0

I just learned about DNS-over-TLS from IETF. I need clarification in some points to get the whole picture.

Assume there is a client want to connect to a TLS server and use DNS-over-TLS as well. The client will establish a TLS session with the DNS server to get the IP of the domain name.

What is not clear to me is what is next? does the client close this DNS TLS session and open a new TLS session with the HTTP server (e.g. web server like google.com). Or does it use the DNS TLS session to connect to HTTP server?

Can you clarify this point to me with references if possible?

Improve this question

1 Answer 1

Reset to default
4

DNS over TLS is just a replacement for DNS over UDP. It is just to get the IP address of the final target. In other words: there is one TLS connection with the DNS server to get the IP address of the hostname from the URL and then there is another TLS connection to the IP address of the hostname - which is very likely different to the IP address of the DNS server. If the first TLS connection (to the DNS server) is kept open for further DNS requests does not matter in the context of your question but should be done for efficiency.

Improve this answer
2
  • Section 3.4 of the RFC discusses the connection management. Specifically: "In order to amortize TCP and TLS connection setup costs, clients and servers SHOULD NOT immediately close a connection after each response. Instead, clients and servers SHOULD reuse existing connections for subsequent queries as long as they have sufficient resources. In some cases, this means that clients and servers may need to keep idle connections open for some amount of time."
    – Patrick Mevzek
    Feb 20, 2018 at 14:59
  • @PatrickMevzek: you are right. I've made my statement more clear in that it does not matter in the context of this question (but should be done for efficiency). The main problem of the OP was if the TLS connection to the DNS server should be kept open to connect to the HTTP server which obviously cannot be done since these are different servers.
    – Steffen Ullrich
    Feb 20, 2018 at 15:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.