Search RFCs

RFC Editor

File formats:

Status:

PROPOSED STANDARD

Updated by:

RFC 9018

Authors:

D. Eastlake 3rd
M. Andrews

Stream:

IETF

Source:

dnsop (ops)

Cite this RFC:TXT  | XML  |  BibTeX

DOI:  https://doi.org/10.17487/RFC7873

Discuss this RFC: Send questions or comments to the mailing listdnsop@ietf.org

Other actions:Submit Errata  | Find IPR Disclosures from the IETF  | View History of RFC 7873

Abstract

DNS Cookies are a lightweight DNS transaction security mechanism thatprovides limited protection to DNS servers and clients against avariety of increasingly common denial-of-service and amplification/forgery or cache poisoning attacks by off-path attackers. DNSCookies are tolerant of NAT, NAT-PT (Network Address Translation -Protocol Translation), and anycast and can be incrementally deployed.(Since DNS Cookies are only returned to the IP address from whichthey were originally received, they cannot be used to generally trackInternet users.)

For the definition ofStatus,seeRFC 2026.

For the definition ofStream, seeRFC 8729.