Skip to content

Resolve #2794, #2884: make "dot" ALPN token negotiation to be required for XoT

Artem Boldariev requested to merge 2794-dot-alpn-for-xfrs into main

This merge request adds support for Application-Layer Protocol Negotiation to DoT as required by XoT (RFC9103). It is implemented so that it is done on a best-effort basis and does not change the existing behaviour for any requests, except zone transfers, where the ALPN status is explicitly checked. It contrasts to DoH, where it is required to make it work.

Implementing it in such a way is required because plenty of DoT deployments do not take ALPN into account whatsoever, including the well-known publicly accessible DNS servers.

The change is made as follows: the client-side code in both DIG and BIND now advertise the dot ALPN tag when connecting to a DoT server. The server-side code in BIND selects the dot ALPN if announced. Both client-side code and server-side code check the status of the negotiation only when attempting zone transfers.

Closes #2794 (closed) #2884 (closed)

Edited by Artem Boldariev

Merge request reports