3.7 KiB
Standards and authoritative sources
Verified on 2026-08-13. Protocol behavior must be based on the published standard, not on summaries or provider-specific JSON APIs.
| Capability | Authority | Project scope |
|---|---|---|
| Agent Skills package | Agent Skills specification | Required package format |
| OMP discovery | OMP Skills documentation | Supported host |
| DoH | RFC 8484 | Implemented over HTTP/1.1 and HTTP/2 |
| DoH3 | RFC 8484 over RFC 9114 | Implemented |
| DoT | RFC 7858 | Implemented |
| DoT authentication profiles | RFC 8310 | Strict privacy only |
| DoT ALPN identifier | IANA TLS ALPN registry | Advertise dot; reject a different selection; permit and report no selection |
| DoQ | RFC 9250 | Implemented for single-response queries |
| ODoH | RFC 9230 | Research until a maintained implementation is selected |
| DNS privacy operations | RFC 8932 | Security and privacy guidance |
| EDNS(0) padding | RFC 7830 and RFC 8467 | Evaluate per transport |
| DNSCrypt | DNSCrypt protocol specification | DNSCrypt v2 implemented over UDP; non-IETF |
| Anonymized DNSCrypt | Anonymized DNSCrypt specification | Research |
| Go DNS wire and IDNA support | Go x/net module | Pinned to v0.58.0; use dnsmessage and idna |
| Go QUIC and HTTP/3 support | quic-go documentation | Pinned to v0.61.0 |
| Go DNSCrypt support | ameshkov/dnscrypt | Pinned to v2.4.0; stamp, certificate, and protocol implementation |
Deliberate exclusions
- DNS-over-DTLS (RFC 8094) is experimental and is not a target transport.
- DNS zone transfer over TLS (RFC 9103) is outside the client-to-recursive diagnostic scope.
- Recursive-to-authoritative encryption and resolver/server operation are outside the initial scope.
Terminology
DoH3 means RFC 8484 semantics carried over HTTP/3. It is not a separate DNS message format. DNSCrypt is an encrypted DNS protocol with its own specification; do not label it as an IETF RFC.
For DoH, accept and send application/dns-message. Keep HTTP status separate
from the DNS RCODE: a valid NXDOMAIN or SERVFAIL response still uses HTTP 2xx.
For DoT, use the strict privacy profile and verify both the PKIX chain and the
configured authentication domain name.
For DoQ, use ALPN doq, UDP port 853, a separate client-initiated bidirectional
stream per query, the two-octet DNS-over-TCP length field, STREAM FIN, and DNS
Message ID 0. DoH3 retains RFC 8484 message and HTTP semantics and requires
HTTP/3 with ALPN h3.
For DNSCrypt v2, parse only DNSCrypt stamps, fetch the provider TXT certificate, validate its Ed25519 signature and validity interval against the stamp key, and authenticate encrypted responses. The stamp-supplied provider name and IP endpoint are part of the authenticated resolver identity.