2.5 KiB
2.5 KiB
Standards and authoritative sources
Verified on 2026-08-13. Protocol behavior must be based on the published standard, not on summaries or provider-specific JSON APIs.
| Capability | Authority | Project scope |
|---|---|---|
| Agent Skills package | Agent Skills specification | Required package format |
| OMP discovery | OMP Skills documentation | Supported host |
| DoH | RFC 8484 | Planned |
| DoT | RFC 7858 | Planned |
| DoT authentication profiles | RFC 8310 | Strict privacy only |
| DoQ | RFC 9250 | Planned |
| ODoH | RFC 9230 | Research until a maintained implementation is selected |
| DNS privacy operations | RFC 8932 | Security and privacy guidance |
| EDNS(0) padding | RFC 7830 and RFC 8467 | Evaluate per transport |
| DNSCrypt | DNSCrypt protocol specification | Planned, non-IETF |
| Anonymized DNSCrypt | Anonymized DNSCrypt specification | Research |
| Go DNS wire and IDNA support | Go x/net module | Pinned to v0.58.0; use dnsmessage and idna |
Deliberate exclusions
- DNS-over-DTLS (RFC 8094) is experimental and is not a target transport.
- DNS zone transfer over TLS (RFC 9103) is outside the client-to-recursive diagnostic scope.
- Recursive-to-authoritative encryption and resolver/server operation are outside the initial scope.
Terminology
DoH3 means RFC 8484 semantics carried over HTTP/3. It is not a separate DNS message format. DNSCrypt is an encrypted DNS protocol with its own specification; do not label it as an IETF RFC.
For DoH, accept and send application/dns-message. Keep HTTP status separate
from the DNS RCODE: a valid NXDOMAIN or SERVFAIL response still uses HTTP 2xx.
For DoT, use the strict privacy profile and verify both the PKIX chain and the
configured authentication domain name.