11. 参考文献

本节列出 RFC 7766 的规范性和资料性引用. 规范性引用覆盖 UDP、TCP、DNS 基础规范、主机要求、DNSSEC、Anycast、EDNS(0)、HTTP 传输以及 DNS over TCP 的早期实现要求. 资料性引用提供 DNS 隐私、安全、响应速率限制、分片风险、TCP Fast Open 和多路径 TCP 等部署背景. 书目条目中的英文标题、作者、DOI 和 URL 保持原文, 以便准确引用.

11.1. 规范性引用

这些文献定义 DNS over TCP 实现必须遵循的基础协议语义和安全要求. 实现者应结合 TCP 连接管理、DNS 消息格式、EDNS(0) 扩展、递归服务器防滥用以及 DNSSEC 行为理解本文要求.

• [RFC768] Postel, J., "User Datagram Protocol", STD 6, RFC 768, DOI 10.17487/RFC0768, August 1980, http://www.rfc-editor.org/info/rfc768.

• [RFC793] Postel, J., "Transmission Control Protocol", STD 7, RFC 793, DOI 10.17487/RFC0793, September 1981, http://www.rfc-editor.org/info/rfc793.

• [RFC1034] Mockapetris, P., "Domain names - concepts and facilities", STD 13, RFC 1034, DOI 10.17487/RFC1034, November 1987, http://www.rfc-editor.org/info/rfc1034.

• [RFC1035] Mockapetris, P., "Domain names - implementation and specification", STD 13, RFC 1035, DOI 10.17487/RFC1035, November 1987, http://www.rfc-editor.org/info/rfc1035.

• [RFC1123] Braden, R., Ed., "Requirements for Internet Hosts - Application and Support", STD 3, RFC 1123, DOI 10.17487/RFC1123, October 1989, http://www.rfc-editor.org/info/rfc1123.

• [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, http://www.rfc-editor.org/info/rfc2119.

• [RFC4033] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, "DNS Security Introduction and Requirements", RFC 4033, DOI 10.17487/RFC4033, March 2005, http://www.rfc-editor.org/info/rfc4033.

• [RFC4786] Abley, J. and K. Lindqvist, "Operation of Anycast Services", BCP 126, RFC 4786, DOI 10.17487/RFC4786, December 2006, http://www.rfc-editor.org/info/rfc4786.

• [RFC5155] Laurie, B., Sisson, G., Arends, R., and D. Blacka, "DNS Security (DNSSEC) Hashed Authenticated Denial of Existence", RFC 5155, DOI 10.17487/RFC5155, March 2008, http://www.rfc-editor.org/info/rfc5155.

• [RFC5358] Damas, J. and F. Neves, "Preventing Use of Recursive Nameservers in Reflector Attacks", BCP 140, RFC 5358, DOI 10.17487/RFC5358, October 2008, http://www.rfc-editor.org/info/rfc5358.

• [RFC5625] Bellis, R., "DNS Proxy Implementation Guidelines", BCP 152, RFC 5625, DOI 10.17487/RFC5625, August 2009, http://www.rfc-editor.org/info/rfc5625.

• [RFC5966] Bellis, R., "DNS Transport over TCP - Implementation Requirements", RFC 5966, DOI 10.17487/RFC5966, August 2010, http://www.rfc-editor.org/info/rfc5966.

• [RFC6891] Damas, J., Graff, M., and P. Vixie, "Extension Mechanisms for DNS (EDNS(0))", STD 75, RFC 6891, DOI 10.17487/RFC6891, April 2013, http://www.rfc-editor.org/info/rfc6891.

• [RFC7230] Fielding, R., Ed. and J. Reschke, Ed., "Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing", RFC 7230, DOI 10.17487/RFC7230, June 2014, http://www.rfc-editor.org/info/rfc7230.

• [RFC7540] Belshe, M., Peon, R., and M. Thomson, Ed., "Hypertext Transfer Protocol Version 2 (HTTP/2)", RFC 7540, DOI 10.17487/RFC7540, May 2015, http://www.rfc-editor.org/info/rfc7540.

11.2. 资料性引用

这些文献为 DNS over TCP 的部署选择提供背景, 包括连接型 DNS 对隐私和安全的影响、TCP 安全评估、DNS over TLS、EDNS TCP keepalive、IP 分片风险和响应速率限制等主题.

RFC 7766 的重点是让 DNS over TCP 成为可实际部署的传输选择, 因此引用覆盖了从基础 DNS 消息格式到 TCP 连接管理、从 DNSSEC 到反射攻击防护的完整链路. 读者在实现时应特别注意 TCP 连接保持、响应大小、分片避免、递归服务器滥用、DNS 代理行为和 EDNS(0) 扩展之间的相互影响.

资料性文献还说明了为什么仅依赖 UDP 会带来隐私、安全和可靠性限制. 连接型 DNS、DNS over TLS、TCP Fast Open 和 EDNS TCP keepalive 等工作展示了不同部署在延迟、状态维护、抗滥用和隐私保护之间的权衡.

这些引用共同说明, DNS over TCP 不是单纯的传输替换, 而是涉及服务器资源管理、客户端重试策略、中间设备行为和安全策略的整体部署问题.

对实现者而言, 规范性引用应优先用于检查协议兼容性: DNS 消息仍必须符合 RFC 1034 和 RFC 1035, TCP 行为必须符合主机要求和传输规范, EDNS(0) 与 DNSSEC 相关处理不能因使用 TCP 而改变语义. 资料性引用则更适合作为部署评估材料, 用于判断是否需要连接复用、速率限制、TLS 保护、分片规避或额外的防反射策略.

• [Connection-Oriented-DNS] Zhu, L., Hu, Z., Heidemann, J., Wessels, D., Mankin, A., and N. Somaiya, "Connection-Oriented DNS to Improve Privacy and Security", 2015 IEEE Symposium on Security and Privacy (SP), DOI 10.1109/SP.2015.18, http://ieeexplore.ieee.org/xpl/articleDetails.jsp?arnumber=7163025.

• [CPNI-TCP] CPNI, "Security Assessment of the Transmission Control Protocol (TCP)", 2009, http://www.gont.com.ar/papers/tn-03-09-security-assessment-TCP.pdf.

• [DNS-over-TLS] Hu, Z., Zhu, L., Heidemann, J., Mankin, A., Wessels, D., and P. Hoffman, "Specification for DNS over TLS", 进行中的工作 (Work in Progress), draft-ietf-dprive-dns-over-tls-06, February 2016.

• [edns-tcp-keepalive] Wouters, P., Abley, J., Dickinson, S., and R. Bellis, "The edns-tcp-keepalive EDNS0 Option", 进行中的工作 (Work in Progress), draft-ietf-dnsop-edns-tcp-keepalive-03, September 2015.

• [fragmentation-considered-poisonous] Herzberg, A. and H. Shulman, "Fragmentation Considered Poisonous", May 2012, http://arxiv.org/abs/1205.4011.

• [RFC5405] Eggert, L. and G. Fairhurst, "Unicast UDP Usage Guidelines for Application Designers", BCP 145, RFC 5405, DOI 10.17487/RFC5405, November 2008, http://www.rfc-editor.org/info/rfc5405.

• [RFC6824] Ford, A., Raiciu, C., Handley, M., and O. Bonaventure, "TCP Extensions for Multipath Operation with Multiple Addresses", RFC 6824, DOI 10.17487/RFC6824, January 2013, http://www.rfc-editor.org/info/rfc6824.

• [RFC7413] Cheng, Y., Chu, J., Radhakrishnan, S., and A. Jain, "TCP Fast Open", RFC 7413, DOI 10.17487/RFC7413, December 2014, http://www.rfc-editor.org/info/rfc7413.

• [RRL1] Vixie, P. and V. Schryver, "DNS Response Rate Limiting (DNS RRL)", ISC-TN 2012-1-Draft1, April 2012, https://ftp.isc.org/isc/pubs/tn/isc-tn-2012-1.txt.

• [RRL2] ISC Support, "Using the Response Rate Limiting Feature in BIND 9.10", ISC Knowledge Base AA-00994, June 2013, https://kb.isc.org/article/AA-00994/.