<?xml version='1.0' encoding='utf-8'?>
<rfc xmlns:xi="http://www.w3.org/2001/XInclude" version="3" category="std" submissionType="IETF" docName="draft-ietf-dnssd-srp-latest" number="9665" ipr="trust200902" obsoletes="" updates="" sortRefs="true" consensus="true" symRefs="true" tocDepth="4" tocInclude="true" xml:lang="en" prepTime="2025-06-11T16:13:45" indexInclude="true" scripts="Common,Latin">
  <link href="https://datatracker.ietf.org/doc/draft-ietf-dnssd-srp-latest" rel="prev"/>
  <link href="https://dx.doi.org/10.17487/rfc9665" rel="alternate"/>
  <link href="urn:issn:2070-1721" rel="alternate"/>
  <front>
    <title abbrev="Service Registration Protocol">Service Registration Protocol for DNS-Based Service Discovery</title>
    <seriesInfo name="RFC" value="9665" stream="IETF"/>
    <author initials="T." surname="Lemon" fullname="Ted Lemon">
      <organization showOnFrontPage="true">Apple Inc.</organization>
      <address>
        <postal>
          <street>One Apple Park Way</street>
          <city>Cupertino</city>
          <region>CA</region>
          <code>95014</code>
          <country>United States of America</country>
        </postal>
        <email>mellon@fugue.com</email>
      </address>
    </author>
    <author initials="S." surname="Cheshire" fullname="Stuart Cheshire">
      <organization showOnFrontPage="true">Apple Inc.</organization>
      <address>
        <postal>
          <street>One Apple Park Way</street>
          <city>Cupertino</city>
          <region>CA</region>
          <code>95014</code>
          <country>United States of America</country>
        </postal>
        <phone>+1 408 974 3207</phone>
        <email>cheshire@apple.com</email>
      </address>
    </author>
    <date month="06" year="2025"/>
    <area>INT</area>
    <workgroup>dnssd</workgroup>
    <keyword>Multicast DNS</keyword>
    <keyword>DNS-Based Service Discovery</keyword>
    <keyword>DNS Update</keyword>
    <keyword>SIG(0)</keyword>
    <abstract pn="section-abstract">
      <t indent="0" pn="section-abstract-1">The Service Registration Protocol (SRP) for DNS-based Service
        Discovery (DNS‑SD) uses the standard DNS Update mechanism to
        enable DNS‑SD using only unicast packets.  This makes it possible
        to deploy DNS‑SD without multicast, which greatly improves
        scalability and improves performance on networks where multicast
        service is not an optimal choice, particularly IEEE 802.11
        (Wi-Fi) and IEEE 802.15.4 networks.  DNS‑SD Service
        registration uses public keys and SIG(0) to allow services to defend
        their registrations.
      </t>
    </abstract>
    <boilerplate>
      <section anchor="status-of-memo" numbered="false" removeInRFC="false" toc="exclude" pn="section-boilerplate.1">
        <name slugifiedName="name-status-of-this-memo">Status of This Memo</name>
        <t indent="0" pn="section-boilerplate.1-1">
            This is an Internet Standards Track document.
        </t>
        <t indent="0" pn="section-boilerplate.1-2">
            This document is a product of the Internet Engineering Task Force
            (IETF).  It represents the consensus of the IETF community.  It has
            received public review and has been approved for publication by
            the Internet Engineering Steering Group (IESG).  Further
            information on Internet Standards is available in Section 2 of 
            RFC 7841.
        </t>
        <t indent="0" pn="section-boilerplate.1-3">
            Information about the current status of this document, any
            errata, and how to provide feedback on it may be obtained at
            <eref target="https://www.rfc-editor.org/info/rfc9665" brackets="none"/>.
        </t>
      </section>
      <section anchor="copyright" numbered="false" removeInRFC="false" toc="exclude" pn="section-boilerplate.2">
        <name slugifiedName="name-copyright-notice">Copyright Notice</name>
        <t indent="0" pn="section-boilerplate.2-1">
            Copyright (c) 2025 IETF Trust and the persons identified as the
            document authors. All rights reserved.
        </t>
        <t indent="0" pn="section-boilerplate.2-2">
            This document is subject to BCP 78 and the IETF Trust's Legal
            Provisions Relating to IETF Documents
            (<eref target="https://trustee.ietf.org/license-info" brackets="none"/>) in effect on the date of
            publication of this document. Please review these documents
            carefully, as they describe your rights and restrictions with
            respect to this document. Code Components extracted from this
            document must include Revised BSD License text as described in
            Section 4.e of the Trust Legal Provisions and are provided without
            warranty as described in the Revised BSD License.
        </t>
      </section>
    </boilerplate>
    <toc>
      <section anchor="toc" numbered="false" removeInRFC="false" toc="exclude" pn="section-toc.1">
        <name slugifiedName="name-table-of-contents">Table of Contents</name>
        <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1">
          <li pn="section-toc.1-1.1">
            <t indent="0" keepWithNext="true" pn="section-toc.1-1.1.1"><xref derivedContent="1" format="counter" sectionFormat="of" target="section-1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-introduction">Introduction</xref></t>
          </li>
          <li pn="section-toc.1-1.2">
            <t indent="0" keepWithNext="true" pn="section-toc.1-1.2.1"><xref derivedContent="2" format="counter" sectionFormat="of" target="section-2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-conventions-and-terminology">Conventions and Terminology Used in This Document</xref></t>
          </li>
          <li pn="section-toc.1-1.3">
            <t indent="0" pn="section-toc.1-1.3.1"><xref derivedContent="3" format="counter" sectionFormat="of" target="section-3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-service-registration-protoc">Service Registration Protocol</xref></t>
            <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.3.2">
              <li pn="section-toc.1-1.3.2.1">
                <t indent="0" pn="section-toc.1-1.3.2.1.1"><xref derivedContent="3.1" format="counter" sectionFormat="of" target="section-3.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-protocol-variants">Protocol Variants</xref></t>
                <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.3.2.1.2">
                  <li pn="section-toc.1-1.3.2.1.2.1">
                    <t indent="0" keepWithNext="true" pn="section-toc.1-1.3.2.1.2.1.1"><xref derivedContent="3.1.1" format="counter" sectionFormat="of" target="section-3.1.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-full-featured-hosts">Full-Featured Hosts</xref></t>
                  </li>
                  <li pn="section-toc.1-1.3.2.1.2.2">
                    <t indent="0" pn="section-toc.1-1.3.2.1.2.2.1"><xref derivedContent="3.1.2" format="counter" sectionFormat="of" target="section-3.1.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-constrained-hosts">Constrained Hosts</xref></t>
                  </li>
                  <li pn="section-toc.1-1.3.2.1.2.3">
                    <t indent="0" pn="section-toc.1-1.3.2.1.2.3.1"><xref derivedContent="3.1.3" format="counter" sectionFormat="of" target="section-3.1.3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-why-two-variants">Why two variants?</xref></t>
                  </li>
                </ul>
              </li>
              <li pn="section-toc.1-1.3.2.2">
                <t indent="0" pn="section-toc.1-1.3.2.2.1"><xref derivedContent="3.2" format="counter" sectionFormat="of" target="section-3.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-protocol-details">Protocol Details</xref></t>
                <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.3.2.2.2">
                  <li pn="section-toc.1-1.3.2.2.2.1">
                    <t indent="0" pn="section-toc.1-1.3.2.2.2.1.1"><xref derivedContent="3.2.1" format="counter" sectionFormat="of" target="section-3.2.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-what-to-publish">What to Publish</xref></t>
                  </li>
                  <li pn="section-toc.1-1.3.2.2.2.2">
                    <t indent="0" pn="section-toc.1-1.3.2.2.2.2.1"><xref derivedContent="3.2.2" format="counter" sectionFormat="of" target="section-3.2.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-where-to-publish-it">Where to Publish It</xref></t>
                  </li>
                  <li pn="section-toc.1-1.3.2.2.2.3">
                    <t indent="0" pn="section-toc.1-1.3.2.2.2.3.1"><xref derivedContent="3.2.3" format="counter" sectionFormat="of" target="section-3.2.3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-how-to-publish-it">How to Publish It</xref></t>
                    <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.3.2.2.2.3.2">
                      <li pn="section-toc.1-1.3.2.2.2.3.2.1">
                        <t indent="0" pn="section-toc.1-1.3.2.2.2.3.2.1.1"><xref derivedContent="3.2.3.1" format="counter" sectionFormat="of" target="section-3.2.3.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-how-the-dnssd-service-regis">How the DNS‑SD Service Registration Process Differs from DNS Update</xref></t>
                      </li>
                      <li pn="section-toc.1-1.3.2.2.2.3.2.2">
                        <t indent="0" pn="section-toc.1-1.3.2.2.2.3.2.2.1"><xref derivedContent="3.2.3.2" format="counter" sectionFormat="of" target="section-3.2.3.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-retransmission-strategy">Retransmission Strategy</xref></t>
                      </li>
                      <li pn="section-toc.1-1.3.2.2.2.3.2.3">
                        <t indent="0" pn="section-toc.1-1.3.2.2.2.3.2.3.1"><xref derivedContent="3.2.3.3" format="counter" sectionFormat="of" target="section-3.2.3.3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-successive-updates">Successive Updates</xref></t>
                      </li>
                    </ul>
                  </li>
                  <li pn="section-toc.1-1.3.2.2.2.4">
                    <t indent="0" pn="section-toc.1-1.3.2.2.2.4.1"><xref derivedContent="3.2.4" format="counter" sectionFormat="of" target="section-3.2.4"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-how-to-secure-it">How to Secure It</xref></t>
                    <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.3.2.2.2.4.2">
                      <li pn="section-toc.1-1.3.2.2.2.4.2.1">
                        <t indent="0" pn="section-toc.1-1.3.2.2.2.4.2.1.1"><xref derivedContent="3.2.4.1" format="counter" sectionFormat="of" target="section-3.2.4.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-fcfs-naming">FCFS Naming</xref></t>
                      </li>
                    </ul>
                  </li>
                  <li pn="section-toc.1-1.3.2.2.2.5">
                    <t indent="0" pn="section-toc.1-1.3.2.2.2.5.1"><xref derivedContent="3.2.5" format="counter" sectionFormat="of" target="section-3.2.5"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-srp-requester-behavior">SRP Requester Behavior</xref></t>
                    <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.3.2.2.2.5.2">
                      <li pn="section-toc.1-1.3.2.2.2.5.2.1">
                        <t indent="0" pn="section-toc.1-1.3.2.2.2.5.2.1.1"><xref derivedContent="3.2.5.1" format="counter" sectionFormat="of" target="section-3.2.5.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-public-private-key-pair-gen">Public/Private Key Pair Generation and Storage</xref></t>
                      </li>
                      <li pn="section-toc.1-1.3.2.2.2.5.2.2">
                        <t indent="0" pn="section-toc.1-1.3.2.2.2.5.2.2.1"><xref derivedContent="3.2.5.2" format="counter" sectionFormat="of" target="section-3.2.5.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-name-conflict-handling">Name Conflict Handling</xref></t>
                      </li>
                      <li pn="section-toc.1-1.3.2.2.2.5.2.3">
                        <t indent="0" pn="section-toc.1-1.3.2.2.2.5.2.3.1"><xref derivedContent="3.2.5.3" format="counter" sectionFormat="of" target="section-3.2.5.3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-record-lifetimes">Record Lifetimes</xref></t>
                      </li>
                      <li pn="section-toc.1-1.3.2.2.2.5.2.4">
                        <t indent="0" pn="section-toc.1-1.3.2.2.2.5.2.4.1"><xref derivedContent="3.2.5.4" format="counter" sectionFormat="of" target="section-3.2.5.4"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-compression-in-srv-records">Compression in SRV Records</xref></t>
                      </li>
                      <li pn="section-toc.1-1.3.2.2.2.5.2.5">
                        <t indent="0" pn="section-toc.1-1.3.2.2.2.5.2.5.1"><xref derivedContent="3.2.5.5" format="counter" sectionFormat="of" target="section-3.2.5.5"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-removing-published-services">Removing Published Services</xref></t>
                      </li>
                    </ul>
                  </li>
                </ul>
              </li>
              <li pn="section-toc.1-1.3.2.3">
                <t indent="0" pn="section-toc.1-1.3.2.3.1"><xref derivedContent="3.3" format="counter" sectionFormat="of" target="section-3.3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-validation-and-processing-o">Validation and Processing of SRP Updates</xref></t>
                <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.3.2.3.2">
                  <li pn="section-toc.1-1.3.2.3.2.1">
                    <t indent="0" pn="section-toc.1-1.3.2.3.2.1.1"><xref derivedContent="3.3.1" format="counter" sectionFormat="of" target="section-3.3.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-validation-of-dns-update-ad">Validation of DNS Update Add and Delete RRs</xref></t>
                    <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.3.2.3.2.1.2">
                      <li pn="section-toc.1-1.3.2.3.2.1.2.1">
                        <t indent="0" pn="section-toc.1-1.3.2.3.2.1.2.1.1"><xref derivedContent="3.3.1.1" format="counter" sectionFormat="of" target="section-3.3.1.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-service-discovery-instructi">Service Discovery Instruction</xref></t>
                      </li>
                      <li pn="section-toc.1-1.3.2.3.2.1.2.2">
                        <t indent="0" pn="section-toc.1-1.3.2.3.2.1.2.2.1"><xref derivedContent="3.3.1.2" format="counter" sectionFormat="of" target="section-3.3.1.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-service-description-instruc">Service Description Instruction</xref></t>
                      </li>
                      <li pn="section-toc.1-1.3.2.3.2.1.2.3">
                        <t indent="0" pn="section-toc.1-1.3.2.3.2.1.2.3.1"><xref derivedContent="3.3.1.3" format="counter" sectionFormat="of" target="section-3.3.1.3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-host-description-instructio">Host Description Instruction</xref></t>
                      </li>
                    </ul>
                  </li>
                  <li pn="section-toc.1-1.3.2.3.2.2">
                    <t indent="0" pn="section-toc.1-1.3.2.3.2.2.1"><xref derivedContent="3.3.2" format="counter" sectionFormat="of" target="section-3.3.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-valid-srp-update-requiremen">Valid SRP Update Requirements</xref></t>
                  </li>
                  <li pn="section-toc.1-1.3.2.3.2.3">
                    <t indent="0" pn="section-toc.1-1.3.2.3.2.3.1"><xref derivedContent="3.3.3" format="counter" sectionFormat="of" target="section-3.3.3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-fcfs-name-and-signature-val">FCFS Name and Signature Validation</xref></t>
                  </li>
                  <li pn="section-toc.1-1.3.2.3.2.4">
                    <t indent="0" pn="section-toc.1-1.3.2.3.2.4.1"><xref derivedContent="3.3.4" format="counter" sectionFormat="of" target="section-3.3.4"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-handling-of-service-subtype">Handling of Service Subtypes</xref></t>
                  </li>
                  <li pn="section-toc.1-1.3.2.3.2.5">
                    <t indent="0" pn="section-toc.1-1.3.2.3.2.5.1"><xref derivedContent="3.3.5" format="counter" sectionFormat="of" target="section-3.3.5"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-srp-update-response">SRP Update Response</xref></t>
                  </li>
                  <li pn="section-toc.1-1.3.2.3.2.6">
                    <t indent="0" pn="section-toc.1-1.3.2.3.2.6.1"><xref derivedContent="3.3.6" format="counter" sectionFormat="of" target="section-3.3.6"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-optional-behavior">Optional Behavior</xref></t>
                  </li>
                </ul>
              </li>
            </ul>
          </li>
          <li pn="section-toc.1-1.4">
            <t indent="0" pn="section-toc.1-1.4.1"><xref derivedContent="4" format="counter" sectionFormat="of" target="section-4"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-ttl-consistency">TTL Consistency</xref></t>
          </li>
          <li pn="section-toc.1-1.5">
            <t indent="0" pn="section-toc.1-1.5.1"><xref derivedContent="5" format="counter" sectionFormat="of" target="section-5"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-maintenance">Maintenance</xref></t>
            <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.5.2">
              <li pn="section-toc.1-1.5.2.1">
                <t indent="0" pn="section-toc.1-1.5.2.1.1"><xref derivedContent="5.1" format="counter" sectionFormat="of" target="section-5.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-cleaning-up-stale-data">Cleaning Up Stale Data</xref></t>
              </li>
            </ul>
          </li>
          <li pn="section-toc.1-1.6">
            <t indent="0" pn="section-toc.1-1.6.1"><xref derivedContent="6" format="counter" sectionFormat="of" target="section-6"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-security-considerations">Security Considerations</xref></t>
            <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.6.2">
              <li pn="section-toc.1-1.6.2.1">
                <t indent="0" pn="section-toc.1-1.6.2.1.1"><xref derivedContent="6.1" format="counter" sectionFormat="of" target="section-6.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-source-validation">Source Validation</xref></t>
              </li>
              <li pn="section-toc.1-1.6.2.2">
                <t indent="0" pn="section-toc.1-1.6.2.2.1"><xref derivedContent="6.2" format="counter" sectionFormat="of" target="section-6.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-other-dns-updates">Other DNS Updates</xref></t>
              </li>
              <li pn="section-toc.1-1.6.2.3">
                <t indent="0" pn="section-toc.1-1.6.2.3.1"><xref derivedContent="6.3" format="counter" sectionFormat="of" target="section-6.3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-risks-of-allowing-arbitrary">Risks of Allowing Arbitrary Names to be Registered in SRP Updates</xref></t>
              </li>
              <li pn="section-toc.1-1.6.2.4">
                <t indent="0" pn="section-toc.1-1.6.2.4.1"><xref derivedContent="6.4" format="counter" sectionFormat="of" target="section-6.4"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-security-of-local-service-d">Security of Local Service Discovery</xref></t>
              </li>
              <li pn="section-toc.1-1.6.2.5">
                <t indent="0" pn="section-toc.1-1.6.2.5.1"><xref derivedContent="6.5" format="counter" sectionFormat="of" target="section-6.5"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-srp-registrar-authenticatio">SRP Registrar Authentication</xref></t>
              </li>
              <li pn="section-toc.1-1.6.2.6">
                <t indent="0" pn="section-toc.1-1.6.2.6.1"><xref derivedContent="6.6" format="counter" sectionFormat="of" target="section-6.6"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-required-signature-algorith">Required Signature Algorithm</xref></t>
              </li>
            </ul>
          </li>
          <li pn="section-toc.1-1.7">
            <t indent="0" pn="section-toc.1-1.7.1"><xref derivedContent="7" format="counter" sectionFormat="of" target="section-7"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-privacy-considerations">Privacy Considerations</xref></t>
          </li>
          <li pn="section-toc.1-1.8">
            <t indent="0" pn="section-toc.1-1.8.1"><xref derivedContent="8" format="counter" sectionFormat="of" target="section-8"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-domain-name-reservation-con">Domain Name Reservation Considerations</xref></t>
            <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.8.2">
              <li pn="section-toc.1-1.8.2.1">
                <t indent="0" pn="section-toc.1-1.8.2.1.1"><xref derivedContent="8.1" format="counter" sectionFormat="of" target="section-8.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-users">Users</xref></t>
              </li>
              <li pn="section-toc.1-1.8.2.2">
                <t indent="0" pn="section-toc.1-1.8.2.2.1"><xref derivedContent="8.2" format="counter" sectionFormat="of" target="section-8.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-application-software">Application Software</xref></t>
              </li>
              <li pn="section-toc.1-1.8.2.3">
                <t indent="0" pn="section-toc.1-1.8.2.3.1"><xref derivedContent="8.3" format="counter" sectionFormat="of" target="section-8.3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-name-resolution-apis-and-li">Name Resolution APIs and Libraries</xref></t>
              </li>
              <li pn="section-toc.1-1.8.2.4">
                <t indent="0" pn="section-toc.1-1.8.2.4.1"><xref derivedContent="8.4" format="counter" sectionFormat="of" target="section-8.4"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-recursive-resolvers">Recursive Resolvers</xref></t>
              </li>
              <li pn="section-toc.1-1.8.2.5">
                <t indent="0" pn="section-toc.1-1.8.2.5.1"><xref derivedContent="8.5" format="counter" sectionFormat="of" target="section-8.5"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-authoritative-dns-servers">Authoritative DNS Servers</xref></t>
              </li>
              <li pn="section-toc.1-1.8.2.6">
                <t indent="0" pn="section-toc.1-1.8.2.6.1"><xref derivedContent="8.6" format="counter" sectionFormat="of" target="section-8.6"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-dns-server-operators">DNS Server Operators</xref></t>
              </li>
              <li pn="section-toc.1-1.8.2.7">
                <t indent="0" pn="section-toc.1-1.8.2.7.1"><xref derivedContent="8.7" format="counter" sectionFormat="of" target="section-8.7"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-dns-registries-registrars">DNS Registries/Registrars</xref></t>
              </li>
            </ul>
          </li>
          <li pn="section-toc.1-1.9">
            <t indent="0" pn="section-toc.1-1.9.1"><xref derivedContent="9" format="counter" sectionFormat="of" target="section-9"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-delegation-of-servicearpa">Delegation of "service.arpa."</xref></t>
          </li>
          <li pn="section-toc.1-1.10">
            <t indent="0" pn="section-toc.1-1.10.1"><xref derivedContent="10" format="counter" sectionFormat="of" target="section-10"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-iana-considerations">IANA Considerations</xref></t>
            <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.10.2">
              <li pn="section-toc.1-1.10.2.1">
                <t indent="0" pn="section-toc.1-1.10.2.1.1"><xref derivedContent="10.1" format="counter" sectionFormat="of" target="section-10.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-registration-and-delegation">Registration and Delegation of "service.arpa." as a Special-Use Domain Name</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.2">
                <t indent="0" pn="section-toc.1-1.10.2.2.1"><xref derivedContent="10.2" format="counter" sectionFormat="of" target="section-10.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-addition-of-servicearpa-to-">Addition of "service.arpa." to the Locally-Served Zones Registry</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.3">
                <t indent="0" pn="section-toc.1-1.10.2.3.1"><xref derivedContent="10.3" format="counter" sectionFormat="of" target="section-10.3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-subdomains-of-servicearpa">Subdomains of "service.arpa."</xref></t>
              </li>
              <li pn="section-toc.1-1.10.2.4">
                <t indent="0" pn="section-toc.1-1.10.2.4.1"><xref derivedContent="10.4" format="counter" sectionFormat="of" target="section-10.4"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-service-name-registrations">Service Name Registrations</xref></t>
                <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.10.2.4.2">
                  <li pn="section-toc.1-1.10.2.4.2.1">
                    <t indent="0" pn="section-toc.1-1.10.2.4.2.1.1"><xref derivedContent="10.4.1" format="counter" sectionFormat="of" target="section-10.4.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-dnssd-srp-service-name">"dnssd-srp" Service Name</xref></t>
                  </li>
                  <li pn="section-toc.1-1.10.2.4.2.2">
                    <t indent="0" pn="section-toc.1-1.10.2.4.2.2.1"><xref derivedContent="10.4.2" format="counter" sectionFormat="of" target="section-10.4.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-dnssd-srp-tls-service-name">"dnssd-srp-tls" Service Name</xref></t>
                  </li>
                </ul>
              </li>
              <li pn="section-toc.1-1.10.2.5">
                <t indent="0" pn="section-toc.1-1.10.2.5.1"><xref derivedContent="10.5" format="counter" sectionFormat="of" target="section-10.5"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-anycast-address">Anycast Address</xref></t>
              </li>
            </ul>
          </li>
          <li pn="section-toc.1-1.11">
            <t indent="0" pn="section-toc.1-1.11.1"><xref derivedContent="11" format="counter" sectionFormat="of" target="section-11"/>. <xref derivedContent="" format="title" sectionFormat="of" target="name-references">References</xref></t>
            <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.11.2">
              <li pn="section-toc.1-1.11.2.1">
                <t indent="0" pn="section-toc.1-1.11.2.1.1"><xref derivedContent="11.1" format="counter" sectionFormat="of" target="section-11.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-normative-references">Normative References</xref></t>
              </li>
              <li pn="section-toc.1-1.11.2.2">
                <t indent="0" pn="section-toc.1-1.11.2.2.1"><xref derivedContent="11.2" format="counter" sectionFormat="of" target="section-11.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-informative-references">Informative References</xref></t>
              </li>
            </ul>
          </li>
          <li pn="section-toc.1-1.12">
            <t indent="0" pn="section-toc.1-1.12.1"><xref derivedContent="Appendix A" format="default" sectionFormat="of" target="section-appendix.a"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-using-standard-authoritativ">Using Standard Authoritative DNS Servers Compliant with RFC 2136 to Test SRP Requesters</xref></t>
          </li>
          <li pn="section-toc.1-1.13">
            <t indent="0" pn="section-toc.1-1.13.1"><xref derivedContent="Appendix B" format="default" sectionFormat="of" target="section-appendix.b"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-how-to-allow-srp-requesters">How to Allow SRP Requesters to Update Standard Servers Compliant with RFC 2136</xref></t>
          </li>
          <li pn="section-toc.1-1.14">
            <t indent="0" pn="section-toc.1-1.14.1"><xref derivedContent="Appendix C" format="default" sectionFormat="of" target="section-appendix.c"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-sample-bind-9-configuration">Sample BIND 9 Configuration for "default.service.arpa."</xref></t>
          </li>
          <li pn="section-toc.1-1.15">
            <t indent="0" pn="section-toc.1-1.15.1"><xref derivedContent="" format="none" sectionFormat="of" target="section-appendix.d"/><xref derivedContent="" format="title" sectionFormat="of" target="name-acknowledgments">Acknowledgments</xref></t>
          </li>
          <li pn="section-toc.1-1.16">
            <t indent="0" pn="section-toc.1-1.16.1"><xref derivedContent="" format="none" sectionFormat="of" target="section-appendix.e"/><xref derivedContent="" format="title" sectionFormat="of" target="name-authors-addresses">Authors' Addresses</xref></t>
          </li>
        </ul>
      </section>
    </toc>
  </front>
  <middle>
    <section numbered="true" removeInRFC="false" toc="include" pn="section-1">
      <name slugifiedName="name-introduction">Introduction</name>
      <t indent="0" pn="section-1-1">
        DNS‑SD <xref target="RFC6763" format="default" sectionFormat="of" derivedContent="RFC6763"/>
        is a component of Zero Configuration Networking
        <xref target="RFC6760" format="default" sectionFormat="of" derivedContent="RFC6760"/>
        <xref target="ZC" format="default" sectionFormat="of" derivedContent="ZC"/>
        <xref target="I-D.cheshire-dnssd-roadmap" format="default" sectionFormat="of" derivedContent="ROADMAP"/>.</t>
      <t indent="0" pn="section-1-2">
        This document describes an enhancement to DNS‑SD that
	allows servers to register the services they offer using the DNS protocol
	over unicast rather than using Multicast DNS (mDNS) <xref target="RFC6762" format="default" sectionFormat="of" derivedContent="RFC6762"/>.
	There is already a large installed base of DNS‑SD
	clients that can discover services using the DNS
	protocol (e.g., Android, Windows, Linux, Apple operating systems).</t>
      <t indent="0" pn="section-1-3">
        This document is intended for three audiences: Implementers of software that provides services that should be advertised
        using DNS‑SD, implementers of authoritative DNS servers that will
        be used in contexts where DNS‑SD registration is needed, and
        administrators of networks where DNS‑SD service is required.
        The document is expected to provide sufficient
        information to allow interoperable implementation
        of the Service Registration Protocol.</t>
      <t indent="0" pn="section-1-4">
  DNS‑SD allows servers to publish the information required to access
  the services they provide.  DNS‑SD clients can then discover the set
  of service instances of a particular type that are available.  They can then
  select an instance from among those that are available and obtain the
  information required to use it.  Although DNS‑SD using the DNS
  protocol can be more efficient and versatile than using mDNS, it is
  not common in practice because of the difficulties associated with
  updating authoritative DNS services with service information.</t>
      <t indent="0" pn="section-1-5">
	The existing practice for updating DNS zones is either to enter new data manually or to use DNS Update
      <xref target="RFC2136" format="default" sectionFormat="of" derivedContent="RFC2136"/>. Unfortunately, DNS Update requires either:</t>
      <ul bare="false" empty="false" indent="3" spacing="normal" pn="section-1-6">
        <li pn="section-1-6.1">that the authoritative DNS server automatically trust
	updates or</li>
        <li pn="section-1-6.2">that the DNS Update requester have some kind of shared secret
	or public key that is known to the authoritative DNS server
	and can be used to authenticate the update.</li>
      </ul>
      <t indent="0" pn="section-1-7">Furthermore, DNS Update can be a fairly chatty process, requiring multiple
	roundtrips with different conditional predicates to complete the update process.</t>
      <t indent="0" pn="section-1-8">
	The Service Registration Protocol (SRP) adds a set of default
	heuristics for processing DNS updates that eliminates the need for
	conditional predicates.
	Instead, the SRP registrar (an authoritative DNS server
	that supports SRP Updates) has a set of default predicates
	that are applied to the update; and the update either succeeds entirely or fails in a way that allows the requester to know
	what went wrong and construct a new update.</t>
      <t indent="0" pn="section-1-9">
	SRP also adds a feature called "First Come, First Served Naming" (or "FCFS Naming"), which allows the requester to:</t>
      <ul bare="false" empty="false" indent="3" spacing="normal" pn="section-1-10">
        <li pn="section-1-10.1">claim a name that is
	not yet in use, and</li>
        <li pn="section-1-10.2">authenticate, using SIG(0) <xref target="RFC2931" format="default" sectionFormat="of" derivedContent="RFC2931"/>,
	both the initial claim
	(to ensure it has not been modified in transit)
	and subsequent updates
	(to ensure they come from the same entity that performed the initial claim).</li>
      </ul>
      <t indent="0" pn="section-1-11">This prevents a new service instance from "stealing" a name that is already in use:
	A second SRP requester attempting to claim an existing name will not possess the
	SIG(0) key used by the first requester to claim it. Because of this, its claim will be rejected. This will force it to
	choose a new name.</t>
      <t indent="0" pn="section-1-12">
	It is important to understand that "authenticate" here just means that we can tell that an update came from the same source
	as the original registration. We have not established trust. This has important implications for what we can and can't do
	with data the SRP requester sends us.
	You will notice as you read this document that
	we only support adding a very restricted set
	of records, and the content of those records is further constrained.</t>
      <t indent="0" pn="section-1-13">
	The reason for this is precisely that we have not established trust. So, we can only publish information that we feel safe in
	publishing even though we do not have any basis for trusting the requester.
	We reason that mDNS <xref target="RFC6762" format="default" sectionFormat="of" derivedContent="RFC6762"/> allows
	arbitrary hosts on a single IP link to advertise services
	<xref target="RFC6763" format="default" sectionFormat="of" derivedContent="RFC6763"/>, relying on whatever service is
	advertised to provide authentication as a part of its protocol rather than in the service advertisement.</t>
      <t indent="0" pn="section-1-14">
	This is considered reasonably safe because it requires physical presence on the network in order to advertise. An off-network
	mDNS attack is simply not possible. Our goal with this specification is to impose similar constraints. Therefore, you will
	see in <xref target="add_validation" format="default" sectionFormat="of" derivedContent="Section 3.3.1"/> that a very restricted set of records with a very restricted set of relationships are
	allowed. You will also see in <xref target="source_validation" format="default" sectionFormat="of" derivedContent="Section 6.1"/> that we give advice on how to prevent off-network attacks.</t>
      <t indent="0" pn="section-1-15">
	This leads us to the disappointing observation that this protocol is not a mechanism for adding arbitrary information to
	DNS zones. We have not evaluated the security properties of adding, for example, an SOA record, an MX record, or a CNAME
	record; therefore, these are forbidden.
	Future updates to this specification might include analyses for other records
	and extend the set of records and/or record content that can be registered here.
	Or it might require establishment of trust, and add an authorization model
	to the authentication model we now have.
	But that is work for a future document.</t>
      <t indent="0" pn="section-1-16">
	Finally, SRP adds the concept of a "lease" <xref target="RFC9664" format="default" sectionFormat="of" derivedContent="RFC9664"/>,
	analogous to leases in DHCP <xref target="RFC2131" format="default" sectionFormat="of" derivedContent="RFC2131"/> <xref target="RFC8415" format="default" sectionFormat="of" derivedContent="RFC8415"/>.  The SRP registration itself has a lease that may
	be on the order of two hours; if the requester does not renew the
	lease before it has elapsed, the registration is removed.  The claim
	on the name can have a longer lease so that another requester cannot
	immediately claim the name, even though the registration itself has
	expired.</t>
      <t indent="0" pn="section-1-17">
        The Service Registration Protocol for DNS‑SD
        specified in this document provides a reasonably secure
        mechanism for publishing this information.
        Once published, these services can be readily
        discovered by DNS‑SD clients using
        standard DNS lookups.</t>
      <t indent="0" pn="section-1-18">
        Section <xref target="RFC6763" section="10" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc6763#section-10" derivedContent="RFC6763"/>
        of the DNS‑SD specification <xref target="RFC6763" format="default" sectionFormat="of" derivedContent="RFC6763"/>
        briefly discusses ways that servers can advertise the services
        they provide in the DNS namespace.  In the case of
        mDNS, it allows servers to advertise their services on the local link,
        using names in the "local." namespace, which makes
        their services directly discoverable by peers attached to that same local link.</t>
      <t indent="0" pn="section-1-19">
        DNS‑SD <xref target="RFC6763" format="default" sectionFormat="of" derivedContent="RFC6763"/> also allows clients to discover services
        by using the DNS protocol over traditional unicast <xref target="RFC1035" format="default" sectionFormat="of" derivedContent="RFC1035"/>.
        This can be done by
        having a system administrator manually configure service information in the DNS; however, manually populating DNS authoritative
        server databases is costly and potentially error-prone and requires a knowledgeable network administrator.  Consequently,
        although all DNS‑SD client implementations of which we are
        aware support DNS‑SD using DNS queries, in practice it
        is used much less frequently than mDNS.</t>
      <t indent="0" pn="section-1-20">
        The Discovery Proxy <xref target="RFC8766" format="default" sectionFormat="of" derivedContent="RFC8766"/> provides one way to automatically populate the DNS
        namespace but is only appropriate on networks where services are easily advertised using mDNS.  The present document describes a
        solution more suitable for networks where multicast is inefficient,
        or where sleepy devices are common, by supporting the use of unicast
        for both the offering of and the discovery of services.</t>
    </section>
    <section numbered="true" removeInRFC="false" toc="include" pn="section-2">
      <name slugifiedName="name-conventions-and-terminology">Conventions and Terminology Used in This Document</name>
      <t indent="0" pn="section-2-1">
    The key words "<bcp14>MUST</bcp14>", "<bcp14>MUST NOT</bcp14>", "<bcp14>REQUIRED</bcp14>", "<bcp14>SHALL</bcp14>", "<bcp14>SHALL NOT</bcp14>", "<bcp14>SHOULD</bcp14>", "<bcp14>SHOULD NOT</bcp14>", "<bcp14>RECOMMENDED</bcp14>", "<bcp14>NOT RECOMMENDED</bcp14>",
    "<bcp14>MAY</bcp14>", and "<bcp14>OPTIONAL</bcp14>" in this document are to be interpreted as
    described in BCP 14 <xref target="RFC2119" format="default" sectionFormat="of" derivedContent="RFC2119"/> <xref target="RFC8174" format="default" sectionFormat="of" derivedContent="RFC8174"/>
    when, and only when, they appear in all capitals, as shown here.
      </t>
      <t indent="0" pn="section-2-2">Strictly speaking, fully qualified domain names end with a dot
	(".").  In DNS zone files and other similar contexts, if the final dot
	is omitted, then a name may be treated incorrectly as relative to some
	other parent domain.  This document follows the formal DNS convention,
	ending fully qualified domain names with a dot.  When this document
	mentions domain names such as "local." and "default.service.arpa.",
	the final dot is part of the domain name; it is not a period
	indicating the end of the sentence.</t>
    </section>
    <section numbered="true" removeInRFC="false" toc="include" pn="section-3">
      <name slugifiedName="name-service-registration-protoc">Service Registration Protocol</name>
      <t indent="0" pn="section-3-1">
        Services that implement SRP use DNS Update <xref target="RFC2136" format="default" sectionFormat="of" derivedContent="RFC2136"/> with SIG(0) <xref target="RFC3007" format="default" sectionFormat="of" derivedContent="RFC3007"/> to publish service information
        in the DNS.  Two variants exist: One for full-featured hosts and one for devices designed for Constrained-Node Networks (CNNs)
        <xref target="RFC7228" format="default" sectionFormat="of" derivedContent="RFC7228"/>.
        An SRP registrar is most likely an authoritative DNS server
        or is a source of data for one or more authoritative DNS servers.
        There is no requirement that the authoritative DNS server that is
        receiving SRP Updates be the same authoritative DNS server that is
        answering queries that return records that have been registered.
        For example, an SRP registrar could be the "hidden primary" that is
        the source of data for a fleet of secondary authoritative DNS servers.</t>
      <section numbered="true" removeInRFC="false" toc="include" pn="section-3.1">
        <name slugifiedName="name-protocol-variants">Protocol Variants</name>
        <section numbered="true" removeInRFC="false" toc="include" pn="section-3.1.1">
          <name slugifiedName="name-full-featured-hosts">Full-Featured Hosts</name>
          <t indent="0" pn="section-3.1.1-1">
            Full-featured hosts either are configured manually with a registration domain or discover the default registration
	    domain automatically using the Domain Enumeration process described in
	    Section <xref target="RFC6763" section="11" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc6763#section-11" derivedContent="RFC6763"/>
	    of the DNS‑SD specification <xref target="RFC6763" format="default" sectionFormat="of" derivedContent="RFC6763"/>.
	    If this process does not produce a
	    default registration domain, the SRP registrar
	    is not discoverable on the local network using this
	    mechanism. Other discovery mechanisms are possible, but they are out of scope for this document.</t>
          <t indent="0" pn="section-3.1.1-2">
            Configuration of the registration domain can be done either:</t>
          <ul bare="false" empty="false" indent="3" spacing="normal" pn="section-3.1.1-3">
            <li pn="section-3.1.1-3.1">by querying the list of available registration
            domains ("r._dns‑sd._udp") and allowing the user to select one from the UI, or</li>
            <li pn="section-3.1.1-3.2">by any other means appropriate to
            the particular use case being addressed.</li>
          </ul>
          <t indent="0" pn="section-3.1.1-4">Full-featured devices construct the names of the SRV, TXT, and PTR records
            describing their service or services as subdomains of the chosen service registration domain.  For these names, they then discover
            the zone apex of the closest enclosing DNS zone using SOA queries
            as described in
            Section <xref target="RFC8765" section="6.1" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc8765#section-6.1" derivedContent="RFC8765"/>
            of the DNS Push Notification specification <xref target="RFC8765" format="default" sectionFormat="of" derivedContent="RFC8765"/>.
            Having
            discovered the enclosing DNS zone, they query for the "_dnssd‑srp._tcp.&lt;zone&gt;" SRV record to discover the
            SRP registrar to which they can send SRP Updates.  Hosts that support SRP Updates using TLS use the
            "_dnssd‑srp‑tls._tcp.&lt;zone&gt;" SRV record instead.</t>
          <t indent="0" pn="section-3.1.1-5">
	    Examples of full-featured hosts include devices such as home computers, laptops, powered peripherals with network
	    connections (such as printers and home routers), and even battery-operated devices such as mobile phones that have
	    long battery lives.
          </t>
        </section>
        <section anchor="constrained_hosts" numbered="true" removeInRFC="false" toc="include" pn="section-3.1.2">
          <name slugifiedName="name-constrained-hosts">Constrained Hosts</name>
          <t indent="0" pn="section-3.1.2-1">
            For devices designed for CNNs <xref target="RFC7228" format="default" sectionFormat="of" derivedContent="RFC7228"/>,
            some simplifications are available.  Instead of
            being configured with (or discovering) the service registration domain,
            the special-use domain name <xref target="RFC6761" format="default" sectionFormat="of" derivedContent="RFC6761"/> "default.service.arpa." is used.
            The details of how SRP registrars are discovered will be specific
            to the constrained network; therefore, we do not suggest a specific mechanism here.</t>
          <t indent="0" pn="section-3.1.2-2">
            SRP requesters on CNNs are expected to receive, from the network,
            a list of SRP registrars with which to register.  It is the
            responsibility of a CNN supporting SRP to provide at least one
            registrar address and port.  It is the responsibility of the
            registrar supporting a CNN to handle the updates appropriately.
            In some network environments, updates may be accepted directly
            into a local "default.service.arpa." zone, which has only local
            visibility.  In other network environments, updates for names
            ending in "default.service.arpa." may be rewritten by the
            registrar to names with broader visibility.  Domain name rewriting
            should be performed as appropriate for the network environment in
            question.  Some suggested techniques for how domain names can be
            translated from a locally scoped name to a domain name with larger
            scope can be found in the discussion of data translation for names
            in Multicast DNS answers in Section <xref target="RFC8766" section="5.5" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc8766#section-5.5" derivedContent="RFC8766"/> of the Discovery Proxy
            specification <xref target="RFC8766" format="default" sectionFormat="of" derivedContent="RFC8766"/>.</t>
        </section>
        <section numbered="true" removeInRFC="false" toc="include" pn="section-3.1.3">
          <name slugifiedName="name-why-two-variants">Why two variants?</name>
          <t indent="0" pn="section-3.1.3-1">
            The reason for these different variants is that low-power devices that typically use CNNs may have
            very limited battery capacity.  The series of DNS lookups required to discover an SRP registrar and then communicate with
            it will increase the energy required to advertise a service; for low-power devices, the additional flexibility this
            provides does not justify the additional use of energy.  It is also fairly typical of such networks that some network
            service information is obtained as part of the process of joining the network; thus, this can be relied upon to provide
            nodes with the information they need.</t>
          <t indent="0" pn="section-3.1.3-2">
            Networks that are not CNNs can have more complicated topologies at the IP layer. Nodes connected
            to such networks can be assumed to be able to do DNS‑SD
            service registration domain discovery. Such networks are
            generally able to provide registration domain discovery and routing.  This creates the possibility of off-network
	    spoofing, where a device from a foreign network registers a service on the local network in order to attack devices
	    on the local network. To guard against off-path spoofing, TCP is required for such networks.</t>
        </section>
      </section>
      <section numbered="true" removeInRFC="false" toc="include" pn="section-3.2">
        <name slugifiedName="name-protocol-details">Protocol Details</name>
        <t indent="0" pn="section-3.2-1">
We will discuss several parts to this process:</t>
        <ul spacing="compact" bare="false" empty="false" indent="3" pn="section-3.2-2">
          <li pn="section-3.2-2.1">how to know what to publish (<xref target="what" format="default" sectionFormat="of" derivedContent="Section 3.2.1"/>),</li>
          <li pn="section-3.2-2.2">how to know where to publish it (under what name) (<xref target="where" format="default" sectionFormat="of" derivedContent="Section 3.2.2"/>),</li>
          <li pn="section-3.2-2.3">how to publish it (<xref target="how" format="default" sectionFormat="of" derivedContent="Section 3.2.3"/>),</li>
          <li pn="section-3.2-2.4">how to secure its publication (<xref target="how-to-secure" format="default" sectionFormat="of" derivedContent="Section 3.2.4"/>), and</li>
          <li pn="section-3.2-2.5">how to maintain
          the information once published (<xref target="maintenance" format="default" sectionFormat="of" derivedContent="Section 5"/>).</li>
        </ul>
        <section anchor="what" numbered="true" removeInRFC="false" toc="include" pn="section-3.2.1">
          <name slugifiedName="name-what-to-publish">What to Publish</name>
          <t indent="0" pn="section-3.2.1-1">
            SRP Updates are sent by SRP requesters to SRP registrars.  Three types of instructions appear in an SRP Update: Service
	    Discovery instructions, Service Description instructions, and Host Description instructions. These instructions are made
	    up of DNS Update Resource Records (RRs) that are either adds or deletes. The types of records that are added, updated, and removed in each
	    of these instructions, as well as the constraints that apply to them, are described in <xref target="server_behavior" format="default" sectionFormat="of" derivedContent="Section 3.3"/>.
	    An SRP Update is a DNS Update message <xref target="RFC2136" format="default" sectionFormat="of" derivedContent="RFC2136"/> that is
	    constructed so as to meet the constraints described in that section. The
	    following is a brief overview of what is included in a typical SRP Update:
          </t>
          <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-3.2.1-2">
            <li pn="section-3.2.1-2.1">
              Service Discovery PTR RR(s) for service(s), which map from a
              generic service type (or subtype(s)) to a specific
              service instance name <xref target="RFC6763" format="default" sectionFormat="of" derivedContent="RFC6763"/>.</li>
            <li pn="section-3.2.1-2.2">
	      For each service instance name, an SRV RR, one or more
	      TXT RRs, and a KEY RR. Although, in principle, DNS‑SD
	      Service Description records can include other record types with
	      the same service instance name, in practice, they rarely do.
	      Currently, SRP does not permit other record types. The KEY RR is used
	      to support FCFS Naming and has no specific meaning for DNS‑SD
	      lookups. SRV records for all services described in an
	      SRP Update point to the same hostname.</li>
            <li pn="section-3.2.1-2.3">
	      There is always exactly one hostname in a single SRP Update.
              A DNS Update containing more than one hostname is not an SRP Update.
              The hostname has one or more address RRs (AAAA or A) and
              a KEY RR (used for FCFS Naming). Depending on the use case, an SRP requester may be required to suppress some
              addresses that would not be usable by hosts discovering the service through the SRP registrar. The exact address
              record suppression behavior required may vary for different types of SRP requesters.
              Some suggested policies for suppressing unusable records can be found in
              Section <xref target="RFC8766" section="5.5.2" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc8766#section-5.5.2" derivedContent="RFC8766"/>
              of the Discovery Proxy specification <xref target="RFC8766" format="default" sectionFormat="of" derivedContent="RFC8766"/>.
	    </li>
          </ul>
          <t indent="0" pn="section-3.2.1-3">
            The DNS-Based Service Discovery specification
            <xref target="RFC6763" format="default" sectionFormat="of" derivedContent="RFC6763"/> describes the details of
            what each of these RR types mean, with the exception of
            the KEY RR, which is defined in the
            specification for how to store Diffie-Hellman
            Keys in the DNS <xref target="RFC2539" format="default" sectionFormat="of" derivedContent="RFC2539"/>.
            These specifications should be considered
            the definitive sources for
            information about what to publish; the reason for summarizing this here is to provide the reader with enough information
            about what will be published that the service registration process can be understood at a high level without first
            learning the full details of DNS‑SD.
            Also, the "service instance name" is an important aspect of FCFS
            Naming, which we describe later on in this document.</t>
        </section>
        <section anchor="where" numbered="true" removeInRFC="false" toc="include" pn="section-3.2.2">
          <name slugifiedName="name-where-to-publish-it">Where to Publish It</name>
          <t indent="0" pn="section-3.2.2-1">
            Multicast DNS (mDNS) uses a single namespace, "local.".
            Subdomains of "local." are specific to the local link on which they are advertised.
            This convenience is not available for
            DNS‑SD using the DNS protocol: Services must exist in
            some specific DNS namespace that is chosen either by the
	    network operator or automatically.</t>
          <t indent="0" pn="section-3.2.2-2">
            As described above, full-featured devices are responsible for knowing the domain in which to register their services.
	    Such devices <bcp14>MAY</bcp14> optionally support configuration of a registration domain by the operator of the device. However,
	    such devices <bcp14>MUST</bcp14> support registration domain discovery as described in
	    Section <xref target="RFC6763" section="11" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc6763#section-11" derivedContent="RFC6763"/>
	    of the DNS‑SD specification <xref target="RFC6763" format="default" sectionFormat="of" derivedContent="RFC6763"/>.
          </t>
          <t indent="0" pn="section-3.2.2-3">
            Devices made for CNNs register in the
            special-use domain name <xref target="RFC6761" format="default" sectionFormat="of" derivedContent="RFC6761"/>
            "default.service.arpa." and let the SRP registrar handle
            rewriting that to a different domain if necessary,
            as mentioned in <xref target="constrained_hosts" format="default" sectionFormat="of" derivedContent="Section 3.1.2"/>.</t>
        </section>
        <section anchor="how" numbered="true" removeInRFC="false" toc="include" pn="section-3.2.3">
          <name slugifiedName="name-how-to-publish-it">How to Publish It</name>
          <t indent="0" pn="section-3.2.3-1">
            It is possible to send a DNS Update message that does several things at once:
            For example, it's possible in a single transaction
            to add or update a single Host Description
            while also adding or updating the RRs comprising the Service Description(s)
            for one or more service instance(s) available on that host
            and adding or updating the RRs comprising the Service Discovery instruction(s)
            for those service instance(s).</t>
          <t indent="0" pn="section-3.2.3-2">
            An SRP Update takes advantage of this: It is implemented as a
            single DNS Update message that contains a service's Service
            Discovery records, Service Description records, and Host
            Description records.</t>
          <t indent="0" pn="section-3.2.3-3">
	    Updates done according to this specification are somewhat
	    different from normal DNS Updates <xref target="RFC2136" format="default" sectionFormat="of" derivedContent="RFC2136"/> where
	    the update process could involve many update attempts. The
	    requester might first attempt to add a name if it doesn't exist;
	    if that fails, then in a second message the requester might update
	    the name if it does exist but matches certain
	    preconditions. Because the Service Registration Protocol described
	    in this document uses a single transaction, some of this
	    adaptability is lost.</t>
          <t indent="0" pn="section-3.2.3-4">
            In order to allow updates to happen in a single transaction, SRP Updates do not include update prerequisites.  The
            requirements specified in <xref target="server_behavior" format="default" sectionFormat="of" derivedContent="Section 3.3"/> are implicit in the processing of SRP Updates; thus, there is
            no need for the SRP requester to put in any explicit prerequisites.</t>
          <section numbered="true" removeInRFC="false" toc="include" pn="section-3.2.3.1">
            <name slugifiedName="name-how-the-dnssd-service-regis">How the DNS‑SD Service Registration Process Differs from DNS Update</name>
            <t indent="0" pn="section-3.2.3.1-1">
              DNS‑SD Service Registration uses the DNS Update specification <xref target="RFC2136" format="default" sectionFormat="of" derivedContent="RFC2136"/>
              with some additions:</t>
            <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-3.2.3.1-2">
              <li pn="section-3.2.3.1-2.1">
		It implements FCFS Naming, protected using SIG(0) <xref target="RFC2931" format="default" sectionFormat="of" derivedContent="RFC2931"/>.</li>
              <li pn="section-3.2.3.1-2.2">
		It enforces policy about what updates are allowed.</li>
              <li pn="section-3.2.3.1-2.3">
		It optionally performs rewriting of "default.service.arpa." to some other domain.</li>
              <li pn="section-3.2.3.1-2.4">
		It optionally performs automatic population of the address-to-name reverse mapping domains.</li>
              <li pn="section-3.2.3.1-2.5">
		An SRP registrar is not required to implement general DNS Update prerequisite processing.</li>
              <li pn="section-3.2.3.1-2.6">
		CNN SRP requesters are allowed to send updates to the generic domain "default.service.arpa.".</li>
            </ul>
          </section>
          <section numbered="true" removeInRFC="false" toc="include" pn="section-3.2.3.2">
            <name slugifiedName="name-retransmission-strategy">Retransmission Strategy</name>
            <t indent="0" pn="section-3.2.3.2-1">The DNS protocol, including DNS updates, can operate over UDP
	    or TCP.  For UDP updates from CNN devices, reliable transmission
	    must be guaranteed by retransmitting when a DNS UDP message is not
	    acknowledged in a reasonable interval.  Section <xref target="RFC1035" section="4.2.1" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc1035#section-4.2.1" derivedContent="RFC1035"/> of the DNS
	    specification <xref target="RFC1035" format="default" sectionFormat="of" derivedContent="RFC1035"/> provides some guidance on
	    this topic, as does Section <xref target="RFC1536" section="1" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc1536#section-1" derivedContent="RFC1536"/> of the IETF document describing common DNS
	    implementation errors <xref target="RFC1536" format="default" sectionFormat="of" derivedContent="RFC1536"/>.  Section <xref target="RFC8085" section="3.1.3" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc8085#section-3.1.3" derivedContent="RFC8085"/> of the UDP
	    Usage Guidelines document <xref target="RFC8085" format="default" sectionFormat="of" derivedContent="RFC8085"/> also provides
	    useful guidance that is particularly relevant to DNS.</t>
          </section>
          <section numbered="true" removeInRFC="false" toc="include" pn="section-3.2.3.3">
            <name slugifiedName="name-successive-updates">Successive Updates</name>
            <t indent="0" pn="section-3.2.3.3-1">SRP does not require that every update contain the same information.
	      When an SRP requester needs to send more than one
	      SRP Update to the SRP registrar, it <bcp14>SHOULD</bcp14> combine
	      these into a single SRP Update,
	      when possible, subject to DNS message size limits and link-specific
          size limits (e.g., an IEEE 802.15.4 network will perform poorly when asked
          to deliver a packet larger than about 500 bytes).
	      If the updates do not fit into a single SRP Update,
	      then the SRP requester <bcp14>MUST</bcp14>
	      send subsequent SRP Updates sequentially:
	      Until an earlier SRP Update has been acknowledged,
	      the requester <bcp14>MUST NOT</bcp14>
	      send any subsequent SRP Updates.
	      If a configuration change occurs while an outstanding
	      SRP Update is in flight, the SRP registrar
	      <bcp14>MUST</bcp14> defer sending a new SRP Update for
	      that change until the previous SRP Update has completed.</t>
          </section>
        </section>
        <section anchor="how-to-secure" numbered="true" removeInRFC="false" toc="include" pn="section-3.2.4">
          <name slugifiedName="name-how-to-secure-it">How to Secure It</name>
          <t indent="0" pn="section-3.2.4-1">
            DNS Update messages can be secured using secret key transaction signatures (TSIG)
            <xref target="RFC8945" format="default" sectionFormat="of" derivedContent="RFC8945"/>.
            This approach uses a secret key shared between
            the DNS Update requester (which issues the update) and
            the authoritative DNS server (which authenticates it).
            This model does not work for automatic service registration.</t>
          <t indent="0" pn="section-3.2.4-2">
            The goal of securing the DNS‑SD Registration Protocol
            is to provide the best possible security given the constraint
            that service registration has to be automatic.  It is possible to layer more operational security on top of what we
            describe here, but FCFS Naming is already an improvement over the security of mDNS.</t>
          <section anchor="fcfs" numbered="true" removeInRFC="false" toc="include" pn="section-3.2.4.1">
            <name slugifiedName="name-fcfs-naming">FCFS Naming</name>
            <t indent="0" pn="section-3.2.4.1-1">
              FCFS Naming provides a limited degree of security. A server that registers its service using SRP
              is given ownership of a name for an extended period of time based on a lease
              specific to the key used to authenticate the SRP Update, which may be longer than the lease associated with the
              registered RRs.  As long as the registrar remembers the name
              and the public key corresponding to the private key used to register RRs on that name,
              no other SRP requester can add or update the
              information associated with that name.
              If the SRP requester fails to renew its
              service registration before the KEY lease expires
              (Section <xref target="RFC9664" section="4" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc9664#section-4" derivedContent="RFC9664"/>
              of the DNS Update Lease specification <xref target="RFC9664" format="default" sectionFormat="of" derivedContent="RFC9664"/>)
              its name is no longer protected.
              FCFS Naming is used to protect both the Service Description
              and the Host Description.</t>
          </section>
        </section>
        <section numbered="true" removeInRFC="false" toc="include" pn="section-3.2.5">
          <name slugifiedName="name-srp-requester-behavior">SRP Requester Behavior</name>
          <section numbered="true" removeInRFC="false" toc="include" pn="section-3.2.5.1">
            <name slugifiedName="name-public-private-key-pair-gen">Public/Private Key Pair Generation and Storage</name>
            <t indent="0" pn="section-3.2.5.1-1">
	      The requester generates a public/private key pair (<xref target="rsa" format="default" sectionFormat="of" derivedContent="Section 6.6"/>).
	      This key pair <bcp14>MUST</bcp14> be stored in stable
	      storage; if there is no writable stable storage on the SRP requester, the SRP requester <bcp14>MUST</bcp14> be preconfigured with a
	      public/private key pair in read-only storage.
	      This key pair <bcp14>MUST</bcp14> be unique to the device.
	      A device
	      with rewritable storage <bcp14>SHOULD</bcp14> retain this key indefinitely.  When the device changes ownership, it may be appropriate
	      for the former owner to erase the old key pair, which would then require the new owner to install a new
              one. Therefore, the SRP requester on the device <bcp14>SHOULD</bcp14> provide a mechanism to erase the key (for example, as the
              result of a "factory reset") and to generate a new key.</t>
            <t indent="0" pn="section-3.2.5.1-2">
	      Note that when a new key is generated, this will prevent the
	      device from registering with the name associated with the old
	      key in the same domain where it had previously registered. So,
	      implicit in the generation of a new key is the generation of a
	      new name; this can be done either proactively when regenerating
	      a key or only in the event that the SRP update produces a name conflict.
            </t>
            <t indent="0" pn="section-3.2.5.1-3">
	      The policy described here for managing keys assumes that the keys are only used for SRP. If a key that is used for SRP
	      is also used for other purposes, the policy described here is likely to be insufficient. The policy stated here is <bcp14>NOT RECOMMENDED</bcp14> in such a situation: a policy appropriate to the full set of uses for the key must be chosen. Specifying
	      such a policy is out of scope for this document.</t>
            <t indent="0" pn="section-3.2.5.1-4">
	      When sending DNS updates, the requester includes a KEY record containing the public portion of the key in each Host
	      Description Instruction and each Service Description Instruction.  Each KEY record <bcp14>MUST</bcp14> contain the same public key.
	      The update is signed using SIG(0), using the private key that corresponds to the public key in the KEY record.  The
	      lifetimes of the records in the update are
	      set using the EDNS(0) Update Lease option
	      <xref target="RFC9664" format="default" sectionFormat="of" derivedContent="RFC9664"/>.</t>
            <t indent="0" pn="section-3.2.5.1-5">
	      The format of the KEY resource record in the SRP Update is
	      defined in the IETF specification for DNSSEC Resource Records
	      <xref target="RFC4034" format="default" sectionFormat="of" derivedContent="RFC4034"/>. Because the KEY RR
	      used in SIG(0) is not a zone-signing key, the flags field in the KEY RR <bcp14>MUST</bcp14> be all zeroes.</t>
            <t indent="0" pn="section-3.2.5.1-6">
	      The KEY record in Service Description updates <bcp14>MAY</bcp14> be omitted for brevity; if it is omitted, the SRP registrar <bcp14>MUST</bcp14> behave
	      as if the same KEY record that is given for the Host Description is also given for each Service Description for which
	      no KEY record is provided.  Omitted KEY records are not used when computing the SIG(0) signature.</t>
          </section>
          <section numbered="true" removeInRFC="false" toc="include" pn="section-3.2.5.2">
            <name slugifiedName="name-name-conflict-handling">Name Conflict Handling</name>
            <t indent="0" pn="section-3.2.5.2-1">
	      "Add" operations for both Host Description RRs and
	      Service Description RRs can have names that result in name conflicts.
	      Service Discovery record "Add" operations
	      cannot have name conflicts.
	      If any Host Description or Service Description record
	      is found by the SRP registrar to have a conflict with an existing name, the registrar will respond to the SRP Update
	      with a YXDomain RCODE <xref target="RFC2136" format="default" sectionFormat="of" derivedContent="RFC2136"/>, indicating that the
	      desired name is already owned by a different SIG(0) key. In this case, the
	      SRP requester <bcp14>MUST</bcp14> choose a new name or give up.</t>
            <t indent="0" pn="section-3.2.5.2-2">
	      There is no specific requirement for how the SRP
	      requester should choose a new name. Typically,
	      however, the requester will append a number to the
	      preferred name. This number could be sequentially increasing or could be chosen randomly. One existing implementation
	      attempts several sequential numbers before choosing randomly.
	      For instance, it might try host.default.service.arpa.,
	      then host‑1.default.service.arpa.,
	      then host‑2.default.service.arpa.,
	      then host‑31773.default.service.arpa.</t>
          </section>
          <section anchor="lifetimes" numbered="true" removeInRFC="false" toc="include" pn="section-3.2.5.3">
            <name slugifiedName="name-record-lifetimes">Record Lifetimes</name>
            <t indent="0" pn="section-3.2.5.3-1">
	      The lifetime of the DNS‑SD PTR, SRV, A, AAAA, and TXT
	      records <xref target="RFC6763" format="default" sectionFormat="of" derivedContent="RFC6763"/> uses the LEASE field
	      of the Update Lease option and is typically set to two hours.  Thus, if a device is disconnected from the
	      network, it does not continue to appear for too long in the
	      user interfaces of devices looking for instances of that service type.</t>
            <t indent="0" pn="section-3.2.5.3-2">
	      The lifetime of the KEY records is set using the KEY-LEASE field
	      of the Update Lease Option and <bcp14>SHOULD</bcp14> be set to a
	      much longer time, typically 14 days.  The result being that even
	      though a device may be temporarily disconnected or powered off
	      -- disappearing from the network for a few days -- it makes a
	      claim on its name that lasts much longer.</t>
            <t indent="0" pn="section-3.2.5.3-3">Therefore, even if a device is disconnected from the network for a
	    few days, and its services are not available for that time, no
	    other device can come along and claim its name the moment it
	    disappears from the network. In the event that a device is
	    disconnected from the network and permanently discarded, then its
	    name is eventually cleaned up and made available for reuse.</t>
          </section>
          <section numbered="true" removeInRFC="false" toc="include" pn="section-3.2.5.4">
            <name slugifiedName="name-compression-in-srv-records">Compression in SRV Records</name>
            <t indent="0" pn="section-3.2.5.4-1">
	      Although the original SRV specification <xref target="RFC2782" format="default" sectionFormat="of" derivedContent="RFC2782"/>
	      requires that the target hostname in the RDATA of an SRV record
	      not be compressed in DNS queries and responses, an SRP requester
	      <bcp14>MAY</bcp14> compress the target in the SRV record,
	      since an SRP Update is neither a DNS query nor a DNS response.
	      The motivation for <em>not</em> compressing
	      is not stated in the SRV specification
	      but is assumed to be because a recursive resolver
	      (caching server) that does not understand the format of the
	      SRV record might store it as binary data without decoding a
	      compression pointer embedded with the target hostname field
	      and thus return nonsensical RDATA in response to a query.
	      This concern does not apply in the
	      case of SRP. An SRP registrar needs to understand SRV records in order to validate the SRP Update. Compression of the
	      target can save space in the SRP Update,
	      so we want SRP requesters to be able to
	      assume that the registrar will handle
	      this. Therefore, SRP registrars <bcp14>MUST</bcp14> support compression of SRV RR targets.</t>
            <t indent="0" pn="section-3.2.5.4-2">
	      Note that this document does not update
	      the SRV specification <xref target="RFC2782" format="default" sectionFormat="of" derivedContent="RFC2782"/>:
	      Authoritative DNS servers still <bcp14>MUST NOT</bcp14> compress SRV record targets.
	      The requirement to accept compressed SRV records in updates only applies to SRP
	      registrars. SRP registrars that are also authoritative DNS servers still
	      <bcp14>MUST NOT</bcp14> compress SRV record targets in DNS responses.
	      We note also that Multicast DNS <xref target="RFC6762" format="default" sectionFormat="of" derivedContent="RFC6762"/>
	      similarly compresses SRV records in mDNS messages.</t>
            <t indent="0" pn="section-3.2.5.4-3">
	      In addition, we note that an implementer of an SRP requester
	      might update existing code that creates SRV records or
	      compresses DNS messages so that it compresses the target of an
	      SRV record. Care must be taken if such code is used both in
	      requesters and in authoritative DNS servers that the code only
	      compresses SRV targets in the case where a requester is
	      generating an SRP Update.</t>
          </section>
          <section anchor="remove" numbered="true" removeInRFC="false" toc="include" pn="section-3.2.5.5">
            <name slugifiedName="name-removing-published-services">Removing Published Services</name>
            <section anchor="zero-lease" numbered="true" removeInRFC="false" toc="exclude" pn="section-3.2.5.5.1">
              <name slugifiedName="name-removing-all-published-serv">Removing All Published Services</name>
              <t indent="0" pn="section-3.2.5.5.1-1">
		To remove all the services registered to a particular hostname,
		the SRP requester transmits an SRP Update for that hostname
		with an Update Lease option that has a LEASE value of zero.
		The SRP Update <bcp14>MUST</bcp14> contain
		exactly one Host Description Instruction
		that contains exactly one "Delete All RRsets From A Name" instruction for the hostname
		and no "Add to an RRSet" instructions for that hostname.
		If the registration is to be permanently removed,
		KEY-LEASE <bcp14>SHOULD</bcp14> also be zero. Otherwise, it <bcp14>SHOULD</bcp14> be set to the same value it had previously; this holds the name
		in reserve for when the SRP requester is once again able to provide the service.</t>
              <t indent="0" pn="section-3.2.5.5.1-2">
		This method of removing services is intended for the case
		where the requester is going offline and does not want
		any of its services to continue being advertised.
              </t>
              <t indent="0" pn="section-3.2.5.5.1-3">To support this, when removing a hostname, an SRP registrar
	      <bcp14>MUST</bcp14> remove all service instances pointing to
	      that hostname and all Service Discovery PTR records pointing to
	      those service instances, even if the SRP requester doesn't list
	      them explicitly. If the KEY lease time is nonzero, the SRP
	      registrar <bcp14>MUST NOT</bcp14> delete the KEY records for
	      these service instances.
              </t>
            </section>
            <section numbered="true" removeInRFC="false" toc="exclude" pn="section-3.2.5.5.2">
              <name slugifiedName="name-removing-some-published-ser">Removing Some Published Services</name>
              <t indent="0" pn="section-3.2.5.5.2-1">
		In some use cases, a requester may need to remove a
		specific service instance without removing its other services.
		For example, a device may
		shut down its remote screen access (_rfb._tcp) service
		while retaining its command-line login (_ssh._tcp) service.
		This can be accomplished in one of two ways:</t>
              <ol type="1" spacing="normal" indent="adaptive" start="1" pn="section-3.2.5.5.2-2">
		  <li pn="section-3.2.5.5.2-2.1" derivedCounter="1.">To simply remove a specific service instance, the requester sends
		  a valid SRP Update with a Service Description Instruction
		  (<xref target="servdesc" format="default" sectionFormat="of" derivedContent="Section 3.3.1.2"/>) containing a single "Delete All
		  RRsets From A Name" update to the service instance name.
		  The SRP Update <bcp14>SHOULD</bcp14> include Service
		  Discovery Instructions (<xref target="servdis" format="default" sectionFormat="of" derivedContent="Section 3.3.1.1"/>) consisting
		  of "Delete An RR From An RRset" updates <xref target="RFC2136" format="default" sectionFormat="of" derivedContent="RFC2136"/> that delete any Service Discovery PTR
		  records whose target is the service instance name.  However,
		  even in the absence of such Service Discovery Instructions,
		  the SRP registrar <bcp14>MUST</bcp14> delete any Service
		  Discovery PTR records that point to the deleted service
		  instance name.
		</li>
                <li pn="section-3.2.5.5.2-2.2" derivedCounter="2.">When deleting one service instance while simultaneously
		creating a new service instance with a different service
		instance name, an alternative is to perform both operations
		using a single SRP Update.  In this case, the old service is
		deleted as in the first alternative.  The new service is
		added, just as it would be in an update that wasn't deleting
		the old service. Because both the removal of the old service
		and the add of the new service consist of a valid Service
		Discovery Instruction and a valid Service Description
		Instruction, the update as a whole is a valid SRP Update and
		will result in the old service being removed and the new one
		added; or, to put it differently, the SRP Update will result
		in the old service being replaced by the new service.
		</li>
              </ol>
              <t indent="0" pn="section-3.2.5.5.2-3">
		It is perhaps worth noting that if a service is being updated without
		the service instance name changing (for example, when only the target
		port in the SRV record is being updated), then that SRP Update will
		look very much like the second alternative above.
		The PTR record in the Service Discovery Instruction will be the same for
		both the "Delete An RR From An RRset" update and the "Add To An RRset" update
		<xref target="RFC2136" format="default" sectionFormat="of" derivedContent="RFC2136"/>.
		Since the removal of the old service and the addition
		of the new service are both valid SRP Update operations,
		the combined operation is a valid SRP Update operation.
		The SRP registrar does not need to include code to
		recognize this special case and does not need to
		take any special actions to handle it correctly.
              </t>
              <t indent="0" pn="section-3.2.5.5.2-4">
		Whichever of these two alternatives is used, the hostname lease
		will be updated with the lease time provided in the SRP update.
		In neither of these cases is it permissible to delete the hostname.
		All services must point to a hostname. If a hostname
		is to be deleted, this must be done using the method
		described in <xref target="zero-lease" format="default" sectionFormat="of" derivedContent="Section 3.2.5.5.1"/>, which deletes the
		hostname and all services that have that hostname as their target.
              </t>
            </section>
          </section>
        </section>
      </section>
      <section anchor="server_behavior" numbered="true" removeInRFC="false" toc="include" pn="section-3.3">
        <name slugifiedName="name-validation-and-processing-o">Validation and Processing of SRP Updates</name>
        <section anchor="add_validation" numbered="true" removeInRFC="false" toc="include" pn="section-3.3.1">
          <name slugifiedName="name-validation-of-dns-update-ad">Validation of DNS Update Add and Delete RRs</name>
          <t indent="0" pn="section-3.3.1-1">
	    The SRP registrar first validates that the DNS Update message is a syntactically and semantically valid DNS Update message according to
	    the usual DNS Update rules <xref target="RFC2136" format="default" sectionFormat="of" derivedContent="RFC2136"/>.</t>
          <t indent="0" pn="section-3.3.1-2">
	    SRP Updates consist of a set of <em>instructions</em>
	    that together add or remove one or more services.
	    Each <em>instruction</em> consists of
	    one or more delete update(s), or one or more add update(s),
	    or some combination of both delete updates and add updates.</t>
          <t indent="0" pn="section-3.3.1-3">
	    The SRP registrar checks each instruction in the SRP Update to see that it is either a Service Discovery Instruction, a
	    Service Description Instruction, or a Host Description Instruction.  Order matters in DNS updates.  Specifically,
	    deletes must precede adds for records that the deletes would affect; otherwise, the add will have no effect.  This is the
	    only ordering constraint: Aside from this constraint, updates may appear in whatever order is convenient when
	    constructing the update.</t>
          <t indent="0" pn="section-3.3.1-4">
	    Because the SRP Update is a DNS update, it <bcp14>MUST</bcp14> contain a single entry in the Zone Section (what would be the Question Section in a DNS query or response) that indicates the zone to be updated. Every delete and update in an SRP Update <bcp14>MUST</bcp14> be within the zone that is specified for the SRP Update.</t>
          <section anchor="servdis" numbered="true" removeInRFC="false" toc="include" pn="section-3.3.1.1">
            <name slugifiedName="name-service-discovery-instructi">Service Discovery Instruction</name>
            <t indent="0" pn="section-3.3.1.1-1">An instruction is a Service Discovery Instruction if it:</t>
            <ul spacing="compact" bare="false" empty="false" indent="3" pn="section-3.3.1.1-2">
              <li pn="section-3.3.1.1-2.1">consists of
	      exactly one "Add To An RRSet" or
	      exactly one "Delete An RR From An RRSet"
	      RR update
	      (Section <xref target="RFC2136" section="2.5" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc2136#section-2.5" derivedContent="RFC2136"/>
	      of the DNS Update specification <xref target="RFC2136" format="default" sectionFormat="of" derivedContent="RFC2136"/>),</li>
              <li pn="section-3.3.1.1-2.2">which updates a PTR RR,</li>
              <li pn="section-3.3.1.1-2.3">the target of which is a service instance name</li>
              <li pn="section-3.3.1.1-2.4">
                <t indent="0" pn="section-3.3.1.1-2.4.1">for which name a Service Description Instruction is present in the SRP Update, and:</t>
                <ul spacing="compact" bare="false" empty="false" indent="3" pn="section-3.3.1.1-2.4.2">
                  <li pn="section-3.3.1.1-2.4.2.1">if the Service Discovery Instruction is an "Add To An RRSet" instruction,
		  that Service Description Instruction contains
		  a "Delete All RRsets From A Name" instruction for that service instance name
		  followed by "Add To An RRset" instructions
		  for the SRV and TXT records describing that service; or</li>
                  <li pn="section-3.3.1.1-2.4.2.2">if the Service Discovery Instruction is a "Delete An RR
		  From An RRSet" instruction, that Service Description
		  Instruction contains a "Delete All RRsets From A Name"
		  instruction for that service instance name with no following
		  "Add To An RRset" instructions for the SRV and TXT records
		  describing that service. An "Add to an RRset" instruction
		  for the KEY record here is allowed but not
		  implicit.</li>
                </ul>
              </li>
            </ul>
            <t indent="0" pn="section-3.3.1.1-3">
	      Note that there can be more than one Service Discovery
	      Instruction for the same service name
	      (the owner name of the Service Discovery PTR record)
	      if the SRP requester is advertising more than one instance
	      of the same service type or is changing the target of a PTR RR.
	      When subtypes are being used
	      (Section <xref target="RFC6763" section="7.1" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc6763#section-7.1" derivedContent="RFC6763"/>
	      of the DNS‑SD specification <xref target="RFC6763" format="default" sectionFormat="of" derivedContent="RFC6763"/>),
	      each subtype is a separate Service Discovery Instruction.
	      For each such PTR RR add or delete, the above constraints must be met.</t>
          </section>
          <section anchor="servdesc" numbered="true" removeInRFC="false" toc="include" pn="section-3.3.1.2">
            <name slugifiedName="name-service-description-instruc">Service Description Instruction</name>
            <t indent="0" pn="section-3.3.1.2-1">An instruction is a Service Description Instruction if, for the
            given service instance name, all of the following are true:</t>
            <ul spacing="compact" bare="false" empty="false" indent="3" pn="section-3.3.1.2-2">
              <li pn="section-3.3.1.2-2.1">
		It contains exactly one "Delete All RRsets From A Name" update for the service instance name
		(Section <xref target="RFC2136" section="2.5.3" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc2136#section-2.5.3" derivedContent="RFC2136"/>
		of the DNS Update specification <xref target="RFC2136" format="default" sectionFormat="of" derivedContent="RFC2136"/>).</li>
              <li pn="section-3.3.1.2-2.2">
		It contains zero or one "Add To An RRset" KEY RRs that, if present, contains the public key corresponding to the private key
		that was used to sign the message (if present, the KEY RR <bcp14>MUST</bcp14> match the KEY RR given in the Host Description).</li>
              <li pn="section-3.3.1.2-2.3">
		It contains zero or one "Add To An RRset" SRV RR.</li>
              <li pn="section-3.3.1.2-2.4">
		If an "Add To An RRSet" update for an SRV RR is present,
		there <bcp14>MUST</bcp14> be at least one "Add To An RRset"
		update for the corresponding TXT RR, and
		the target of the SRV RR <bcp14>MUST</bcp14> be the hostname given in the Host Description Instruction in
		the SRP Update, or</li>
              <li pn="section-3.3.1.2-2.5">
		If there is no "Add To An RRset" update for an SRV RR, then
		there <bcp14>MUST</bcp14> be no "Add To An RRset" updates for the corresponding TXT RR,
		and either:</li>
              <li pn="section-3.3.1.2-2.6">
                <ul spacing="compact" bare="false" empty="false" indent="3" pn="section-3.3.1.2-2.6.1">
                  <li pn="section-3.3.1.2-2.6.1.1">the name to which the "Delete All RRsets From A Name" applies does not exist, or</li>
                  <li pn="section-3.3.1.2-2.6.1.2">there is an existing KEY RR on that name that matches the key with which the SRP Update was
		  signed.</li>
                </ul>
              </li>
            </ul>
            <t indent="0" pn="section-3.3.1.2-3">Service Description Instructions do not add any other resource records.</t>
            <t indent="0" pn="section-3.3.1.2-4">An SRP registrar <bcp14>MUST</bcp14> correctly handle compressed names in the SRV target.</t>
          </section>
          <section anchor="hdi" numbered="true" removeInRFC="false" toc="include" pn="section-3.3.1.3">
            <name slugifiedName="name-host-description-instructio">Host Description Instruction</name>
            <t indent="0" pn="section-3.3.1.3-1">Every SRP Update always contains exactly one Host Description Instruction.</t>
            <t indent="0" pn="section-3.3.1.3-2">An instruction is a Host Description Instruction if, for the appropriate hostname, it contains the following:</t>
            <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-3.3.1.3-3">
              <li pn="section-3.3.1.3-3.1">
		exactly one "Delete All RRsets From A Name" RR</li>
              <li pn="section-3.3.1.3-3.2">
		exactly one "Add To An RRset" RR that adds a KEY RR that
		contains the public key corresponding to the private key that
		was used to sign the message</li>
              <li pn="section-3.3.1.3-3.3">
		zero "Add To An RRset" operations (in the case of deleting a registration)
		or one or more "Add To An RRset" RRs of type A and/or AAAA
		(in the case of creating or updating a registration)</li>
            </ul>
            <t indent="0" pn="section-3.3.1.3-4">
	      Host Description Instructions do not add any other resource records.</t>
            <t indent="0" pn="section-3.3.1.3-5">
	      A and/or AAAA records that are not of sufficient scope to be
	      validly published in a DNS zone <bcp14>MAY</bcp14> be ignored by
	      the SRP registrar, which could result in a Host Description
	      effectively containing zero reachable addresses even when it
	      contains one or more addresses.</t>
            <t indent="0" pn="section-3.3.1.3-6">
	      For example, if an IPv4 link-local address <xref target="RFC3927" format="default" sectionFormat="of" derivedContent="RFC3927"/>
	      or an IPv6 link-local address <xref target="RFC4862" format="default" sectionFormat="of" derivedContent="RFC4862"/>
	      is provided by the SRP requester, the SRP
	      registrar could elect not to publish this in a DNS zone.
	      However, in some situations, the registrar might make the records
	      available through a mechanism such as an advertising proxy only on the specific link from which the SRP Update
	      originated. In such a situation, locally scoped records are still valid.</t>
          </section>
        </section>
        <section anchor="validation" numbered="true" removeInRFC="false" toc="include" pn="section-3.3.2">
          <name slugifiedName="name-valid-srp-update-requiremen">Valid SRP Update Requirements</name>
          <t indent="0" pn="section-3.3.2-1">
	    An SRP Update <bcp14>MUST</bcp14> contain exactly one Host Description Instruction.
		Multiple Service Discovery updates and Service Description updates
		may be combined into a single SRP Update
		along with a single Host Description update,
		as described in <xref target="how" format="default" sectionFormat="of" derivedContent="Section 3.2.3"/>.
	    A DNS Update message that contains any additional
	    adds or deletes that cannot be identified as Service Discovery, Service Description, or Host Description Instructions is
	    not an SRP Update. A DNS update that contains any prerequisites is not an SRP Update.</t>
          <t indent="0" pn="section-3.3.2-2">An SRP Update <bcp14>MUST</bcp14> include an EDNS(0) Update Lease option
	    <xref target="RFC9664" format="default" sectionFormat="of" derivedContent="RFC9664"/>.
	    The LEASE time specified in the Update Lease
	    option <bcp14>MUST</bcp14> be less than
	    or equal to the KEY-LEASE time. A DNS update that does not include the Update Lease option, or that includes a
	    KEY-LEASE value that is less than the LEASE value, is not an SRP Update.</t>
          <t indent="0" pn="section-3.3.2-3">When an SRP registrar receives a DNS Update message that is not an SRP
	  update, it <bcp14>MAY</bcp14> process the update as normal DNS Update
	  <xref target="RFC2136" format="default" sectionFormat="of" derivedContent="RFC2136"/>, including
	  access control checks and constraint checks, if supported. Otherwise,
	  the SRP registrar <bcp14>MUST</bcp14> reject the DNS Update with the
	  Refused RCODE.</t>
          <t indent="0" pn="section-3.3.2-4">
	    If the definitions of each of these instructions are followed
	    carefully and the update requirements are validated correctly,
	    many DNS Update messages that look very much like SRP Updates
	    nevertheless will fail to validate.  For example, a DNS update
	    that contains an "Add To An RRset" instruction for a Service Name
	    and an "Add to an RRset" instruction for a service instance name
	    where the PTR record added to the Service Name does not reference
	    the service instance name is not a valid SRP Update but may be a
	    valid DNS Update.</t>
        </section>
        <section numbered="true" removeInRFC="false" toc="include" pn="section-3.3.3">
          <name slugifiedName="name-fcfs-name-and-signature-val">FCFS Name and Signature Validation</name>
          <t indent="0" pn="section-3.3.3-1">
	    Assuming that the SRP registrar has confirmed that a DNS Update message
	    is a valid SRP Update (<xref target="validation" format="default" sectionFormat="of" derivedContent="Section 3.3.2"/>), it
	    then checks that the name in the Host Description Instruction exists in the zone being updated.  If so, then the registrar checks to see if the KEY
	    record on that name is the same as the KEY record in the Host Description Instruction.  The registrar performs the same
	    check for the KEY records in any Service Description Instructions.  For KEY records that were omitted from Service
	    Description Instructions, the KEY from the Host Description Instruction is used.  If any existing KEY record
	    corresponding to a KEY record in the SRP Update does not match the KEY record in the SRP Update (whether provided
	    or taken from the Host Description Instruction), then the SRP registrar
	    <bcp14>MUST</bcp14> reject the SRP Update with a YXDomain
	    RCODE indicating that the desired name is already owned by a different SIG(0) key.
	    This informs the SRP requester that it should select a different name and try again.</t>
          <t indent="0" pn="section-3.3.3-2">
	    If the SRP Update is not in conflict with existing data in the zone being updated, the SRP registrar validates the SRP Update using SIG(0) against the public key in the KEY record of the Host
	    Description Instruction.  If the validation fails,
	    the SRP Update is malformed, and the registrar
	    <bcp14>MUST</bcp14> reject the SRP Update with the Refused RCODE.
	    Otherwise, the SRP Update is considered valid and authentic and
	    is processed as for a normal DNS Update <xref target="RFC2136" format="default" sectionFormat="of" derivedContent="RFC2136"/>.</t>
          <t indent="0" pn="section-3.3.3-3">
	    KEY record updates omitted from Service Description Instruction(s) are processed as if they had been explicitly present.
	    After the SRP Update has been applied, every Service Description that is updated <bcp14>MUST</bcp14> have a KEY RR, which <bcp14>MUST</bcp14> have the
	    same value as the KEY RR that is present in the Host Description to which the Service Description refers.</t>
          <t indent="0" pn="section-3.3.3-4">
	    The IETF specification for
	    DNSSEC Resource Records <xref target="RFC4034" format="default" sectionFormat="of" derivedContent="RFC4034"/>
	    states that the flags field in the KEY RR
	    <bcp14>MUST</bcp14> be zero except for bit 7, which can
	    be one in the case of a zone key.
	    SRP requesters implementing this version of the SRP specification
	    <bcp14>MUST</bcp14> set the flags field in the KEY RR to all zeroes.
	    SRP registrars implementing this version of the SRP specification
	    <bcp14>MUST</bcp14> accept and store the flags field in the KEY RR
	    as received, without checking or modifying its value.</t>
        </section>
        <section numbered="true" removeInRFC="false" toc="include" pn="section-3.3.4">
          <name slugifiedName="name-handling-of-service-subtype">Handling of Service Subtypes</name>
          <t indent="0" pn="section-3.3.4-1">
	    SRP registrars <bcp14>MUST</bcp14> treat the update instructions for a service type and all its subtypes as atomic. That is, when a
	    service and its subtypes are being updated, whatever information appears in the SRP Update is the entirety of
	    information about that service and its subtypes. If any subtype appeared in a previous update but does not appear in
	    the current update, then the SRP registrar <bcp14>MUST</bcp14> remove that subtype.
          </t>
          <t indent="0" pn="section-3.3.4-2">
	    There is intentionally no mechanism for deleting a single subtype
	    individually. A delete of a service deletes all of its subtypes.
	    To delete a single subtype individually, an SRP Update must
	    be constructed that contains the service type and all subtypes
	    for that service except for the subtype(s) to be deleted.
          </t>
        </section>
        <section numbered="true" removeInRFC="false" toc="include" pn="section-3.3.5">
          <name slugifiedName="name-srp-update-response">SRP Update Response</name>
          <t indent="0" pn="section-3.3.5-1">
	    The status that is returned depends on the result of processing the update and can be either NoError, ServFail, Refused,
	    or YXDomain. All other possible outcomes will already have been accounted for when applying the constraints that
	    qualify the update as an SRP Update. The meanings of these responses are explained in
	    Section <xref target="RFC2136" section="2.2" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc2136#section-2.2" derivedContent="RFC2136"/>
	    of the DNS Update specification <xref target="RFC2136" format="default" sectionFormat="of" derivedContent="RFC2136"/>.</t>
          <t indent="0" pn="section-3.3.5-2">
	    In the case of a response other than NoError,
	    Section <xref target="RFC2136" section="3.8" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc2136#section-3.8" derivedContent="RFC2136"/>
	    of the DNS Update specification <xref target="RFC2136" format="default" sectionFormat="of" derivedContent="RFC2136"/>
	    states that
	    the authoritative DNS server is permitted
            to respond either with no RRs or to copy the RRs
            sent by the DNS Update client into the response.
            The SRP requester <bcp14>MUST NOT</bcp14> attempt
	    to validate any RRs that are included in the response. It is possible that a future SRP extension may include per-RR
	    indications as to why the update failed, but
	    at the time of writing this is not specified.
	    So, if an SRP requester were to attempt to validate
            the RRs in the response, it might reject such a response, since it would contain RRs but probably not a set of RRs
	    identical to what was sent in the SRP Update.</t>
        </section>
        <section numbered="true" removeInRFC="false" toc="include" pn="section-3.3.6">
          <name slugifiedName="name-optional-behavior">Optional Behavior</name>
          <t indent="0" pn="section-3.3.6-1">
	    The SRP registrar <bcp14>MAY</bcp14> add a Reverse Mapping PTR record
	    (described for IPv4 in Section 
	    <xref target="RFC1035" section="3.5" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc1035#section-3.5" derivedContent="RFC1035"/>
	    of the DNS specification <xref target="RFC1035" format="default" sectionFormat="of" derivedContent="RFC1035"/>
	    and for IPv6 in Section 
	    <xref target="RFC3596" section="2.5" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc3596#section-2.5" derivedContent="RFC3596"/>
	    of the later document updating DNS for IPv6 <xref target="RFC3596" format="default" sectionFormat="of" derivedContent="RFC3596"/>) that corresponds to the Host Description.
	    This is optional: The reverse mapping PTR record serves no
	    essential protocol function. One reason to provide reverse
	    mappings is that they can be used to annotate logs and network
	    packet traces. In order for the registrar to do a reverse mapping
	    update, it must be authoritative for the zone that would need to
	    be updated or have credentials to do the update.  The SRP
	    requester <bcp14>MAY</bcp14> also do a reverse mapping update if
	    it has credentials to do so.</t>
          <t indent="0" pn="section-3.3.6-2">
	    The SRP registrar <bcp14>MAY</bcp14> apply additional criteria when accepting updates.  In some networks, it may be possible to do
	    out-of-band registration of keys and only accept updates from preregistered keys.  In this case, an update for a key
	    that has not been registered <bcp14>SHOULD</bcp14> be rejected with the Refused RCODE.
	    When use of managed keys is desired,
	    there are at least two benefits to doing this in conjunction with SRP
	    rather than simply performing traditional DNS Updates using SIG(0) keys:</t>
          <ol indent="adaptive" spacing="normal" start="1" type="1" pn="section-3.3.6-3"><li pn="section-3.3.6-3.1" derivedCounter="1.">The same
	    over-the-air registration protocol is used in both cases,
	    so both use cases can be addressed by the same SRP requester
	    implementation.</li>
            <li pn="section-3.3.6-3.2" derivedCounter="2.">The Service Registration Protocol includes
	    maintenance functionality not present with normal DNS
	    updates.</li>
          </ol>
          <t indent="0" pn="section-3.3.6-4">
	    Note that the semantics of using SRP in this way
	    are different from the semantics of typical
	    implementations of DNS Update. The KEY used
	    to sign the SRP Update only allows the SRP requester to update records that refer to its Host Description.
	    Implementations of traditional DNS Update
	    <xref target="RFC2136" format="default" sectionFormat="of" derivedContent="RFC2136"/> do not normally provide
	    a way to enforce a constraint of this type.</t>
          <t indent="0" pn="section-3.3.6-5">
	    The SRP registrar could also have a dictionary of names or name patterns that are not permitted.  If such a list is used,
	    updates for service instance names that match entries in the dictionary are rejected with a Refused RCODE.</t>
        </section>
      </section>
    </section>
    <section numbered="true" removeInRFC="false" toc="include" pn="section-4">
      <name slugifiedName="name-ttl-consistency">TTL Consistency</name>
      <t indent="0" pn="section-4-1">
	All RRs within an RRset are required to have the same TTL
	(required by
	Section <xref target="RFC2181" section="5.2" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc2181#section-5.2" derivedContent="RFC2181"/>
	of the DNS Clarifications document <xref target="RFC2181" format="default" sectionFormat="of" derivedContent="RFC2181"/>).
	In order to avoid inconsistencies, SRP places restrictions on TTLs sent by requesters and requires that SRP registrars enforce
	consistency.</t>
      <t indent="0" pn="section-4-2">
	Requesters sending SRP Updates <bcp14>MUST</bcp14> use consistent
	TTLs in all RRs within each RRset contained within an SRP Update.</t>
      <t indent="0" pn="section-4-3">
	SRP registrars <bcp14>MUST</bcp14> check that the TTLs for all RRs
	within each RRset contained within an SRP Update are the same.
	If they are not, the SRP
	update <bcp14>MUST</bcp14> be rejected with a Refused RCODE.</t>
      <t indent="0" pn="section-4-4">
	Additionally, when adding RRs to an RRset (for example, when processing Service Discovery records), the SRP registrar <bcp14>MUST</bcp14> use the
	same TTL on all RRs in the RRset.  How this consistency is enforced is up to the implementation.</t>
      <t indent="0" pn="section-4-5">
	TTLs sent in SRP Updates are advisory: they indicate the SRP requester's guess as to what a good TTL would be.  SRP registrars may
	override these TTLs.  SRP registrars <bcp14>SHOULD</bcp14> ensure that TTLs are reasonable: neither too long nor too short.  The TTL <bcp14>SHOULD NOT</bcp14>
	ever be longer than the lease time (<xref target="stale" format="default" sectionFormat="of" derivedContent="Section 5.1"/>).  Shorter TTLs will result in more frequent data refreshes;
	this increases latency on the DNS‑SD client side, increases
	load on any caching resolvers and on the authoritative DNS server,
	and also increases network load, which may be an issue for CNNs.  Longer TTLs will increase the likelihood
	that data in caches will be stale.  TTL minimums and maximums <bcp14>SHOULD</bcp14> be configurable by the operator of the SRP registrar.
      </t>
    </section>
    <section anchor="maintenance" numbered="true" removeInRFC="false" toc="include" pn="section-5">
      <name slugifiedName="name-maintenance">Maintenance</name>
      <section anchor="stale" numbered="true" removeInRFC="false" toc="include" pn="section-5.1">
        <name slugifiedName="name-cleaning-up-stale-data">Cleaning Up Stale Data</name>
        <t indent="0" pn="section-5.1-1">Because the DNS‑SD Service Registration Protocol
          is automatic and not managed by humans,
          some additional bookkeeping is required.  When an update is constructed by the SRP requester,
          it <bcp14>MUST</bcp14> include an EDNS(0) Update Lease Option <xref target="RFC9664" format="default" sectionFormat="of" derivedContent="RFC9664"/>.
          The Update Lease Option contains two lease times: the Lease Time and the KEY
          Lease Time.</t>
        <t indent="0" pn="section-5.1-2">Similar to DHCP leases <xref target="RFC2131" format="default" sectionFormat="of" derivedContent="RFC2131"/>,
          these leases are promises from the SRP requester that it will
          send a new update for the service registration before the
          lease time expires.
          The Lease time is chosen to represent the duration after the update
          during which the registered records other than the KEY record
          can be assumed to be valid.
          The KEY lease time represents the duration after the update
          during which the KEY record can be assumed to be valid.
          The reasoning behind the different lease times is discussed in
          Sections <xref target="fcfs" format="counter" sectionFormat="of" derivedContent="3.2.4.1"/> and
          <xref target="lifetimes" format="counter" sectionFormat="of" derivedContent="3.2.5.3"/>.</t>
        <t indent="0" pn="section-5.1-3">SRP registrars may be configured with limits for these values.
          At the time of writing, a default limit of two hours for
          the Lease and 14 days for the SIG(0) KEY are thought to be good choices.  Devices with limited
          battery that wake infrequently are likely to request longer leases; registrars that support such devices may need to set
          higher limits.  SRP requesters that are going to
          continue to use names on which they hold leases
          <bcp14>SHOULD</bcp14> refresh them well before
          the lease ends in case the registrar is
          temporarily unavailable or under heavy load.</t>
        <t indent="0" pn="section-5.1-4">
	  The lease time applies specifically to the hostname.
	  All service instances, and all service entries for such service
	  instances, depend on the hostname. When the lease on a
	  hostname expires, the hostname and all services that
	  reference it <bcp14>MUST</bcp14> be removed at the same
	  time: It is never valid for a service instance to remain
	  when the hostname it references has been removed.
	  If the KEY record for the hostname is to remain, the KEY record
	  for any services that reference it <bcp14>MUST</bcp14> also
	  remain. However, the Service Discovery PTR record <bcp14>MUST</bcp14>
	  be removed since it has no key associated with it and since it
	  is never valid to have a Service Discovery PTR record for which
	  there is no service instance on the target of the PTR record.
        </t>
        <t indent="0" pn="section-5.1-5">
	  SRP registrars <bcp14>MUST</bcp14> also track a lease time per service instance. The reason being that a requester may
	  re-register a hostname with a different set of services and
	  not remember that some different service instance had previously
	  been registered. In this case, when that service instance lease expires, the SRP registrar <bcp14>MUST</bcp14> remove the service
	  instance,
	  and any associated Service Discovery PTR records pointing to that service instance,
	  (although the KEY record for the service instance
	  <bcp14>SHOULD</bcp14> be retained until the
	  KEY lease on that service
	  expires).
	  This is beneficial because it avoids stale services continuing
	  to be advertised after the SRP requester has forgotten about them.
        </t>
        <t indent="0" pn="section-5.1-6">The SRP registrar <bcp14>MUST</bcp14> include an EDNS(0) Update
	Lease option in the response.  The requester <bcp14>MUST</bcp14> check
	for the EDNS(0) Update Lease option in the response, and when deciding
	when to renew its registration the requester <bcp14>MUST</bcp14> use
	the lease times from the Update Lease option in the response in place
	of the lease times that it originally requested from the registrar.
	The times may be shorter or longer than those specified in the SRP
	Update. The SRP requester must honor them in either case.</t>
        <t indent="0" pn="section-5.1-7">SRP requesters <bcp14>SHOULD</bcp14> assume that each lease ends N
	seconds after the update was first transmitted (where N is the granted lease
	duration).  SRP registrars <bcp14>SHOULD</bcp14> assume that each lease
	ends N seconds after the update that was successfully processed was
	received.  Because the registrar will always receive the update after
	the SRP requester sent it, this avoids the possibility of
	a race condition where the SRP registrar prematurely removes
	a service when the SRP requester thinks the lease has not yet expired.
	In addition, the SRP requester <bcp14>MUST</bcp14> begin attempting to renew
	its lease in advance of the expected expiration time, as required
	by the DNS Update Lease specification <xref target="RFC9664" format="default" sectionFormat="of" derivedContent="RFC9664"/>,
	to accommodate the situation where the clocks on the SRP requester
	and the SRP registrar do not run at precisely the same rate.</t>
        <t indent="0" pn="section-5.1-8">SRP registrars <bcp14>MUST</bcp14> reject updates that do not
	include an EDNS(0) Update Lease option.  DNS authoritative servers
	that allow both SRP and non-SRP DNS updates <bcp14>MAY</bcp14> accept
	updates that don't include leases, but they <bcp14>SHOULD</bcp14>
	differentiate between SRP Updates and other updates and
	<bcp14>MUST</bcp14> reject updates that would otherwise be SRP Updates
	if they do not include leases.</t>
        <t indent="0" pn="section-5.1-9">The function of Lease times and the
	function of TTLs are completely different. On an
	authoritative DNS server, the TTL on a resource record is a
	constant. Whenever that RR is served in a DNS response, the TTL value
	sent in the answer is the same.  The lease time is never sent as a
	TTL; its sole purpose is to determine when the authoritative DNS
	server will delete stale records.  It is not an error to send a DNS
	response with a TTL of M when the remaining time on the lease is
	less than M.</t>
      </section>
    </section>
    <section numbered="true" removeInRFC="false" toc="include" pn="section-6">
      <name slugifiedName="name-security-considerations">Security Considerations</name>
      <section anchor="source_validation" numbered="true" removeInRFC="false" toc="include" pn="section-6.1">
        <name slugifiedName="name-source-validation">Source Validation</name>
        <t indent="0" pn="section-6.1-1">SRP Updates have no authorization semantics other than
	  "First Come, First Served" (FCFS).
	  Thus, if an attacker from outside the administrative
	  domain of the SRP registrar knows the registrar's IP address, it can, in principle, send updates to the registrar
	  that will be processed successfully.   Therefore, SRP registrars <bcp14>SHOULD</bcp14> be configured to reject updates
	  from source addresses outside of the administrative domain of the registrar.</t>
        <t indent="0" pn="section-6.1-2">For TCP updates, the initial SYN-SYN+ACK handshake prevents
	  updates being forged by an off-path attacker.  In order to
	  ensure that this handshake happens, SRP registrars relying on three-way-handshake validation <bcp14>MUST NOT</bcp14> accept TCP Fast Open payloads
	  <xref target="RFC7413" format="default" sectionFormat="of" derivedContent="RFC7413"/>.
	  If the network infrastructure allows it, an SRP registrar
	  <bcp14>MAY</bcp14> accept TCP Fast Open payloads if all such packets
	  are validated along the path, and the network is able to reject this type of spoofing at all ingress points.</t>
        <t indent="0" pn="section-6.1-3">For UDP updates from CNN devices, spoofing would have to be prevented with appropriate source address filtering
	  on routers <xref target="RFC2827" format="default" sectionFormat="of" derivedContent="RFC2827"/>.
	  This would ordinarily be accomplished by measures such as those described in
	  Section <xref target="RFC7084" section="4.5" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc7084#section-4.5" derivedContent="RFC7084"/>
	  of the IPv6 CE Router Requirements document <xref target="RFC7084" format="default" sectionFormat="of" derivedContent="RFC7084"/>.
	  For example, a stub router <xref target="I-D.ietf-snac-simple" format="default" sectionFormat="of" derivedContent="SNAC-SIMPLE"/>
	  for a CNN might only accept UDP updates from source addresses known to be on-link on that stub network and might
	  further validate that the UDP update was actually received on the stub network interface and not the interface connected to
	  the adjacent infrastructure link.</t>
      </section>
      <section numbered="true" removeInRFC="false" toc="include" pn="section-6.2">
        <name slugifiedName="name-other-dns-updates">Other DNS Updates</name>
        <t indent="0" pn="section-6.2-1">Note that these rules only apply to the validation of SRP Updates.
	  An authoritative DNS server that accepts updates from SRP
	  requesters may also accept other DNS Update messages, and those DNS Update messages may be validated
	  using different rules.
	  However, in the case of an authoritative DNS server that accepts SRP
	  updates, the intersection of the SRP Update rules and
	  whatever other update rules are present must be considered very carefully.</t>
        <t indent="0" pn="section-6.2-2">For example, a normal authenticated DNS update to any
	  RR that was added using SRP, but is authenticated using a
	  different key, could be used to override a promise made by the SRP registrar to an SRP requester by replacing all or part of
	  the service registration information with information provided by an authenticated DNS update requester.  An implementation
	  that allows both kinds of updates <bcp14>SHOULD NOT</bcp14> allow DNS Update requesters that are using different authentication and
	  authorization credentials to update records added by SRP requesters.</t>
      </section>
      <section numbered="true" removeInRFC="false" toc="include" pn="section-6.3">
        <name slugifiedName="name-risks-of-allowing-arbitrary">Risks of Allowing Arbitrary Names to be Registered in SRP Updates</name>
        <t indent="0" pn="section-6.3-1">It is possible to set up SRP Updates for a zone
	  that is also used for non-DNS‑SD records.
	  For example, imagine that you set
	  up SRP service for "example.com".
	  SRP requesters can now register names like "www"
	  or "mail" or "smtp" in this domain. In addition,
	  SRP Updates using FCFS Naming can insert names that are obscene or offensive into the zone. There is no simple solution to
	  these problems. However, we have two recommendations to address this problem:</t>
        <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-6.3-2">
          <li pn="section-6.3-2.1">Do not provide SRP service in organization-level zones.
	    Use subdomains of the organizational domain for DNS‑SD.
	    This does not prevent registering names as mentioned above
	    but does ensure that genuinely important names
	    are not accidentally claimed by SRP requesters.
	    So, for example, the zone "dnssd.example.com." could be used
	    instead of "example.com." for SRP Updates. Because of the way that
	    DNS-browsing domains are discovered, there is no need for the
	    DNS‑SD discovery zone that is updated by SRP to
	    have a user-friendly or important-sounding name.</li>
          <li pn="section-6.3-2.2">Configure a dictionary of names that are prohibited. Dictionaries of common obscene and offensive names are no doubt
	    available and can be augmented with a list of typical "special" names like "www", "mail", "smtp", and so on. Lists of
	    names are generally available or can be constructed manually.
	    Names rejected due to this should return a Refused
	    RCODE, indicating to the SRP requester that it
	    should not append or increment a number at the
	    end of the name and then try again, since this
	    would likely result in an infinite loop.
	    If a name is considered unacceptable because it is
	    obscene or offensive, adding a number on the end is
	    unlikely to make the name acceptable.</li>
        </ul>
      </section>
      <section numbered="true" removeInRFC="false" toc="include" pn="section-6.4">
        <name slugifiedName="name-security-of-local-service-d">Security of Local Service Discovery</name>
        <t indent="0" pn="section-6.4-1">Local links can be protected by managed services such as RA Guard
	<xref target="RFC6105" format="default" sectionFormat="of" derivedContent="RFC6105"/>, but multicast services like DHCP <xref target="RFC2131" format="default" sectionFormat="of" derivedContent="RFC2131"/>, DHCPv6 <xref target="RFC8415" format="default" sectionFormat="of" derivedContent="RFC8415"/>, and IPv6 Neighbor
	Discovery <xref target="RFC4861" format="default" sectionFormat="of" derivedContent="RFC4861"/> are, in most cases, not
	authenticated and can't be controlled on unmanaged networks, such as
	home networks and small office networks where no network management
	staff are present. In such situations, the SRP service has
	comparatively fewer potential security exposures and, hence, is not
	the weak link. This is discussed in more detail in <xref target="how-to-secure" format="default" sectionFormat="of" derivedContent="Section 3.2.4"/>.</t>
        <t indent="0" pn="section-6.4-2">The fundamental protection for networks of this type is the user's
	choice of what devices to add to the network. Work is being done in
	other working groups and standards bodies to improve the state of the
	art for network on-boarding and device isolation (e.g., Manufacturer
	Usage Descriptions <xref target="RFC8520" format="default" sectionFormat="of" derivedContent="RFC8520"/> provide a means for
	constraining what behaviors are allowed for a device in an automatic
	way), but such work is out of scope for this document.</t>
      </section>
      <section numbered="true" removeInRFC="false" toc="include" pn="section-6.5">
        <name slugifiedName="name-srp-registrar-authenticatio">SRP Registrar Authentication</name>
        <t indent="0" pn="section-6.5-1">This specification does not provide a mechanism for validating responses from SRP registrars to
	  SRP requesters.   In principle, a KEY RR could be used by
	  a non-CNN SRP requester to validate responses from the registrar, but this is not required,
	  nor do we specify a mechanism for determining which key to use.</t>
        <t indent="0" pn="section-6.5-2">In addition, for DNS-over-TLS connections, out-of-band key pinning as described in
	  Section <xref target="RFC7858" section="4.2" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc7858#section-4.2" derivedContent="RFC7858"/>
	  of the DNS-over-TLS specification <xref target="RFC7858" format="default" sectionFormat="of" derivedContent="RFC7858"/>
	  could be used for authentication of the SRP registrar,
	  e.g., to prevent man-in-the-middle attacks. However, the use of such keys is impractical for an unmanaged service
	  registration protocol; hence, it is out of scope for this document.</t>
      </section>
      <section anchor="rsa" numbered="true" removeInRFC="false" toc="include" pn="section-6.6">
        <name slugifiedName="name-required-signature-algorith">Required Signature Algorithm</name>
        <t indent="0" pn="section-6.6-1">
	  For validation, SRP registrars <bcp14>MUST</bcp14> implement the ECDSAP256SHA256 signature algorithm.  SRP registrars <bcp14>SHOULD</bcp14> implement the
	  algorithms that are listed in
	  Section <xref target="RFC8624" section="3.1" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc8624#section-3.1" derivedContent="RFC8624"/>
	  of the DNSSEC Cryptographic Algorithms specification <xref target="RFC8624" format="default" sectionFormat="of" derivedContent="RFC8624"/>,
	  in the validation column of the
	  table, that are numbered 13 or higher and that have a "<bcp14>MUST</bcp14>", "<bcp14>RECOMMENDED</bcp14>", or "<bcp14>MAY</bcp14>" designation in the validation column of
	  the table.
	  SRP requesters <bcp14>MUST NOT</bcp14> assume that any algorithm numbered lower than 13 is
	  available for use in validating SIG(0) signatures.</t>
      </section>
    </section>
    <section numbered="true" removeInRFC="false" toc="include" pn="section-7">
      <name slugifiedName="name-privacy-considerations">Privacy Considerations</name>
      <t indent="0" pn="section-7-1">
	Because DNS‑SD SRP Updates can be sent off-link,
	the privacy implications of SRP are
	different from those for mDNS responses.
	SRP Requester implementations that are using TCP <bcp14>SHOULD</bcp14>
	also use DNS-over-TLS <xref target="RFC7858" format="default" sectionFormat="of" derivedContent="RFC7858"/> if available.
	SRP registrar implementations <bcp14>MUST</bcp14> offer TLS support.
	Because there is no mechanism for sharing keys,
	validation of DNS-over-TLS keys is not possible;
	DNS-over-TLS is used only for Opportunistic Privacy, as documented in
	Section <xref target="RFC7858" section="4.1" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc7858#section-4.1" derivedContent="RFC7858"/>
	of the DNS-over-TLS specification <xref target="RFC7858" format="default" sectionFormat="of" derivedContent="RFC7858"/>.
      </t>
      <t indent="0" pn="section-7-2">
	SRP requesters that are able to use TLS <bcp14>SHOULD NOT</bcp14>
	fall back to TCP. Since all SRP registrars are required to support TLS,
	whether to use TLS is entirely the decision of the SRP requester.
      </t>
      <t indent="0" pn="section-7-3">
	Public keys can be used as identifiers to track hosts. SRP registrars <bcp14>MAY</bcp14> elect not to return KEY records for queries for
	SRP registrations. To avoid DNSSEC validation failures, an SRP registrar that signs the zone for DNSSEC but refuses to return
	a KEY record <bcp14>MUST NOT</bcp14> store the KEY record in the zone itself. Because the KEY record isn't in the zone, the nonexistence of
	the KEY record can be validated.
	If the zone is not signed, the authoritative DNS server <bcp14>MAY</bcp14>
	instead return a negative response (either NXDOMAIN or no data).
      </t>
    </section>
    <section numbered="true" removeInRFC="false" toc="include" pn="section-8">
      <name slugifiedName="name-domain-name-reservation-con">Domain Name Reservation Considerations</name>
      <t indent="0" pn="section-8-1">This section specifies considerations for systems involved in domain name resolution when resolving queries for names
	ending with ".service.arpa.".  Each item in this section addresses some aspect of the DNS or the process of resolving domain
	names that would be affected by this special-use allocation.
	Detailed explanations of these items can be found in
	Section <xref target="RFC6761" section="5" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc6761#section-5" derivedContent="RFC6761"/>
	of the Special-Use Domain Names specification <xref target="RFC6761" format="default" sectionFormat="of" derivedContent="RFC6761"/>.
      </t>
      <section numbered="true" removeInRFC="false" toc="include" pn="section-8.1">
        <name slugifiedName="name-users">Users</name>
        <t indent="0" pn="section-8.1-1">The current proposed use for "service.arpa." does not
	require special knowledge on the part of the user. While the
	  "default.service.arpa." subdomain is used as a generic name for registration, users are not expected to see this name in
	  user interfaces. In the event that it does show up in a user interface, it is just a domain name and requires no special
	  treatment by the user.</t>
      </section>
      <section numbered="true" removeInRFC="false" toc="include" pn="section-8.2">
        <name slugifiedName="name-application-software">Application Software</name>
        <t indent="0" pn="section-8.2-1">
	  Application software does not need to handle
	  subdomains of "service.arpa." specially.
	  "service.arpa." <bcp14>SHOULD NOT</bcp14> be treated
	  as more trustworthy than any other insecure DNS domain, simply because it is locally served (or for any other reason). It
	  is not possible to register a PKI certificate for a subdomain of "service.arpa." because it is a locally served domain
	  name. So, no such subdomain can be considered to be uniquely identifying a particular host, as would be required for such a
	  PKI certificate to be issued. If a subdomain of "service.arpa." is returned by an API or entered in an input field of an
	  application, PKI authentication of the endpoint being identified by the name will not be possible. Alternative methods
	  and practices for authenticating such endpoints are out of scope for this document.</t>
      </section>
      <section numbered="true" removeInRFC="false" toc="include" pn="section-8.3">
        <name slugifiedName="name-name-resolution-apis-and-li">Name Resolution APIs and Libraries</name>
        <t indent="0" pn="section-8.3-1">Name resolution APIs and libraries <bcp14>MUST NOT</bcp14> recognize names that end in "service.arpa." as special and <bcp14>MUST NOT</bcp14> treat
	  them as having special significance, except that it may be
	  necessary that such APIs not bypass the locally discovered
	  recursive resolvers.</t>
        <t indent="0" pn="section-8.3-2">One or more IP addresses for recursive resolvers will usually
	  be supplied to the SRP requester through router advertisements
	  or DHCP.  For an administrative domain that uses subdomains of "service.arpa.", the recursive resolvers provided by that
	  domain will be able to answer queries for subdomains of "service.arpa.". Other (non-local) resolvers will not, or they
	  will provide answers that are not correct within that administrative domain.</t>
        <t indent="0" pn="section-8.3-3">A host that is configured to use a resolver other than one that has been provided by the local network may not be able to
	  resolve or may receive incorrect results for subdomains of
	  "service.arpa.".  In order to avoid this, hosts <bcp14>SHOULD</bcp14> use the
	  resolvers that are locally provided for resolving "service.arpa." names,
	  even when they are configured to use other resolvers for other names.</t>
      </section>
      <section numbered="true" removeInRFC="false" toc="include" pn="section-8.4">
        <name slugifiedName="name-recursive-resolvers">Recursive Resolvers</name>
        <t indent="0" pn="section-8.4-1">There are two considerations for recursive resolvers
	(also known as "caching DNS servers" or "recursive DNS servers") that
	follow this specification:</t>
        <ol spacing="normal" indent="adaptive" start="1" type="1" pn="section-8.4-2">
	  <li pn="section-8.4-2.1" derivedCounter="1.">For correctness, recursive resolvers at sites using
	  'service.arpa.' must, in practice, transparently support DNSSEC
	  queries: queries for DNSSEC records and queries with the DNSSEC OK
	  (DO) bit set
	  (Section <xref target="RFC4035" section="3.2.1" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc4035#section-3.2.1" derivedContent="RFC4035"/>
	  of the DNSSEC specification <xref target="RFC4035" format="default" sectionFormat="of" derivedContent="RFC4035"/>).

	  DNSSEC validation <xref target="RFC9364" format="default" sectionFormat="of" derivedContent="RFC9364"/>
	  is a best current practice: Although validation is not required, a
	  caching recursive resolver that does not validate answers that can
	  be validated may cache invalid data.  In turn, this would prevent
	  validating stub resolvers from successfully validating
	  answers. Hence, as a practical matter, recursive resolvers at sites
	  using "service.arpa." should do DNSSEC validation.</li>
          <li pn="section-8.4-2.2" derivedCounter="2.">
            <t indent="0" pn="section-8.4-2.2.1">Unless configured otherwise, recursive resolvers and DNS
	    proxies <bcp14>MUST</bcp14> behave following
	    the rules prescribed for Iterative Resolvers in
	    Section <xref target="RFC6303" section="3" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc6303#section-3" derivedContent="RFC6303"/>
	    of the IETF Locally Served DNS Zones document <xref target="RFC6303" format="default" sectionFormat="of" derivedContent="RFC6303"/>.
	    That is, queries for "service.arpa." and subdomains of
	    "service.arpa." <bcp14>MUST NOT</bcp14> be forwarded, with one
	    important exception: a query for a DS record with the DO bit set
	    <bcp14>MUST</bcp14> return the correct answer for that question,
	    including correct information in the authority section that proves
that the record is nonexistent.</t>
            <t indent="0" pn="section-8.4-2.2.2">So, for example, a query for the NS record for "service.arpa."
            <bcp14>MUST NOT</bcp14> result in that query being forwarded to an
            upstream cache nor to the authoritative DNS server for ".arpa.".
            However, to provide accurate authority information, a
            query for the DS record <bcp14>MUST</bcp14> result in forwarding
            whatever queries are necessary. Typically, this will just be a
            query for the DS record since the necessary authority information
            will be included in the authority section of the response if the
            DO bit is set.</t>
          </li>
        </ol>
      </section>
      <section numbered="true" removeInRFC="false" toc="include" pn="section-8.5">
        <name slugifiedName="name-authoritative-dns-servers">Authoritative DNS Servers</name>
        <t indent="0" pn="section-8.5-1">No special processing of "service.arpa." is required for authoritative DNS server implementations.  It is possible that an
	  authoritative DNS server might attempt to check the authoritative DNS servers for "service.arpa." for a delegation beneath that
	  name before answering authoritatively for such a delegated name.  In such a case, because the name always has only local
	  significance, there will be no such delegation in the "service.arpa." zone;
	  therefore, the authoritative DNS server would refuse to answer
	  authoritatively for such a zone.  An authoritative DNS server that implements
	  this sort of check <bcp14>MUST</bcp14> be configurable so that either it does
	  not do this check for the "service.arpa." domain or it ignores the results of the check.</t>
      </section>
      <section numbered="true" removeInRFC="false" toc="include" pn="section-8.6">
        <name slugifiedName="name-dns-server-operators">DNS Server Operators</name>
        <t indent="0" pn="section-8.6-1">DNS server operators <bcp14>MAY</bcp14> configure an authoritative DNS server for "service.arpa." for use with SRP.  The operator for the
	  DNS servers that are authoritative for "service.arpa." in the global DNS will configure any such DNS servers as described in
	  <xref target="delegation" format="default" sectionFormat="of" derivedContent="Section 9"/>.</t>
      </section>
      <section numbered="true" removeInRFC="false" toc="include" pn="section-8.7">
        <name slugifiedName="name-dns-registries-registrars">DNS Registries/Registrars</name>
        <t indent="0" pn="section-8.7-1">"service.arpa." is a subdomain of the "arpa." top-level domain,
	  which is operated by IANA under the authority of the
	  Internet Architecture Board (IAB) <xref target="RFC3172" format="default" sectionFormat="of" derivedContent="RFC3172"/>.
	  There are no other DNS registrars for "arpa.".</t>
      </section>
    </section>
    <section anchor="delegation" numbered="true" removeInRFC="false" toc="include" pn="section-9">
      <name slugifiedName="name-delegation-of-servicearpa">Delegation of "service.arpa."</name>
      <t indent="0" pn="section-9-1">
	The owner of the "arpa." zone, at the time of writing the IAB <xref target="IAB-ARPA" format="default" sectionFormat="of" derivedContent="IAB-ARPA"/>,
	has added a delegation of "service.arpa."
	in the "arpa." zone <xref target="RFC3172" format="default" sectionFormat="of" derivedContent="RFC3172"/>,
	following the guidance provided in
	Section <xref target="RFC8375" section="7" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc8375#section-7" derivedContent="RFC8375"/>
	of the "home.arpa." specification <xref target="RFC8375" format="default" sectionFormat="of" derivedContent="RFC8375"/>.
      </t>
    </section>
    <section numbered="true" removeInRFC="false" toc="include" pn="section-10">
      <name slugifiedName="name-iana-considerations">IANA Considerations</name>
      <section numbered="true" removeInRFC="false" toc="include" pn="section-10.1">
        <name slugifiedName="name-registration-and-delegation">Registration and Delegation of "service.arpa." as a Special-Use Domain Name</name>
        <t indent="0" pn="section-10.1-1">IANA has recorded the domain name "service.arpa." in the "Special-Use Domain Names" registry
	  <xref target="SUDN" format="default" sectionFormat="of" derivedContent="SUDN"/>. IANA has implemented the delegation requested in
	  <xref target="delegation" format="default" sectionFormat="of" derivedContent="Section 9"/>.</t>
      </section>
      <section numbered="true" removeInRFC="false" toc="include" pn="section-10.2">
        <name slugifiedName="name-addition-of-servicearpa-to-">Addition of "service.arpa." to the Locally-Served Zones Registry</name>
        <t indent="0" pn="section-10.2-1">IANA has also added a new entry to the "Transport-Independent Locally-Served Zones Registry" registry of
	  the "Locally-Served DNS Zones" group <xref target="LSDZ" format="default" sectionFormat="of" derivedContent="LSDZ"/>.
	  The entry is for the domain "SERVICE.ARPA." with the
	  description "DNS‑SD Service Registration Protocol
	  Special-Use Domain" and lists this document as the reference.</t>
      </section>
      <section anchor="subdomains" numbered="true" removeInRFC="false" toc="include" pn="section-10.3">
        <name slugifiedName="name-subdomains-of-servicearpa">Subdomains of "service.arpa."</name>
        <t indent="0" pn="section-10.3-1">This document only makes use of the "default.service.arpa."
	subdomain of "service.arpa." Other subdomains are reserved for future
	use by DNS‑SD or related work.  IANA has created the
	"service.arpa. Subdomain" registry <xref target="SUB" format="default" sectionFormat="of" derivedContent="SUB"/>.  The IETF has
	change control for this registry. New entries may be added either as a
	result of Standards Action (Section <xref target="RFC8126" section="4.9" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc8126#section-4.9" derivedContent="RFC8126"/> of the IANA Guidelines) or with
	IESG Approval (Section <xref target="RFC8126" section="4.10" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc8126#section-4.10" derivedContent="RFC8126"/> of the IANA Guidelines) <xref target="RFC8126" format="default" sectionFormat="of" derivedContent="RFC8126"/>, provided that the values and their meanings are
	documented in a permanent and readily available public specification,
	in sufficient detail so that interoperability between independent
	implementations is possible. </t>
        <t indent="0" pn="section-10.3-2">
	  IANA has grouped the "service.arpa. Subdomain" registry
	  with the "Locally-Served DNS Zones" group.
          The registry is a table with three columns: the subdomain name (expressed as a fully qualified domain
	  name), a brief description of how it is used, and a reference to the document that describes its use in detail.
        </t>
        <t indent="0" pn="section-10.3-3">
	  This initial contents of this registry are as follows:
        </t>
        <table align="center" pn="table-1">
          <thead>
            <tr>
              <th align="left" colspan="1" rowspan="1">Subdomain Name</th>
              <th align="left" colspan="1" rowspan="1">Description</th>
              <th align="left" colspan="1" rowspan="1">Reference</th>
            </tr>
          </thead>
          <tbody>
            <tr>
              <td align="left" colspan="1" rowspan="1">default.service.arpa.</td>
              <td align="left" colspan="1" rowspan="1">Default domain for SRP Updates</td>
              <td align="left" colspan="1" rowspan="1">RFC 9665</td>
            </tr>
          </tbody>
        </table>
      </section>
      <section numbered="true" removeInRFC="false" toc="include" pn="section-10.4">
        <name slugifiedName="name-service-name-registrations">Service Name Registrations</name>
        <t indent="0" pn="section-10.4-1">IANA has added two new entries to the
	  "Service Name and Transport Protocol Port Number Registry"
	  <xref target="PORT" format="default" sectionFormat="of" derivedContent="PORT"/>. The following subsections
	  contain tables with the fields required by
	  Section <xref target="RFC6335" section="8.1.1" sectionFormat="bare" format="default" derivedLink="https://rfc-editor.org/rfc/rfc6335#section-8.1.1" derivedContent="RFC6335"/>
	  of IANA's Procedures for Service Name allocation <xref target="RFC6335" format="default" sectionFormat="of" derivedContent="RFC6335"/>.</t>
        <section numbered="true" removeInRFC="false" toc="include" pn="section-10.4.1">
          <name slugifiedName="name-dnssd-srp-service-name">"dnssd-srp" Service Name</name>
          <table align="center" pn="table-2">
            <thead>
              <tr>
                <th align="left" colspan="1" rowspan="1">Field Name</th>
                <th align="left" colspan="1" rowspan="1">Value</th>
              </tr>
            </thead>
            <tbody>
              <tr>
                <td align="left" colspan="1" rowspan="1">  Service Name       </td>
                <td align="left" colspan="1" rowspan="1">  dnssd-srp                         </td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">  Transport Protocol </td>
                <td align="left" colspan="1" rowspan="1">  tcp                               </td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">  Assignee           </td>
                <td align="left" colspan="1" rowspan="1">  IESG &lt;iesg@ietf.org&gt;        </td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">  Contact            </td>
                <td align="left" colspan="1" rowspan="1">  IETF Chair &lt;chair@ietf.org&gt; </td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">  Description        </td>
                <td align="left" colspan="1" rowspan="1">  DNS‑SD Service Discovery     </td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">  Reference          </td>
                <td align="left" colspan="1" rowspan="1">  RFC 9665                          </td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">  Port Number        </td>
                <td align="left" colspan="1" rowspan="1">  None                              </td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">  Service Code       </td>
                <td align="left" colspan="1" rowspan="1">  None                              </td>
              </tr>
            </tbody>
          </table>
        </section>
        <section numbered="true" removeInRFC="false" toc="include" pn="section-10.4.2">
          <name slugifiedName="name-dnssd-srp-tls-service-name">"dnssd-srp-tls" Service Name</name>
          <table align="center" pn="table-3">
            <thead>
              <tr>
                <th align="left" colspan="1" rowspan="1">Field Name</th>
                <th align="left" colspan="1" rowspan="1">Value</th>
              </tr>
            </thead>
            <tbody>
              <tr>
                <td align="left" colspan="1" rowspan="1">  Service Name       </td>
                <td align="left" colspan="1" rowspan="1">  dnssd-srp-tls                     </td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">  Transport Protocol </td>
                <td align="left" colspan="1" rowspan="1">  tcp                               </td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">  Assignee           </td>
                <td align="left" colspan="1" rowspan="1">  IESG &lt;iesg@ietf.org&gt;                             </td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">  Contact            </td>
                <td align="left" colspan="1" rowspan="1">  IETF Chair &lt;chair@ietf.org&gt;                        </td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">  Description        </td>
                <td align="left" colspan="1" rowspan="1">  DNS‑SD Service Discovery (TLS) </td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">  Reference          </td>
                <td align="left" colspan="1" rowspan="1">  RFC 9665                          </td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">  Port Number        </td>
                <td align="left" colspan="1" rowspan="1">  None                              </td>
              </tr>
              <tr>
                <td align="left" colspan="1" rowspan="1">  Service Code       </td>
                <td align="left" colspan="1" rowspan="1">  None                              </td>
              </tr>
            </tbody>
          </table>
        </section>
      </section>
      <section numbered="true" removeInRFC="false" toc="include" pn="section-10.5">
        <name slugifiedName="name-anycast-address">Anycast Address</name>
        <t indent="0" pn="section-10.5-1">IANA has allocated an IPv6 anycast address from the
	  "IANA IPv6 Special-Purpose Address Registry" <xref target="IPv6" format="default" sectionFormat="of" derivedContent="IPv6"/>,
	  similar to the Port
	  Control Protocol <xref target="RFC6887" format="default" sectionFormat="of" derivedContent="RFC6887"/>
	  anycast address <xref target="RFC7723" format="default" sectionFormat="of" derivedContent="RFC7723"/>.
	  The purpose of this allocation is to provide a fixed anycast
	  address that can be commonly used as a destination for
	  SRP Updates when no SRP registrar is explicitly configured. The initial values for the registry are as follows:</t>
        <table align="center" pn="table-4">
          <thead>
            <tr>
              <th align="left" colspan="1" rowspan="1">Attribute</th>
              <th align="left" colspan="1" rowspan="1">Value</th>
            </tr>
          </thead>
          <tbody>
            <tr>
              <td align="left" colspan="1" rowspan="1">Address Block</td>
              <td align="left" colspan="1" rowspan="1">2001:1::3/128</td>
            </tr>
            <tr>
              <td align="left" colspan="1" rowspan="1">Name</td>
              <td align="left" colspan="1" rowspan="1">DNS‑SD Service Registration Protocol Anycast Address</td>
            </tr>
            <tr>
              <td align="left" colspan="1" rowspan="1">RFC</td>
              <td align="left" colspan="1" rowspan="1">RFC 9665</td>
            </tr>
            <tr>
              <td align="left" colspan="1" rowspan="1">Allocation Date</td>
              <td align="left" colspan="1" rowspan="1">2024-04</td>
            </tr>
            <tr>
              <td align="left" colspan="1" rowspan="1">Termination Date</td>
              <td align="left" colspan="1" rowspan="1">N/A</td>
            </tr>
            <tr>
              <td align="left" colspan="1" rowspan="1">Source</td>
              <td align="left" colspan="1" rowspan="1">True</td>
            </tr>
            <tr>
              <td align="left" colspan="1" rowspan="1">Destination</td>
              <td align="left" colspan="1" rowspan="1">True</td>
            </tr>
            <tr>
              <td align="left" colspan="1" rowspan="1">Forwardable</td>
              <td align="left" colspan="1" rowspan="1">True</td>
            </tr>
            <tr>
              <td align="left" colspan="1" rowspan="1">Globally Reachable</td>
              <td align="left" colspan="1" rowspan="1">True</td>
            </tr>
            <tr>
              <td align="left" colspan="1" rowspan="1">Reserved-by-Protocol</td>
              <td align="left" colspan="1" rowspan="1">False</td>
            </tr>
          </tbody>
        </table>
      </section>
    </section>
  </middle>
  <back>
    <displayreference target="I-D.cheshire-dnssd-roadmap" to="ROADMAP"/>
    <displayreference target="I-D.ietf-snac-simple" to="SNAC-SIMPLE"/>
    <references pn="section-11">
      <name slugifiedName="name-references">References</name>
      <references pn="section-11.1">
        <name slugifiedName="name-normative-references">Normative References</name>
        <reference anchor="RFC1035" target="https://www.rfc-editor.org/info/rfc1035" quoteTitle="true" derivedAnchor="RFC1035">
          <front>
            <title>Domain names - implementation and specification</title>
            <author fullname="P. Mockapetris" initials="P." surname="Mockapetris"/>
            <date month="November" year="1987"/>
            <abstract>
              <t indent="0">This RFC is the revised specification of the protocol and format used in the implementation of the Domain Name System. It obsoletes RFC-883. This memo documents the details of the domain name client - server communication.</t>
            </abstract>
          </front>
          <seriesInfo name="STD" value="13"/>
          <seriesInfo name="RFC" value="1035"/>
          <seriesInfo name="DOI" value="10.17487/RFC1035"/>
        </reference>
        <reference anchor="RFC1536" target="https://www.rfc-editor.org/info/rfc1536" quoteTitle="true" derivedAnchor="RFC1536">
          <front>
            <title>Common DNS Implementation Errors and Suggested Fixes</title>
            <author fullname="A. Kumar" initials="A." surname="Kumar"/>
            <author fullname="J. Postel" initials="J." surname="Postel"/>
            <author fullname="C. Neuman" initials="C." surname="Neuman"/>
            <author fullname="P. Danzig" initials="P." surname="Danzig"/>
            <author fullname="S. Miller" initials="S." surname="Miller"/>
            <date month="October" year="1993"/>
            <abstract>
              <t indent="0">This memo describes common errors seen in DNS implementations and suggests some fixes. This memo provides information for the Internet community. It does not specify an Internet standard.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="1536"/>
          <seriesInfo name="DOI" value="10.17487/RFC1536"/>
        </reference>
        <reference anchor="RFC2119" target="https://www.rfc-editor.org/info/rfc2119" quoteTitle="true" derivedAnchor="RFC2119">
          <front>
            <title>Key words for use in RFCs to Indicate Requirement Levels</title>
            <author fullname="S. Bradner" initials="S." surname="Bradner"/>
            <date month="March" year="1997"/>
            <abstract>
              <t indent="0">In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.</t>
            </abstract>
          </front>
          <seriesInfo name="BCP" value="14"/>
          <seriesInfo name="RFC" value="2119"/>
          <seriesInfo name="DOI" value="10.17487/RFC2119"/>
        </reference>
        <reference anchor="RFC2136" target="https://www.rfc-editor.org/info/rfc2136" quoteTitle="true" derivedAnchor="RFC2136">
          <front>
            <title>Dynamic Updates in the Domain Name System (DNS UPDATE)</title>
            <author fullname="P. Vixie" initials="P." role="editor" surname="Vixie"/>
            <author fullname="S. Thomson" initials="S." surname="Thomson"/>
            <author fullname="Y. Rekhter" initials="Y." surname="Rekhter"/>
            <author fullname="J. Bound" initials="J." surname="Bound"/>
            <date month="April" year="1997"/>
            <abstract>
              <t indent="0">Using this specification of the UPDATE opcode, it is possible to add or delete RRs or RRsets from a specified zone. Prerequisites are specified separately from update operations, and can specify a dependency upon either the previous existence or nonexistence of an RRset, or the existence of a single RR. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="2136"/>
          <seriesInfo name="DOI" value="10.17487/RFC2136"/>
        </reference>
        <reference anchor="RFC2181" target="https://www.rfc-editor.org/info/rfc2181" quoteTitle="true" derivedAnchor="RFC2181">
          <front>
            <title>Clarifications to the DNS Specification</title>
            <author fullname="R. Elz" initials="R." surname="Elz"/>
            <author fullname="R. Bush" initials="R." surname="Bush"/>
            <date month="July" year="1997"/>
            <abstract>
              <t indent="0">This document considers some areas that have been identified as problems with the specification of the Domain Name System, and proposes remedies for the defects identified. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="2181"/>
          <seriesInfo name="DOI" value="10.17487/RFC2181"/>
        </reference>
        <reference anchor="RFC2539" target="https://www.rfc-editor.org/info/rfc2539" quoteTitle="true" derivedAnchor="RFC2539">
          <front>
            <title>Storage of Diffie-Hellman Keys in the Domain Name System (DNS)</title>
            <author fullname="D. Eastlake 3rd" initials="D." surname="Eastlake 3rd"/>
            <date month="March" year="1999"/>
            <abstract>
              <t indent="0">A standard method for storing Diffie-Hellman keys in the Domain Name System is described which utilizes DNS KEY resource records. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="2539"/>
          <seriesInfo name="DOI" value="10.17487/RFC2539"/>
        </reference>
        <reference anchor="RFC2782" target="https://www.rfc-editor.org/info/rfc2782" quoteTitle="true" derivedAnchor="RFC2782">
          <front>
            <title>A DNS RR for specifying the location of services (DNS SRV)</title>
            <author fullname="A. Gulbrandsen" initials="A." surname="Gulbrandsen"/>
            <author fullname="P. Vixie" initials="P." surname="Vixie"/>
            <author fullname="L. Esibov" initials="L." surname="Esibov"/>
            <date month="February" year="2000"/>
            <abstract>
              <t indent="0">This document describes a DNS RR which specifies the location of the server(s) for a specific protocol and domain. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="2782"/>
          <seriesInfo name="DOI" value="10.17487/RFC2782"/>
        </reference>
        <reference anchor="RFC2931" target="https://www.rfc-editor.org/info/rfc2931" quoteTitle="true" derivedAnchor="RFC2931">
          <front>
            <title>DNS Request and Transaction Signatures ( SIG(0)s )</title>
            <author fullname="D. Eastlake 3rd" initials="D." surname="Eastlake 3rd"/>
            <date month="September" year="2000"/>
            <abstract>
              <t indent="0">This document describes the minor but non-interoperable changes in Request and Transaction signature resource records ( SIG(0)s ) that implementation experience has deemed necessary. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="2931"/>
          <seriesInfo name="DOI" value="10.17487/RFC2931"/>
        </reference>
        <reference anchor="RFC3172" target="https://www.rfc-editor.org/info/rfc3172" quoteTitle="true" derivedAnchor="RFC3172">
          <front>
            <title>Management Guidelines &amp; Operational Requirements for the Address and Routing Parameter Area Domain ("arpa")</title>
            <author fullname="G. Huston" initials="G." role="editor" surname="Huston"/>
            <date month="September" year="2001"/>
            <abstract>
              <t indent="0">This memo describes the management and operational requirements for the address and routing parameter area ("arpa") domain. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.</t>
            </abstract>
          </front>
          <seriesInfo name="BCP" value="52"/>
          <seriesInfo name="RFC" value="3172"/>
          <seriesInfo name="DOI" value="10.17487/RFC3172"/>
        </reference>
        <reference anchor="RFC3596" target="https://www.rfc-editor.org/info/rfc3596" quoteTitle="true" derivedAnchor="RFC3596">
          <front>
            <title>DNS Extensions to Support IP Version 6</title>
            <author fullname="S. Thomson" initials="S." surname="Thomson"/>
            <author fullname="C. Huitema" initials="C." surname="Huitema"/>
            <author fullname="V. Ksinant" initials="V." surname="Ksinant"/>
            <author fullname="M. Souissi" initials="M." surname="Souissi"/>
            <date month="October" year="2003"/>
            <abstract>
              <t indent="0">This document defines the changes that need to be made to the Domain Name System (DNS) to support hosts running IP version 6 (IPv6). The changes include a resource record type to store an IPv6 address, a domain to support lookups based on an IPv6 address, and updated definitions of existing query types that return Internet addresses as part of additional section processing. The extensions are designed to be compatible with existing applications and, in particular, DNS implementations themselves. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="STD" value="88"/>
          <seriesInfo name="RFC" value="3596"/>
          <seriesInfo name="DOI" value="10.17487/RFC3596"/>
        </reference>
        <reference anchor="RFC4034" target="https://www.rfc-editor.org/info/rfc4034" quoteTitle="true" derivedAnchor="RFC4034">
          <front>
            <title>Resource Records for the DNS Security Extensions</title>
            <author fullname="R. Arends" initials="R." surname="Arends"/>
            <author fullname="R. Austein" initials="R." surname="Austein"/>
            <author fullname="M. Larson" initials="M." surname="Larson"/>
            <author fullname="D. Massey" initials="D." surname="Massey"/>
            <author fullname="S. Rose" initials="S." surname="Rose"/>
            <date month="March" year="2005"/>
            <abstract>
              <t indent="0">This document is part of a family of documents that describe the DNS Security Extensions (DNSSEC). The DNS Security Extensions are a collection of resource records and protocol modifications that provide source authentication for the DNS. This document defines the public key (DNSKEY), delegation signer (DS), resource record digital signature (RRSIG), and authenticated denial of existence (NSEC) resource records. The purpose and format of each resource record is described in detail, and an example of each resource record is given.</t>
              <t indent="0">This document obsoletes RFC 2535 and incorporates changes from all updates to RFC 2535. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="4034"/>
          <seriesInfo name="DOI" value="10.17487/RFC4034"/>
        </reference>
        <reference anchor="RFC4035" target="https://www.rfc-editor.org/info/rfc4035" quoteTitle="true" derivedAnchor="RFC4035">
          <front>
            <title>Protocol Modifications for the DNS Security Extensions</title>
            <author fullname="R. Arends" initials="R." surname="Arends"/>
            <author fullname="R. Austein" initials="R." surname="Austein"/>
            <author fullname="M. Larson" initials="M." surname="Larson"/>
            <author fullname="D. Massey" initials="D." surname="Massey"/>
            <author fullname="S. Rose" initials="S." surname="Rose"/>
            <date month="March" year="2005"/>
            <abstract>
              <t indent="0">This document is part of a family of documents that describe the DNS Security Extensions (DNSSEC). The DNS Security Extensions are a collection of new resource records and protocol modifications that add data origin authentication and data integrity to the DNS. This document describes the DNSSEC protocol modifications. This document defines the concept of a signed zone, along with the requirements for serving and resolving by using DNSSEC. These techniques allow a security-aware resolver to authenticate both DNS resource records and authoritative DNS error indications.</t>
              <t indent="0">This document obsoletes RFC 2535 and incorporates changes from all updates to RFC 2535. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="4035"/>
          <seriesInfo name="DOI" value="10.17487/RFC4035"/>
        </reference>
        <reference anchor="RFC6303" target="https://www.rfc-editor.org/info/rfc6303" quoteTitle="true" derivedAnchor="RFC6303">
          <front>
            <title>Locally Served DNS Zones</title>
            <author fullname="M. Andrews" initials="M." surname="Andrews"/>
            <date month="July" year="2011"/>
            <abstract>
              <t indent="0">Experience with the Domain Name System (DNS) has shown that there are a number of DNS zones that all iterative resolvers and recursive nameservers should automatically serve, unless configured otherwise. RFC 4193 specifies that this should occur for D.F.IP6.ARPA. This document extends the practice to cover the IN-ADDR.ARPA zones for RFC 1918 address space and other well-known zones with similar characteristics. This memo documents an Internet Best Current Practice.</t>
            </abstract>
          </front>
          <seriesInfo name="BCP" value="163"/>
          <seriesInfo name="RFC" value="6303"/>
          <seriesInfo name="DOI" value="10.17487/RFC6303"/>
        </reference>
        <reference anchor="RFC6763" target="https://www.rfc-editor.org/info/rfc6763" quoteTitle="true" derivedAnchor="RFC6763">
          <front>
            <title>DNS-Based Service Discovery</title>
            <author fullname="S. Cheshire" initials="S." surname="Cheshire"/>
            <author fullname="M. Krochmal" initials="M." surname="Krochmal"/>
            <date month="February" year="2013"/>
            <abstract>
              <t indent="0">This document specifies how DNS resource records are named and structured to facilitate service discovery. Given a type of service that a client is looking for, and a domain in which the client is looking for that service, this mechanism allows clients to discover a list of named instances of that desired service, using standard DNS queries. This mechanism is referred to as DNS-based Service Discovery, or DNS-SD.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="6763"/>
          <seriesInfo name="DOI" value="10.17487/RFC6763"/>
        </reference>
        <reference anchor="RFC7858" target="https://www.rfc-editor.org/info/rfc7858" quoteTitle="true" derivedAnchor="RFC7858">
          <front>
            <title>Specification for DNS over Transport Layer Security (TLS)</title>
            <author fullname="Z. Hu" initials="Z." surname="Hu"/>
            <author fullname="L. Zhu" initials="L." surname="Zhu"/>
            <author fullname="J. Heidemann" initials="J." surname="Heidemann"/>
            <author fullname="A. Mankin" initials="A." surname="Mankin"/>
            <author fullname="D. Wessels" initials="D." surname="Wessels"/>
            <author fullname="P. Hoffman" initials="P." surname="Hoffman"/>
            <date month="May" year="2016"/>
            <abstract>
              <t indent="0">This document describes the use of Transport Layer Security (TLS) to provide privacy for DNS. Encryption provided by TLS eliminates opportunities for eavesdropping and on-path tampering with DNS queries in the network, such as discussed in RFC 7626. In addition, this document specifies two usage profiles for DNS over TLS and provides advice on performance considerations to minimize overhead from using TCP and TLS with DNS.</t>
              <t indent="0">This document focuses on securing stub-to-recursive traffic, as per the charter of the DPRIVE Working Group. It does not prevent future applications of the protocol to recursive-to-authoritative traffic.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="7858"/>
          <seriesInfo name="DOI" value="10.17487/RFC7858"/>
        </reference>
        <reference anchor="RFC8085" target="https://www.rfc-editor.org/info/rfc8085" quoteTitle="true" derivedAnchor="RFC8085">
          <front>
            <title>UDP Usage Guidelines</title>
            <author fullname="L. Eggert" initials="L." surname="Eggert"/>
            <author fullname="G. Fairhurst" initials="G." surname="Fairhurst"/>
            <author fullname="G. Shepherd" initials="G." surname="Shepherd"/>
            <date month="March" year="2017"/>
            <abstract>
              <t indent="0">The User Datagram Protocol (UDP) provides a minimal message-passing transport that has no inherent congestion control mechanisms. This document provides guidelines on the use of UDP for the designers of applications, tunnels, and other protocols that use UDP. Congestion control guidelines are a primary focus, but the document also provides guidance on other topics, including message sizes, reliability, checksums, middlebox traversal, the use of Explicit Congestion Notification (ECN), Differentiated Services Code Points (DSCPs), and ports.</t>
              <t indent="0">Because congestion control is critical to the stable operation of the Internet, applications and other protocols that choose to use UDP as an Internet transport must employ mechanisms to prevent congestion collapse and to establish some degree of fairness with concurrent traffic. They may also need to implement additional mechanisms, depending on how they use UDP.</t>
              <t indent="0">Some guidance is also applicable to the design of other protocols (e.g., protocols layered directly on IP or via IP-based tunnels), especially when these protocols do not themselves provide congestion control.</t>
              <t indent="0">This document obsoletes RFC 5405 and adds guidelines for multicast UDP usage.</t>
            </abstract>
          </front>
          <seriesInfo name="BCP" value="145"/>
          <seriesInfo name="RFC" value="8085"/>
          <seriesInfo name="DOI" value="10.17487/RFC8085"/>
        </reference>
        <reference anchor="RFC8126" target="https://www.rfc-editor.org/info/rfc8126" quoteTitle="true" derivedAnchor="RFC8126">
          <front>
            <title>Guidelines for Writing an IANA Considerations Section in RFCs</title>
            <author fullname="M. Cotton" initials="M." surname="Cotton"/>
            <author fullname="B. Leiba" initials="B." surname="Leiba"/>
            <author fullname="T. Narten" initials="T." surname="Narten"/>
            <date month="June" year="2017"/>
            <abstract>
              <t indent="0">Many protocols make use of points of extensibility that use constants to identify various protocol parameters. To ensure that the values in these fields do not have conflicting uses and to promote interoperability, their allocations are often coordinated by a central record keeper. For IETF protocols, that role is filled by the Internet Assigned Numbers Authority (IANA).</t>
              <t indent="0">To make assignments in a given registry prudently, guidance describing the conditions under which new values should be assigned, as well as when and how modifications to existing values can be made, is needed. This document defines a framework for the documentation of these guidelines by specification authors, in order to assure that the provided guidance for the IANA Considerations is clear and addresses the various issues that are likely in the operation of a registry.</t>
              <t indent="0">This is the third edition of this document; it obsoletes RFC 5226.</t>
            </abstract>
          </front>
          <seriesInfo name="BCP" value="26"/>
          <seriesInfo name="RFC" value="8126"/>
          <seriesInfo name="DOI" value="10.17487/RFC8126"/>
        </reference>
        <reference anchor="RFC8174" target="https://www.rfc-editor.org/info/rfc8174" quoteTitle="true" derivedAnchor="RFC8174">
          <front>
            <title>Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words</title>
            <author fullname="B. Leiba" initials="B." surname="Leiba"/>
            <date month="May" year="2017"/>
            <abstract>
              <t indent="0">RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings.</t>
            </abstract>
          </front>
          <seriesInfo name="BCP" value="14"/>
          <seriesInfo name="RFC" value="8174"/>
          <seriesInfo name="DOI" value="10.17487/RFC8174"/>
        </reference>
        <reference anchor="RFC8375" target="https://www.rfc-editor.org/info/rfc8375" quoteTitle="true" derivedAnchor="RFC8375">
          <front>
            <title>Special-Use Domain 'home.arpa.'</title>
            <author fullname="P. Pfister" initials="P." surname="Pfister"/>
            <author fullname="T. Lemon" initials="T." surname="Lemon"/>
            <date month="May" year="2018"/>
            <abstract>
              <t indent="0">This document specifies the behavior that is expected from the Domain Name System with regard to DNS queries for names ending with '.home.arpa.' and designates this domain as a special-use domain name. 'home.arpa.' is designated for non-unique use in residential home networks. The Home Networking Control Protocol (HNCP) is updated to use the 'home.arpa.' domain instead of '.home'.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="8375"/>
          <seriesInfo name="DOI" value="10.17487/RFC8375"/>
        </reference>
        <reference anchor="RFC8624" target="https://www.rfc-editor.org/info/rfc8624" quoteTitle="true" derivedAnchor="RFC8624">
          <front>
            <title>Algorithm Implementation Requirements and Usage Guidance for DNSSEC</title>
            <author fullname="P. Wouters" initials="P." surname="Wouters"/>
            <author fullname="O. Sury" initials="O." surname="Sury"/>
            <date month="June" year="2019"/>
            <abstract>
              <t indent="0">The DNSSEC protocol makes use of various cryptographic algorithms in order to provide authentication of DNS data and proof of nonexistence. To ensure interoperability between DNS resolvers and DNS authoritative servers, it is necessary to specify a set of algorithm implementation requirements and usage guidelines to ensure that there is at least one algorithm that all implementations support. This document defines the current algorithm implementation requirements and usage guidance for DNSSEC. This document obsoletes RFC 6944.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="8624"/>
          <seriesInfo name="DOI" value="10.17487/RFC8624"/>
        </reference>
        <reference anchor="RFC8765" target="https://www.rfc-editor.org/info/rfc8765" quoteTitle="true" derivedAnchor="RFC8765">
          <front>
            <title>DNS Push Notifications</title>
            <author fullname="T. Pusateri" initials="T." surname="Pusateri"/>
            <author fullname="S. Cheshire" initials="S." surname="Cheshire"/>
            <date month="June" year="2020"/>
            <abstract>
              <t indent="0">The Domain Name System (DNS) was designed to return matching records efficiently for queries for data that are relatively static. When those records change frequently, DNS is still efficient at returning the updated results when polled, as long as the polling rate is not too high. But, there exists no mechanism for a client to be asynchronously notified when these changes occur. This document defines a mechanism for a client to be notified of such changes to DNS records, called DNS Push Notifications.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="8765"/>
          <seriesInfo name="DOI" value="10.17487/RFC8765"/>
        </reference>
        <reference anchor="RFC9364" target="https://www.rfc-editor.org/info/rfc9364" quoteTitle="true" derivedAnchor="RFC9364">
          <front>
            <title>DNS Security Extensions (DNSSEC)</title>
            <author fullname="P. Hoffman" initials="P." surname="Hoffman"/>
            <date month="February" year="2023"/>
            <abstract>
              <t indent="0">This document describes the DNS Security Extensions (commonly called "DNSSEC") that are specified in RFCs 4033, 4034, and 4035, as well as a handful of others. One purpose is to introduce all of the RFCs in one place so that the reader can understand the many aspects of DNSSEC. This document does not update any of those RFCs. A second purpose is to state that using DNSSEC for origin authentication of DNS data is the best current practice. A third purpose is to provide a single reference for other documents that want to refer to DNSSEC.</t>
            </abstract>
          </front>
          <seriesInfo name="BCP" value="237"/>
          <seriesInfo name="RFC" value="9364"/>
          <seriesInfo name="DOI" value="10.17487/RFC9364"/>
        </reference>
        <reference anchor="RFC9664" target="https://www.rfc-editor.org/info/rfc9664" quoteTitle="true" derivedAnchor="RFC9664">
          <front>
            <title>An EDNS(0) Option to Negotiate Leases on DNS Updates</title>
            <author fullname="Stuart Cheshire" initials="S." surname="Cheshire">
              <organization showOnFrontPage="true">Apple Inc.</organization>
            </author>
            <author fullname="Ted Lemon" initials="T." surname="Lemon">
              <organization showOnFrontPage="true">Apple Inc</organization>
            </author>
            <date month="June" year="2025"/>
          </front>
          <seriesInfo name="RFC" value="9664"/>
          <seriesInfo name="DOI" value="10.17487/RFC9664"/>
        </reference>
      </references>
      <references pn="section-11.2">
        <name slugifiedName="name-informative-references">Informative References</name>
        <reference anchor="IAB-ARPA" target="https://www.iab.org/documents/correspondence-reports-documents/2017-2/iab-statement-on-the-registration-of-special-use-names-in-the-arpa-domain/" quoteTitle="true" derivedAnchor="IAB-ARPA">
          <front>
            <title>Internet Architecture Board statement on the registration of special use names in the ARPA domain</title>
            <author/>
            <date month="March" year="2017"/>
          </front>
        </reference>
        <reference anchor="IPv6" target="https://www.iana.org/assignments/iana-ipv6-special-registry" quoteTitle="true" derivedAnchor="IPv6">
          <front>
            <title>IANA IPv6 Special-Purpose Address Registry</title>
            <author>
              <organization showOnFrontPage="true">IANA</organization>
            </author>
          </front>
        </reference>
        <reference anchor="LSDZ" target="https://www.iana.org/assignments/locally-served-dns-zones" quoteTitle="true" derivedAnchor="LSDZ">
          <front>
            <title>Locally-Served DNS Zones</title>
            <author>
              <organization showOnFrontPage="true">IANA</organization>
            </author>
          </front>
        </reference>
        <reference anchor="PORT" target="https://www.iana.org/assignments/service-names-port-numbers" quoteTitle="true" derivedAnchor="PORT">
          <front>
            <title>Service Name and Transport Protocol Port Number Registry</title>
            <author>
              <organization showOnFrontPage="true">IANA</organization>
            </author>
          </front>
        </reference>
        <reference anchor="RFC2131" target="https://www.rfc-editor.org/info/rfc2131" quoteTitle="true" derivedAnchor="RFC2131">
          <front>
            <title>Dynamic Host Configuration Protocol</title>
            <author fullname="R. Droms" initials="R." surname="Droms"/>
            <date month="March" year="1997"/>
            <abstract>
              <t indent="0">The Dynamic Host Configuration Protocol (DHCP) provides a framework for passing configuration information to hosts on a TCPIP network. DHCP is based on the Bootstrap Protocol (BOOTP), adding the capability of automatic allocation of reusable network addresses and additional configuration options. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="2131"/>
          <seriesInfo name="DOI" value="10.17487/RFC2131"/>
        </reference>
        <reference anchor="RFC2827" target="https://www.rfc-editor.org/info/rfc2827" quoteTitle="true" derivedAnchor="RFC2827">
          <front>
            <title>Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing</title>
            <author fullname="P. Ferguson" initials="P." surname="Ferguson"/>
            <author fullname="D. Senie" initials="D." surname="Senie"/>
            <date month="May" year="2000"/>
            <abstract>
              <t indent="0">This paper discusses a simple, effective, and straightforward method for using ingress traffic filtering to prohibit DoS (Denial of Service) attacks which use forged IP addresses to be propagated from 'behind' an Internet Service Provider's (ISP) aggregation point. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.</t>
            </abstract>
          </front>
          <seriesInfo name="BCP" value="38"/>
          <seriesInfo name="RFC" value="2827"/>
          <seriesInfo name="DOI" value="10.17487/RFC2827"/>
        </reference>
        <reference anchor="RFC3007" target="https://www.rfc-editor.org/info/rfc3007" quoteTitle="true" derivedAnchor="RFC3007">
          <front>
            <title>Secure Domain Name System (DNS) Dynamic Update</title>
            <author fullname="B. Wellington" initials="B." surname="Wellington"/>
            <date month="November" year="2000"/>
            <abstract>
              <t indent="0">This document proposes a method for performing secure Domain Name System (DNS) dynamic updates. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="3007"/>
          <seriesInfo name="DOI" value="10.17487/RFC3007"/>
        </reference>
        <reference anchor="RFC3927" target="https://www.rfc-editor.org/info/rfc3927" quoteTitle="true" derivedAnchor="RFC3927">
          <front>
            <title>Dynamic Configuration of IPv4 Link-Local Addresses</title>
            <author fullname="S. Cheshire" initials="S." surname="Cheshire"/>
            <author fullname="B. Aboba" initials="B." surname="Aboba"/>
            <author fullname="E. Guttman" initials="E." surname="Guttman"/>
            <date month="May" year="2005"/>
            <abstract>
              <t indent="0">To participate in wide-area IP networking, a host needs to be configured with IP addresses for its interfaces, either manually by the user or automatically from a source on the network such as a Dynamic Host Configuration Protocol (DHCP) server. Unfortunately, such address configuration information may not always be available. It is therefore beneficial for a host to be able to depend on a useful subset of IP networking functions even when no address configuration is available. This document describes how a host may automatically configure an interface with an IPv4 address within the 169.254/16 prefix that is valid for communication with other devices connected to the same physical (or logical) link.</t>
              <t indent="0">IPv4 Link-Local addresses are not suitable for communication with devices not directly connected to the same physical (or logical) link, and are only used where stable, routable addresses are not available (such as on ad hoc or isolated networks). This document does not recommend that IPv4 Link-Local addresses and routable addresses be configured simultaneously on the same interface. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="3927"/>
          <seriesInfo name="DOI" value="10.17487/RFC3927"/>
        </reference>
        <reference anchor="RFC4861" target="https://www.rfc-editor.org/info/rfc4861" quoteTitle="true" derivedAnchor="RFC4861">
          <front>
            <title>Neighbor Discovery for IP version 6 (IPv6)</title>
            <author fullname="T. Narten" initials="T." surname="Narten"/>
            <author fullname="E. Nordmark" initials="E." surname="Nordmark"/>
            <author fullname="W. Simpson" initials="W." surname="Simpson"/>
            <author fullname="H. Soliman" initials="H." surname="Soliman"/>
            <date month="September" year="2007"/>
            <abstract>
              <t indent="0">This document specifies the Neighbor Discovery protocol for IP Version 6. IPv6 nodes on the same link use Neighbor Discovery to discover each other's presence, to determine each other's link-layer addresses, to find routers, and to maintain reachability information about the paths to active neighbors. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="4861"/>
          <seriesInfo name="DOI" value="10.17487/RFC4861"/>
        </reference>
        <reference anchor="RFC4862" target="https://www.rfc-editor.org/info/rfc4862" quoteTitle="true" derivedAnchor="RFC4862">
          <front>
            <title>IPv6 Stateless Address Autoconfiguration</title>
            <author fullname="S. Thomson" initials="S." surname="Thomson"/>
            <author fullname="T. Narten" initials="T." surname="Narten"/>
            <author fullname="T. Jinmei" initials="T." surname="Jinmei"/>
            <date month="September" year="2007"/>
            <abstract>
              <t indent="0">This document specifies the steps a host takes in deciding how to autoconfigure its interfaces in IP version 6. The autoconfiguration process includes generating a link-local address, generating global addresses via stateless address autoconfiguration, and the Duplicate Address Detection procedure to verify the uniqueness of the addresses on a link. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="4862"/>
          <seriesInfo name="DOI" value="10.17487/RFC4862"/>
        </reference>
        <reference anchor="RFC6105" target="https://www.rfc-editor.org/info/rfc6105" quoteTitle="true" derivedAnchor="RFC6105">
          <front>
            <title>IPv6 Router Advertisement Guard</title>
            <author fullname="E. Levy-Abegnoli" initials="E." surname="Levy-Abegnoli"/>
            <author fullname="G. Van de Velde" initials="G." surname="Van de Velde"/>
            <author fullname="C. Popoviciu" initials="C." surname="Popoviciu"/>
            <author fullname="J. Mohacsi" initials="J." surname="Mohacsi"/>
            <date month="February" year="2011"/>
            <abstract>
              <t indent="0">Routed protocols are often susceptible to spoof attacks. The canonical solution for IPv6 is Secure Neighbor Discovery (SEND), a solution that is non-trivial to deploy. This document proposes a light-weight alternative and complement to SEND based on filtering in the layer-2 network fabric, using a variety of filtering criteria, including, for example, SEND status. This document is not an Internet Standards Track specification; it is published for informational purposes.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="6105"/>
          <seriesInfo name="DOI" value="10.17487/RFC6105"/>
        </reference>
        <reference anchor="RFC6335" target="https://www.rfc-editor.org/info/rfc6335" quoteTitle="true" derivedAnchor="RFC6335">
          <front>
            <title>Internet Assigned Numbers Authority (IANA) Procedures for the Management of the Service Name and Transport Protocol Port Number Registry</title>
            <author fullname="M. Cotton" initials="M." surname="Cotton"/>
            <author fullname="L. Eggert" initials="L." surname="Eggert"/>
            <author fullname="J. Touch" initials="J." surname="Touch"/>
            <author fullname="M. Westerlund" initials="M." surname="Westerlund"/>
            <author fullname="S. Cheshire" initials="S." surname="Cheshire"/>
            <date month="August" year="2011"/>
            <abstract>
              <t indent="0">This document defines the procedures that the Internet Assigned Numbers Authority (IANA) uses when handling assignment and other requests related to the Service Name and Transport Protocol Port Number registry. It also discusses the rationale and principles behind these procedures and how they facilitate the long-term sustainability of the registry.</t>
              <t indent="0">This document updates IANA's procedures by obsoleting the previous UDP and TCP port assignment procedures defined in Sections 8 and 9.1 of the IANA Allocation Guidelines, and it updates the IANA service name and port assignment procedures for UDP-Lite, the Datagram Congestion Control Protocol (DCCP), and the Stream Control Transmission Protocol (SCTP). It also updates the DNS SRV specification to clarify what a service name is and how it is registered. This memo documents an Internet Best Current Practice.</t>
            </abstract>
          </front>
          <seriesInfo name="BCP" value="165"/>
          <seriesInfo name="RFC" value="6335"/>
          <seriesInfo name="DOI" value="10.17487/RFC6335"/>
        </reference>
        <reference anchor="RFC6760" target="https://www.rfc-editor.org/info/rfc6760" quoteTitle="true" derivedAnchor="RFC6760">
          <front>
            <title>Requirements for a Protocol to Replace the AppleTalk Name Binding Protocol (NBP)</title>
            <author fullname="S. Cheshire" initials="S." surname="Cheshire"/>
            <author fullname="M. Krochmal" initials="M." surname="Krochmal"/>
            <date month="February" year="2013"/>
            <abstract>
              <t indent="0">One of the goals of the authors of Multicast DNS (mDNS) and DNS-Based Service Discovery (DNS-SD) was to retire AppleTalk and the AppleTalk Name Binding Protocol (NBP) and to replace them with an IP-based solution. This document presents a brief overview of the capabilities of AppleTalk NBP and outlines the properties required of an IP-based replacement.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="6760"/>
          <seriesInfo name="DOI" value="10.17487/RFC6760"/>
        </reference>
        <reference anchor="RFC6761" target="https://www.rfc-editor.org/info/rfc6761" quoteTitle="true" derivedAnchor="RFC6761">
          <front>
            <title>Special-Use Domain Names</title>
            <author fullname="S. Cheshire" initials="S." surname="Cheshire"/>
            <author fullname="M. Krochmal" initials="M." surname="Krochmal"/>
            <date month="February" year="2013"/>
            <abstract>
              <t indent="0">This document describes what it means to say that a Domain Name (DNS name) is reserved for special use, when reserving such a name is appropriate, and the procedure for doing so. It establishes an IANA registry for such domain names, and seeds it with entries for some of the already established special domain names.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="6761"/>
          <seriesInfo name="DOI" value="10.17487/RFC6761"/>
        </reference>
        <reference anchor="RFC6762" target="https://www.rfc-editor.org/info/rfc6762" quoteTitle="true" derivedAnchor="RFC6762">
          <front>
            <title>Multicast DNS</title>
            <author fullname="S. Cheshire" initials="S." surname="Cheshire"/>
            <author fullname="M. Krochmal" initials="M." surname="Krochmal"/>
            <date month="February" year="2013"/>
            <abstract>
              <t indent="0">As networked devices become smaller, more portable, and more ubiquitous, the ability to operate with less configured infrastructure is increasingly important. In particular, the ability to look up DNS resource record data types (including, but not limited to, host names) in the absence of a conventional managed DNS server is useful.</t>
              <t indent="0">Multicast DNS (mDNS) provides the ability to perform DNS-like operations on the local link in the absence of any conventional Unicast DNS server. In addition, Multicast DNS designates a portion of the DNS namespace to be free for local use, without the need to pay any annual fee, and without the need to set up delegations or otherwise configure a conventional DNS server to answer for those names.</t>
              <t indent="0">The primary benefits of Multicast DNS names are that (i) they require little or no administration or configuration to set them up, (ii) they work when no infrastructure is present, and (iii) they work during infrastructure failures.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="6762"/>
          <seriesInfo name="DOI" value="10.17487/RFC6762"/>
        </reference>
        <reference anchor="RFC6887" target="https://www.rfc-editor.org/info/rfc6887" quoteTitle="true" derivedAnchor="RFC6887">
          <front>
            <title>Port Control Protocol (PCP)</title>
            <author fullname="D. Wing" initials="D." role="editor" surname="Wing"/>
            <author fullname="S. Cheshire" initials="S." surname="Cheshire"/>
            <author fullname="M. Boucadair" initials="M." surname="Boucadair"/>
            <author fullname="R. Penno" initials="R." surname="Penno"/>
            <author fullname="P. Selkirk" initials="P." surname="Selkirk"/>
            <date month="April" year="2013"/>
            <abstract>
              <t indent="0">The Port Control Protocol allows an IPv6 or IPv4 host to control how incoming IPv6 or IPv4 packets are translated and forwarded by a Network Address Translator (NAT) or simple firewall, and also allows a host to optimize its outgoing NAT keepalive messages.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="6887"/>
          <seriesInfo name="DOI" value="10.17487/RFC6887"/>
        </reference>
        <reference anchor="RFC7084" target="https://www.rfc-editor.org/info/rfc7084" quoteTitle="true" derivedAnchor="RFC7084">
          <front>
            <title>Basic Requirements for IPv6 Customer Edge Routers</title>
            <author fullname="H. Singh" initials="H." surname="Singh"/>
            <author fullname="W. Beebee" initials="W." surname="Beebee"/>
            <author fullname="C. Donley" initials="C." surname="Donley"/>
            <author fullname="B. Stark" initials="B." surname="Stark"/>
            <date month="November" year="2013"/>
            <abstract>
              <t indent="0">This document specifies requirements for an IPv6 Customer Edge (CE) router. Specifically, the current version of this document focuses on the basic provisioning of an IPv6 CE router and the provisioning of IPv6 hosts attached to it. The document also covers IP transition technologies. Two transition technologies in RFC 5969's IPv6 Rapid Deployment on IPv4 Infrastructures (6rd) and RFC 6333's Dual-Stack Lite (DS-Lite) are covered in the document. The document obsoletes RFC 6204.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="7084"/>
          <seriesInfo name="DOI" value="10.17487/RFC7084"/>
        </reference>
        <reference anchor="RFC7228" target="https://www.rfc-editor.org/info/rfc7228" quoteTitle="true" derivedAnchor="RFC7228">
          <front>
            <title>Terminology for Constrained-Node Networks</title>
            <author fullname="C. Bormann" initials="C." surname="Bormann"/>
            <author fullname="M. Ersue" initials="M." surname="Ersue"/>
            <author fullname="A. Keranen" initials="A." surname="Keranen"/>
            <date month="May" year="2014"/>
            <abstract>
              <t indent="0">The Internet Protocol Suite is increasingly used on small devices with severe constraints on power, memory, and processing resources, creating constrained-node networks. This document provides a number of basic terms that have been useful in the standardization work for constrained-node networks.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="7228"/>
          <seriesInfo name="DOI" value="10.17487/RFC7228"/>
        </reference>
        <reference anchor="RFC7413" target="https://www.rfc-editor.org/info/rfc7413" quoteTitle="true" derivedAnchor="RFC7413">
          <front>
            <title>TCP Fast Open</title>
            <author fullname="Y. Cheng" initials="Y." surname="Cheng"/>
            <author fullname="J. Chu" initials="J." surname="Chu"/>
            <author fullname="S. Radhakrishnan" initials="S." surname="Radhakrishnan"/>
            <author fullname="A. Jain" initials="A." surname="Jain"/>
            <date month="December" year="2014"/>
            <abstract>
              <t indent="0">This document describes an experimental TCP mechanism called TCP Fast Open (TFO). TFO allows data to be carried in the SYN and SYN-ACK packets and consumed by the receiving end during the initial connection handshake, and saves up to one full round-trip time (RTT) compared to the standard TCP, which requires a three-way handshake (3WHS) to complete before data can be exchanged. However, TFO deviates from the standard TCP semantics, since the data in the SYN could be replayed to an application in some rare circumstances. Applications should not use TFO unless they can tolerate this issue, as detailed in the Applicability section.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="7413"/>
          <seriesInfo name="DOI" value="10.17487/RFC7413"/>
        </reference>
        <reference anchor="RFC7723" target="https://www.rfc-editor.org/info/rfc7723" quoteTitle="true" derivedAnchor="RFC7723">
          <front>
            <title>Port Control Protocol (PCP) Anycast Addresses</title>
            <author fullname="S. Kiesel" initials="S." surname="Kiesel"/>
            <author fullname="R. Penno" initials="R." surname="Penno"/>
            <date month="January" year="2016"/>
            <abstract>
              <t indent="0">The Port Control Protocol (PCP) anycast addresses enable PCP clients to transmit signaling messages to their closest PCP-aware on-path NAT, firewall, or other middlebox without having to learn the IP address of that middlebox via some external channel. This document establishes one well-known IPv4 address and one well-known IPv6 address to be used as PCP anycast addresses.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="7723"/>
          <seriesInfo name="DOI" value="10.17487/RFC7723"/>
        </reference>
        <reference anchor="RFC8415" target="https://www.rfc-editor.org/info/rfc8415" quoteTitle="true" derivedAnchor="RFC8415">
          <front>
            <title>Dynamic Host Configuration Protocol for IPv6 (DHCPv6)</title>
            <author fullname="T. Mrugalski" initials="T." surname="Mrugalski"/>
            <author fullname="M. Siodelski" initials="M." surname="Siodelski"/>
            <author fullname="B. Volz" initials="B." surname="Volz"/>
            <author fullname="A. Yourtchenko" initials="A." surname="Yourtchenko"/>
            <author fullname="M. Richardson" initials="M." surname="Richardson"/>
            <author fullname="S. Jiang" initials="S." surname="Jiang"/>
            <author fullname="T. Lemon" initials="T." surname="Lemon"/>
            <author fullname="T. Winters" initials="T." surname="Winters"/>
            <date month="November" year="2018"/>
            <abstract>
              <t indent="0">This document describes the Dynamic Host Configuration Protocol for IPv6 (DHCPv6): an extensible mechanism for configuring nodes with network configuration parameters, IP addresses, and prefixes. Parameters can be provided statelessly, or in combination with stateful assignment of one or more IPv6 addresses and/or IPv6 prefixes. DHCPv6 can operate either in place of or in addition to stateless address autoconfiguration (SLAAC).</t>
              <t indent="0">This document updates the text from RFC 3315 (the original DHCPv6 specification) and incorporates prefix delegation (RFC 3633), stateless DHCPv6 (RFC 3736), an option to specify an upper bound for how long a client should wait before refreshing information (RFC 4242), a mechanism for throttling DHCPv6 clients when DHCPv6 service is not available (RFC 7083), and relay agent handling of unknown messages (RFC 7283). In addition, this document clarifies the interactions between models of operation (RFC 7550). As such, this document obsoletes RFC 3315, RFC 3633, RFC 3736, RFC 4242, RFC 7083, RFC 7283, and RFC 7550.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="8415"/>
          <seriesInfo name="DOI" value="10.17487/RFC8415"/>
        </reference>
        <reference anchor="RFC8520" target="https://www.rfc-editor.org/info/rfc8520" quoteTitle="true" derivedAnchor="RFC8520">
          <front>
            <title>Manufacturer Usage Description Specification</title>
            <author fullname="E. Lear" initials="E." surname="Lear"/>
            <author fullname="R. Droms" initials="R." surname="Droms"/>
            <author fullname="D. Romascanu" initials="D." surname="Romascanu"/>
            <date month="March" year="2019"/>
            <abstract>
              <t indent="0">This memo specifies a component-based architecture for Manufacturer Usage Descriptions (MUDs). The goal of MUD is to provide a means for end devices to signal to the network what sort of access and network functionality they require to properly function. The initial focus is on access control. Later work can delve into other aspects.</t>
              <t indent="0">This memo specifies two YANG modules, IPv4 and IPv6 DHCP options, a Link Layer Discovery Protocol (LLDP) TLV, a URL, an X.509 certificate extension, and a means to sign and verify the descriptions.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="8520"/>
          <seriesInfo name="DOI" value="10.17487/RFC8520"/>
        </reference>
        <reference anchor="RFC8766" target="https://www.rfc-editor.org/info/rfc8766" quoteTitle="true" derivedAnchor="RFC8766">
          <front>
            <title>Discovery Proxy for Multicast DNS-Based Service Discovery</title>
            <author fullname="S. Cheshire" initials="S." surname="Cheshire"/>
            <date month="June" year="2020"/>
            <abstract>
              <t indent="0">This document specifies a network proxy that uses Multicast DNS to automatically populate the wide-area unicast Domain Name System namespace with records describing devices and services found on the local link.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="8766"/>
          <seriesInfo name="DOI" value="10.17487/RFC8766"/>
        </reference>
        <reference anchor="RFC8945" target="https://www.rfc-editor.org/info/rfc8945" quoteTitle="true" derivedAnchor="RFC8945">
          <front>
            <title>Secret Key Transaction Authentication for DNS (TSIG)</title>
            <author fullname="F. Dupont" initials="F." surname="Dupont"/>
            <author fullname="S. Morris" initials="S." surname="Morris"/>
            <author fullname="P. Vixie" initials="P." surname="Vixie"/>
            <author fullname="D. Eastlake 3rd" initials="D." surname="Eastlake 3rd"/>
            <author fullname="O. Gudmundsson" initials="O." surname="Gudmundsson"/>
            <author fullname="B. Wellington" initials="B." surname="Wellington"/>
            <date month="November" year="2020"/>
            <abstract>
              <t indent="0">This document describes a protocol for transaction-level authentication using shared secrets and one-way hashing. It can be used to authenticate dynamic updates to a DNS zone as coming from an approved client or to authenticate responses as coming from an approved name server.</t>
              <t indent="0">No recommendation is made here for distributing the shared secrets; it is expected that a network administrator will statically configure name servers and clients using some out-of-band mechanism.</t>
              <t indent="0">This document obsoletes RFCs 2845 and 4635.</t>
            </abstract>
          </front>
          <seriesInfo name="STD" value="93"/>
          <seriesInfo name="RFC" value="8945"/>
          <seriesInfo name="DOI" value="10.17487/RFC8945"/>
        </reference>
        <reference anchor="I-D.cheshire-dnssd-roadmap" target="https://datatracker.ietf.org/doc/html/draft-cheshire-dnssd-roadmap-03" quoteTitle="true" derivedAnchor="ROADMAP">
          <front>
            <title>Service Discovery Road Map</title>
            <author initials="S." surname="Cheshire" fullname="Stuart Cheshire">
              <organization showOnFrontPage="true">Apple Inc.</organization>
            </author>
            <date month="October" day="23" year="2018"/>
            <abstract>
              <t indent="0">   Over the course of several years, a rich collection of technologies
   has developed around DNS-Based Service Discovery, described across
   multiple documents.  This "Road Map" document gives an overview of
   how these related but separate technologies (and their documents) fit
   together, to facilitate service discovery in various environments.

              </t>
            </abstract>
          </front>
          <seriesInfo name="Internet-Draft" value="draft-cheshire-dnssd-roadmap-03"/>
          <refcontent>Work in Progress</refcontent>
        </reference>
        <reference anchor="I-D.ietf-snac-simple" target="https://datatracker.ietf.org/doc/html/draft-ietf-snac-simple-06" quoteTitle="true" derivedAnchor="SNAC-SIMPLE">
          <front>
            <title>Automatically Connecting Stub Networks to Unmanaged Infrastructure</title>
            <author initials="T." surname="Lemon" fullname="Ted Lemon">
              <organization showOnFrontPage="true">Apple Inc.</organization>
            </author>
            <author initials="J." surname="Hui" fullname="Jonathan Hui">
              <organization showOnFrontPage="true">Google LLC</organization>
            </author>
            <date month="November" day="4" year="2024"/>
            <abstract>
              <t indent="0">   This document describes a set of practices for connecting stub
   networks to adjacent infrastructure networks.  This is applicable in
   cases such as constrained (Internet of Things) networks where there
   is a need to provide functional parity of service discovery and
   reachability between devices on the stub network and devices on an
   adjacent infrastructure link (for example, a home network).

              </t>
            </abstract>
          </front>
          <seriesInfo name="Internet-Draft" value="draft-ietf-snac-simple-06"/>
          <refcontent>Work in Progress</refcontent>
        </reference>
        <reference anchor="SUB" target="https://www.iana.org/assignments/locally-served-dns-zones/locally-served-dns-zones" quoteTitle="true" derivedAnchor="SUB">
          <front>
            <title>service.arpa Subdomain</title>
            <author>
              <organization showOnFrontPage="true">IANA</organization>
            </author>
          </front>
        </reference>
        <reference anchor="SUDN" target="https://www.iana.org/assignments/special-use-domain-names" quoteTitle="true" derivedAnchor="SUDN">
          <front>
            <title>Special-Use Domain Names</title>
            <author>
              <organization showOnFrontPage="true">IANA</organization>
            </author>
          </front>
        </reference>
        <reference anchor="ZC" quoteTitle="true" derivedAnchor="ZC">
          <front>
            <title>Zero Configuration Networking: The Definitive Guide</title>
            <author initials="D.H." surname="Steinberg" fullname="Daniel H. Steinberg"/>
            <author initials="S." surname="Cheshire" fullname="Stuart Cheshire"/>
            <date year="2005" month="December"/>
          </front>
          <refcontent>O'Reilly Media, Inc.</refcontent>
          <seriesInfo name="ISBN" value="9780596101008"/>
        </reference>
      </references>
    </references>
    <section numbered="true" removeInRFC="false" toc="include" pn="section-appendix.a">
      <name slugifiedName="name-using-standard-authoritativ">Using Standard Authoritative DNS Servers Compliant with RFC 2136 to Test SRP Requesters</name>
      <t indent="0" pn="section-appendix.a-1">
        For testing, it may be useful to set up an
        authoritative DNS server that does not implement SRP.
        This can be done by configuring the
        authoritative DNS server to listen on the anycast address or by
        advertising it in the "_dnssd‑srp._tcp.&lt;zone&gt;" and
        "_dnssd‑srp‑tls._tcp.&lt;zone&gt;" SRV records.
        It must be configured to be authoritative for
        "default.service.arpa." and to accept updates from hosts
        on local networks for names under "default.service.arpa."
        without authentication since such authoritative DNS servers will not
        have support for FCFS authentication (<xref target="fcfs" format="default" sectionFormat="of" derivedContent="Section 3.2.4.1"/>).</t>
      <t indent="0" pn="section-appendix.a-2">
        An authoritative DNS server configured in this way will be able to successfully accept and process SRP Updates from requesters that send SRP
        updates.  However, no prerequisites will be applied; this means
        that the test authoritative DNS server will accept internally
        inconsistent SRP Updates and will not stop two SRP Updates sent by different services that claim the same name or names
        from overwriting each other.</t>
      <t indent="0" pn="section-appendix.a-3">
        Since SRP Updates are signed with keys, validation of the SIG(0) algorithm used by the requester can be done by manually
        installing the requester's public key on the authoritative DNS server
        that will be receiving the updates.  The key can then be used to
        authenticate the SRP Update and can be used as a requirement for the update.  An example configuration for testing SRP
        using BIND 9 is given in <xref target="bind-example" format="default" sectionFormat="of" derivedContent="Appendix C"/>.</t>
    </section>
    <section numbered="true" removeInRFC="false" toc="include" pn="section-appendix.b">
      <name slugifiedName="name-how-to-allow-srp-requesters">How to Allow SRP Requesters to Update Standard Servers Compliant with RFC 2136</name>
      <t indent="0" pn="section-appendix.b-1">
        Ordinarily, CNN SRP Updates sent to an authoritative DNS server
        that implements standard DNS Update <xref target="RFC2136" format="default" sectionFormat="of" derivedContent="RFC2136"/> but not SRP
        will fail
        because the zone being updated is "default.service.arpa." and because
        no authoritative DNS server that is not an SRP registrar would normally
        be configured to be authoritative for "default.service.arpa.".
        Therefore, a requester that sends an SRP Update can
        tell that the receiving authoritative DNS server
        does not support SRP but does support
        standard DNS Update <xref target="RFC2136" format="default" sectionFormat="of" derivedContent="RFC2136"/>
        because the RCODE will either be NotZone, NotAuth, or Refused or because
        there is no response to the update request (when using the anycast address).</t>
      <t indent="0" pn="section-appendix.b-2">
        In this case, a requester <bcp14>MAY</bcp14>
        attempt to register itself using
        normal DNS updates <xref target="RFC2136" format="default" sectionFormat="of" derivedContent="RFC2136"/>.
        To do so, it must discover the
        default registration zone and the authoritative DNS server designated
        to receive updates for that zone, as described earlier, using the
        _dns‑update._udp SRV record.  It can then send the update to the port and host pointed to by the SRV record, and it is
        expected to use appropriate prerequisites to avoid overwriting competing records.  Such updates are out of scope for SRP,
        and a requester that implements SRP <bcp14>MUST</bcp14>
        first attempt to use SRP to register itself and
        only attempt to use backwards capability with
        normal DNS Update <xref target="RFC2136" format="default" sectionFormat="of" derivedContent="RFC2136"/>
        if that fails.
        Although the owner name of the SRV record for
        DNS Update (_dns-update._udp) specifies UDP,
        it is also possible to use TCP, and TCP <bcp14>SHOULD</bcp14> be required to prevent spoofing.</t>
    </section>
    <section anchor="bind-example" numbered="true" removeInRFC="false" toc="include" pn="section-appendix.c">
      <name slugifiedName="name-sample-bind-9-configuration">Sample BIND 9 Configuration for "default.service.arpa."</name>
      <figure align="left" suppress-title="false" pn="figure-1">
        <name slugifiedName="name-zone-configuration-in-named">Zone Configuration in named.conf</name>
        <artwork align="center" pn="section-appendix.c-1.1">
zone "default.service.arpa." {
  type primary;
  file "/etc/bind/primary/service.db";
  allow-update { key demo.default.service.arpa.; };
};</artwork>
      </figure>
      <figure align="left" suppress-title="false" pn="figure-2">
        <name slugifiedName="name-example-zone-file">Example Zone File</name>
        <artwork align="center" pn="section-appendix.c-2.1">
$TTL 57600  ; 16 hours
@                   IN SOA       ns postmaster (
                      2951053287 ; serial
                      3600       ; refresh (1 hour)
                      1800       ; retry   (30 minutes)
                      604800     ; expire  (1 week)
                      3600       ; minimum (1 hour)
                      )
                    NS           ns
ns                  AAAA         2001:db8:0:2::1

$TTL 3600   ; 1 hour

; Autoconguration bootstrap records
_dnssd-srp._tcp     SRV 0 0 53   ns
_dnssd-srp-tls._tcp SRV 0 0 853  ns

; Service Discovery Instruction
_ipps._tcp          PTR          demo._ipps._tcp

; Service Description Instruction
demo._ipps._tcp     SRV 0 0 631  demohost
                    TXT          ""

; Host Description Instruction
demohost            AAAA         2001:db8:0:2::2
                    KEY 0 3 13 (
                      qweEmaaq0FAWok5//ftuQtZgiZoiFSUsm0srWREdywQU
                      9dpvtOhrdKWUuPT3uEFF5TZU6B4q1z1I662GdaUwqg==
                      ); alg = ECDSAP256SHA256 ; key id = 14495
</artwork>
      </figure>
    </section>
    <section numbered="false" removeInRFC="false" toc="include" pn="section-appendix.d">
      <name slugifiedName="name-acknowledgments">Acknowledgments</name>
      <t indent="0" pn="section-appendix.d-1">Thanks to <contact fullname="Toke Høiland-Jørgensen"/>, <contact fullname="Jonathan Hui"/>, <contact fullname="Esko Dijk"/>, <contact fullname="Kangping Dong"/>, and <contact fullname="Abtin Keshavarzian"/>
      for their thorough technical reviews. Thanks to <contact fullname="Kangping"/> and <contact fullname="Abtin"/> as well for
      testing the document by doing an independent implementation. Thanks to
      <contact fullname="Tamara Kemper"/> for doing a nice developmental edit,
      <contact fullname="Tim Wattenberg"/> for doing an SRP requester
      proof-of-concept implementation at the Montreal Hackathon at IETF 102,
      and <contact fullname="Tom Pusateri"/> for reviewing during the
      hackathon and afterwards. Thanks to <contact fullname="Esko"/> for a
      really thorough second Last Call review. Thanks also to <contact fullname="Nathan Dyck"/>, <contact fullname="Gabriel Montenegro"/>,
      <contact fullname="Kangping Dong"/>, <contact fullname="Martin Turon"/>,
      and <contact fullname="Michael Cowan"/> for their detailed second last
      call reviews. Thanks to <contact fullname="Patrik Fältström"/>, <contact fullname="Dhruv Dhody"/>, <contact fullname="David Dong"/>, <contact fullname="Joey Salazar"/>, <contact fullname="Jean-Michel Combes"/>, and
      <contact fullname="Joerg Ott"/> for their respective directorate
      reviews. Thanks to <contact fullname="Paul Wouters"/> for a
      <em>really</em> detailed IESG review! Thanks also to the other IESG
      members who provided comments or simply took the time to review the
      document.</t>
    </section>
    <section anchor="authors-addresses" numbered="false" removeInRFC="false" toc="include" pn="section-appendix.e">
      <name slugifiedName="name-authors-addresses">Authors' Addresses</name>
      <author initials="T." surname="Lemon" fullname="Ted Lemon">
        <organization showOnFrontPage="true">Apple Inc.</organization>
        <address>
          <postal>
            <street>One Apple Park Way</street>
            <city>Cupertino</city>
            <region>CA</region>
            <code>95014</code>
            <country>United States of America</country>
          </postal>
          <email>mellon@fugue.com</email>
        </address>
      </author>
      <author initials="S." surname="Cheshire" fullname="Stuart Cheshire">
        <organization showOnFrontPage="true">Apple Inc.</organization>
        <address>
          <postal>
            <street>One Apple Park Way</street>
            <city>Cupertino</city>
            <region>CA</region>
            <code>95014</code>
            <country>United States of America</country>
          </postal>
          <phone>+1 408 974 3207</phone>
          <email>cheshire@apple.com</email>
        </address>
      </author>
    </section>
  </back>
</rfc>
