RFC 7671: The DNS-Based Authentication of Named Entities (DANE) Protocol: Updates and Operational Guidance

This document clarifies and updates the DNS-Based Authentication of Named Entities (DANE) TLSA specification (RFC 6698), based on subsequent implementation…

Read RFC 7671 on the RFC Editor

Outgoing relationships (18 related RFCs)

Updates, Normative reference — RFC 6698: The DNS-Based Authentication of Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA
Normative reference — RFC 2119: Key words for use in RFCs to Indicate Requirement Levels
Normative reference — RFC 5246: The Transport Layer Security (TLS) Protocol Version 1.2
Normative reference — RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
Normative reference — RFC 4033: DNS Security Introduction and Requirements
Normative reference — RFC 6347: Datagram Transport Layer Security Version 1.2
Normative reference — RFC 4034: Resource Records for the DNS Security Extensions
Normative reference — RFC 4035: Protocol Modifications for the DNS Security Extensions
Normative reference — RFC 6125: Representation and Verification of Domain-Based Application Service Identity within Internet Public Key Infrastructure Using X.509 (PKIX) Certificates in the Context of Transport Layer Security (TLS)
Normative reference — RFC 6066: Transport Layer Security (TLS) Extensions: Extension Definitions
Normative reference — RFC 7250: Using Raw Public Keys in Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)
Normative reference — RFC 7218: Adding Acronyms to Simplify Conversations about DNS-Based Authentication of Named Entities (DANE)
Informative reference — RFC 1035: Domain names - implementation and specification
Informative reference — RFC 7435: Opportunistic Security: Some Protection Most of the Time
Informative reference — RFC 6781: DNSSEC Operational Practices, Version 2
Informative reference — RFC 6962: Certificate Transparency
Informative reference — RFC 7672: SMTP Security via Opportunistic DNS-Based Authentication of Named Entities (DANE) Transport Layer Security (TLS)
Informative reference — RFC 7673: Using DNS-Based Authentication of Named Entities (DANE) TLSA Records with SRV Records

Incoming relationships (4 related RFCs)

Normatively referenced by — RFC 8460: SMTP TLS Reporting
Normatively referenced by — RFC 8162: Using Secure DNS to Associate Certificates with Domain Names for S/MIME
Normatively referenced by — RFC 9102: TLS DNSSEC Chain Extension
Informatively referenced by — RFC 9464: Internet Key Exchange Protocol Version 2 (IKEv2) Configuration for Encrypted DNS