Subject: I-D Action: draft-dickson-dprive-adot-auth-03.txt

From: [email-masked]
Date: Sun, 19 Sep 2021 15:04:28 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.

        Title           : Authenticated DNS over TLS to Authoritative Servers
        Author          : Brian Dickson
	Filename        : draft-dickson-dprive-adot-auth-03.txt
	Pages           : 17
	Date            : 2021-09-19

Abstract:
   This Internet Draft proposes a mechanism for DNS resolvers to
   discover support for TLS transport to authoritative DNS servers, to
   validate this indication of support, and to authenticate the TLS
   certificates involved.

   This requires that the name server _names_ are in a DNSSEC signed
   zone.

   This also requires that the delegation of the zone served is
   protected by [I-D.dickson-dnsop-ds-hack], since the NS names are the
   keys used for discovery of TLS transport support.

   Additional recommendations relate to use of various techniques for
   efficiency and scalability, and new EDNS options to minimize round
   trips and for signaling between clients and resolvers.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-dickson-dprive-adot-auth/

There is also an HTML version available at:
https://www.ietf.org/archive/id/draft-dickson-dprive-adot-auth-03.html

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-dickson-dprive-adot-auth-03

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/