, the scope of the document is limited to detection and
	mitigation techniques to avoid so-called DNSSEC roadblocks.		mitigation techniques to avoid so-called DNSSEC roadblocks.
	A.14. IETF RFC 8094 - DNS over Datagram Transport Layer Security (DTLS)		A.27. IETF RFC 8094 - DNS over Datagram Transport Layer Security (DTLS)
	This experimental specification [RFC8094] details a protocol that		This experimental specification [RFC8094] details a protocol that
	uses a datagram transport (UDP), but stipulates that "DNS clients and		uses a datagram transport (UDP), but stipulates that "DNS clients and
	servers that implement DNS over DTLS MUST also implement DNS over TLS		servers that implement DNS over DTLS MUST also implement DNS over TLS
	in order to provide privacy for clients that desire Strict Privacy		in order to provide privacy for clients that desire Strict Privacy
	[...]". This requirement implies DNS over TCP must be supported in		[...]". This requirement implies DNS over TCP must be supported in
	case the message size is larger than the path MTU.		case the message size is larger than the path MTU.
	A.15. IETF RFC 8162 - Using Secure DNS to Associate Certificates with		A.28. IETF RFC 8162 - Using Secure DNS to Associate Certificates with
	Domain Names for S/MIME		Domain Names for S/MIME
	This experimental specification [RFC8162] describes a technique to		This experimental specification [RFC8162] describes a technique to
	authenticate user X.509 certificates in an S/MIME system via the DNS.		authenticate user X.509 certificates in an S/MIME system via the DNS.
	The document points out that the new experimental resource record		The document points out that the new experimental resource record
	types are expected to carry large payloads, resulting in the		types are expected to carry large payloads, resulting in the
	suggestion that "applications SHOULD use TCP -- not UDP -- to perform		suggestion that "applications SHOULD use TCP -- not UDP -- to perform
	queries for the SMIMEA resource record."		queries for the SMIMEA resource record."
	A.16. IETF RFC 8324 - DNS Privacy, Authorization, Special Uses,		A.29. IETF RFC 8324 - DNS Privacy, Authorization, Special Uses,
	Encoding, Characters, Matching, and Root Structure: Time for		Encoding, Characters, Matching, and Root Structure: Time for
	Another Look?		Another Look?
	An informational document [RFC8324] that briefly discusses the common		An informational document [RFC8324] that briefly discusses the common
	role and challenges of DNS over TCP throughout the history of DNS.		role and challenges of DNS over TCP throughout the history of DNS.
	A.17. IETF RFC 8467 - Padding Policies for Extension Mechanisms for DNS		A.30. IETF RFC 8467 - Padding Policies for Extension Mechanisms for DNS
	(EDNS(0))		(EDNS(0))
	An experimental document [RFC8467] reminds implementers to consider		An experimental document [RFC8467] reminds implementers to consider
	the underlying transport protocol (e.g. TCP) when calculating the		the underlying transport protocol (e.g. TCP) when calculating the
	padding length when artificially increasing the DNS message size with		padding length when artificially increasing the DNS message size with
	an EDNS(0) padding option.		an EDNS(0) padding option.
	A.18. IETF RFC 8483 - Yeti DNS Testbed		A.31. IETF RFC 8483 - Yeti DNS Testbed
	This informational document [RFC8483] describes a testbed environment		This informational document [RFC8483] describes a testbed environment
	that highlights some DNS over TCP behaviors, including issues		that highlights some DNS over TCP behaviors, including issues
	involving packet fragmentation and operational requirements for TCP		involving packet fragmentation and operational requirements for TCP
	stream assembly in order to conduct DNS measurement and analysis.		stream assembly in order to conduct DNS measurement and analysis.
	A.19. IETF RFC 8484 - DNS Queries over HTTPS (DoH)		A.32. IETF RFC 8484 - DNS Queries over HTTPS (DoH)
	This standards track document [RFC8484] defines a protocol for		This standards track document [RFC8484] defines a protocol for
	sending DNS queries and responses over HTTPS. This specification		sending DNS queries and responses over HTTPS. This specification
	assumes TLS and TCP for the underlying security and transport layers		assumes TLS and TCP for the underlying security and transport layers
	respectively. Self-described as a a technique that more closely		respectively. Self-described as a a technique that more closely
	resembles a tunneling mechanism, DoH nevertheless likely implies DNS		resembles a tunneling mechanism, DoH nevertheless likely implies DNS
	over TCP in some sense if not directly.		over TCP in some sense if not directly.
			A.33. IETF RFC 8490 - DNS Stateful Operations
			This standards track document [RFC8490] updates the base protocol
			specification with a new OPCODE to help manage stateful operations in
			persistent sessions such as those that might be used by DNS over TCP.
	Authors' Addresses		Authors' Addresses
	John Kristoff		John Kristoff
	DePaul University		DePaul University
	Chicago, IL 60604		Chicago, IL 60604
	US		US
	Phone: +1 312 493 0305		Phone: +1 312 493 0305
	Email: jtk@depaul.edu		Email: jtk@depaul.edu
	URI: https://aharp.iorc.depaul.edu		URI: https://aharp.iorc.depaul.edu
End of changes. 63 change blocks.
	149 lines changed or deleted		349 lines changed or added
This html diff was produced by rfcdiff 1.47. The latest version is available from http://tools.ietf.org/tools/rfcdiff/