- Be aware that a client will think it is talking to a DNS-over-TLS server and so may keep connections open when idle even when not using EDNS0 Keepalive (as allowed by RFC7858 ). The nameserver will see only TCP connections which were historically used just for one-shot TCP and may not be robust to many long-lived connections.
- Therefore this will work much better if the nameserver has robust TCP capabilities (as described in Sections 6.2.2 and 10 of RFC7766), and would be required for production level service. Any server that fully implements EDNS0 Keepalive (RFC7828) should meet this criteria.
See the DNS -over-TLS Privacy reference material page for more details on the individual features.
|TCP fast open**|| || || || |
Process Pipelined queries
|EDNS0 Keepalive***||WIP|| || || || || |
|TLS encryption (Port 853)||(d)|| || || || |
|Provide TLS auth credentials||(d)|| || || || |
|EDNS0 Padding|| || ||WIP|| || || |