| Internet-Draft | IoT-DNS-Guidelines | October 2026 |
| Mishra, et al. | Expires 25 April 2027 | [Page] |
This document outlines guidance for Internet of Things (IoT) manufacturers regarding the implementation of DNS stub resolver software on devices, and for the management zones used for purposes such as device configuration and software upgrades. It aims to mitigate security threats, enhance privacy, and to address operational security challenges.¶
DNS resolution between devices and management zone servers depends upon DNS services within operator networks, and these services and operator networks can be impacted by device behavior. Hence, this document also provides guidance to network operators that deploy IoT devices to mitigate the specific risks identified in this document and take advantage of improved DNS security mechanisms provided by manufacturers.¶
This note is to be removed before publishing as an RFC.¶
The latest revision of this draft can be found at https://miishra.github.io/IoT-DNS-Guidelines/draft-mishra-iotops-iot-dns-guidelines-latest.html. Status information for this document may be found at https://datatracker.ietf.org/doc/draft-ietf-iotops-iot-dns-guidelines/.¶
Source for this draft and an issue tracker can be found at https://github.com/miishra/IoT-DNS-Guidelines.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 25 April 2027.¶
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
Research into the DNS behavior of IoT devices [UCLandInriaPaper] shows widespread non-compliance with protocol standards, gaps in protocol support, and security vulnerabilities. This leads to unpredictable operational behavior and exposes devices to fingerprinting and denial-of-service attacks. This document provides DNS guidance across the IoT resolution path (device, resolver, and authoritative infrastructure), with primary emphasis on device behavior aimed at IoT manufacturers.¶
The recommendations in this document are organized according to three roles: (1) IoT device manufacturers, concerning DNS functionality implemented on devices; (2) operators of authoritative DNS zones used for device management and related services; and (3) network operators providing recursive DNS resolution or DNS-based security controls to IoT devices. Sections Section 4, Section 5, and Section 6 address these roles, respectively. While the guidance in this document may apply to any device using DNS, this document considers IoT devices as a specific case where targeted recommendations are useful for the following reasons:¶
The recommendations address specific IoT-related security concerns not seen in the DNS behavior of general-purpose operating systems¶
IoT devices have different resource characteristics from general-purpose devices, such as constrained power consumption, meaning incorrect software implementations can have an increased operational impact on device functionality¶
IoT devices do not typically have endpoint security agents installed on them that are widely used on general-purpose operating systems¶
There are many DNS RFCs, and this document can be used to identify those related to specific security issues observed through research into IoT devices, with the aim of making it easier to address these vulnerabilities¶
IoT devices may be deployed at scale on dedicated networks where device behavior cannot be changed post-deployment, making these recommendations particularly useful to network security teams in mitigating vulnerabilities¶
Manufacturers may use standard software distributions aimed at IoT devices without considering DNS behavior, and the guidelines here can be used as part of the criteria to evaluate these distributions¶
IoT devices typically perform the same set of DNS queries on start-up, which makes them both more vulnerable because of this predictable behavior and also more prone to network fingerprinting [IoTDeviceIdentificationUsingPassiveNetworkTrafficAnalysis]¶
This document is primarily concerned with device-to-cloud communication [RFC7452], but DNS may be used in other IoT device communication patterns. Hence recommendations apply to any deployment type where DNS is used, but decisions on implementation will be proportionate to the associated security risks and operational considerations. For example, the implementation of Section 4.1 and Section 4.2 would be appropriate to any implementation, whereas Section 4.6 may not be proportionate in industrial automation environments where devices do not encrypt other types of traffic [RFC9150]. Multicast DNS (mDNS) [RFC6762] is a distinct protocol from unicast DNS and is out of scope in these recommendations.¶
Threats and associated mitigations are summarized in the table below, along with a link to the relevant sections.¶
| Threat | Mitigation Summary | Section |
|---|---|---|
| Hard-coded or ignored DNS resolver configuration | Use configurable resolvers; do not fall back to hard-coded resolvers | Section 4.1 |
| Predictable source ports or transaction IDs | Use unpredictable transaction IDs across the full 16-bit range and ensure source ports are random and span a large a range as practical, using different source ports for concurrent queries | Section 4.2 |
| Excessive or fixed-interval queries that ignore TTLs | Honor TTLs; cache responses where resources permit; avoid deterministic revalidation intervals | Section 4.3 |
| Poor EDNS(0) support or oversized DNS/UDP messages | Support EDNS(0); advertise safe UDP payload sizes to avoid fragmentation; retry over TCP when the TC bit is set | Section 4.4 |
| Retry storms following resolution failures | Bound query retries; cache resolution failures; use serve-stale where applicable | Section 4.5 |
| Unencrypted DNS traffic | Support an appropriate protected DNS transport, such as DoT, DoQ, DoH, or protected DoC, where feasible | Section 4.6 |
| Spoofed DNS responses or AiTM redirection | DNSSEC-sign manufacturer-operated management zones; rely on validation by a trusted resolver or perform local DNSSEC validation | Section 4.7, Section 5.1 |
| Compromised devices used for DoS with forged source addresses | Implement ingress filtering; use DNS Response Rate Limiting (RRL) where appropriate | Section 6.4 |
DNS terminology in this document conforms to [BCP219].¶
| Terminology | Description |
|---|---|
| AiTM | adversary-in-the-middle attacks |
| DoS | Denial of Service |
| Stub Resolver | DNS resolver functionality on an IoT device that relies on an upstream recursive resolver. IoT devices addressed by this document are assumed to operate as stub resolvers, or local resolver components that rely on an upstream recursive resolver. IoT devices operating as full recursive resolvers are out of scope for this document. |
| Resolver | The recursive DNS resolver used by the IoT device |
| Management zone | A DNS zone operated by an entity, hosting its devices' and management servers' records |
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶
An IoT device may implement DNS resolution using a stub resolver, a validating stub resolver, or another suitable local resolver component. This document does not require IoT devices to use a particular resolver architecture. Unless otherwise stated, the recommendations in this section apply to DNS stub resolver functionality implemented on the device. The following guidance specifies expected behavior for IoT device stub resolvers to ensure secure, privacy-preserving, and operationally efficient DNS resolution.¶
IoT devices have been observed to fall back to hard-coded IP addresses for DNS resolvers [UCLandInriaPaper], such as well-known open resolvers [CharacterizingSmartHomeIoTTraffic], or ignore addresses assigned to them via automated configuration methods such as DHCP Option 6 [RFC2132].¶
Such behavior can bypass network DNS policies and can prevent devices from functioning correctly when the hard-coded resolver is unreachable or blocked by the network.¶
The DNS resolver configuration used by an IoT device MUST be configurable through applicable network configuration protocols or authorized device-management mechanisms. Devices MUST NOT fall back to hard-coded public resolvers.¶
Devices SHOULD use the following priority order for selecting a resolver. The first one that results in a valid DNS response SHOULD be selected.¶
Manual user configuration¶
Device management software authorized for configuration purposes¶
IPv6 Router Advertisement (RA) [RFC8106], DHCPv6 [RFC9915] using DNS configuration options such as those defined in [RFC3646], and IPv4 DHCP [RFC2132]. When encrypted resolver options are present in DHCP or IPv6 Router Advertisements [RFC9463], they SHOULD be used.¶
If the selected resolver is identified only by an IP address and encrypted resolver information was not otherwise provided, Discovery of Designated Resolvers (DDR) [RFC9462] MAY be performed to discover an encrypted resolver, where available.¶
Some IoT devices have been observed to have insufficient or no randomization in the source ports of DNS queries or DNS transaction IDs, making them vulnerable to spoofed responses. A combination of Source Port and Transaction ID is used, amongst other criteria, by the stub resolver when accepting a DNS response.¶
Device behavior MUST be consistent with Sections 4.5 and 9.2 of [RFC5452]. Stub resolvers sending DNS queries over UDP MUST use unpredictable DNS transaction IDs across the full 16-bit range and unpredictable source ports selected from as large a range of available ports as is practical. They MUST use multiple source ports when multiple DNS queries are outstanding.¶
IoT devices have been observed making unexpectedly high numbers of DNS queries even when DNS record Time-To-Live values (TTLs) would mean this should be unnecessary. Devices have also been observed issuing DNS queries at fixed, highly predictable intervals for the same domain names, regardless of operational changes or TTL values.¶
Unnecessary queries may lead to a drain of power in resource-constrained IoT devices. Conversely, very high TTLs may impact device operations such as communicating with management servers, receiving software updates, or other changes, which may lead to security issues. Deterministic query behavior that ignores TTL values increases the risk of device fingerprinting by adversaries who can profile query timing to identify specific device models or firmware versions.¶
Manufacturers MUST configure the records in authoritative zones with TTL values appropriate to the use of the records by devices, ensuring the TTL is not too low to cause unnecessary queries for frequently used names, but not high enough to cause operational issues, such as when the IP address of an A record in a management zone changes.¶
IoT device resolver implementations SHOULD cache positive DNS responses when sufficient memory and other device resources are available. Implementations that cache DNS resource records MUST expire, or otherwise process cached records in accordance with their TTLs.¶
Where minimum or maximum cache TTL values are supported, these values SHOULD be configurable through an appropriate device-management mechanism rather than fixed by the implementation. When device stub resolvers cannot be configured with minimum and maximum TTL values, this MAY be mitigated by setting these on the network resolver.¶
If certain device operational requirements necessitate periodic revalidation of critical domains (e.g., management servers), these repeated queries SHOULD use non-deterministic inter-query timing to avoid predictable timing patterns that could enable traffic fingerprinting.¶
In the event of resolution failure (e.g., no response from the resolver), devices SHOULD implement back-off strategies to limit unnecessary query traffic; also see Section 4.5.¶
Devices have been observed having limited support for EDNS(0), causing them to revert to TCP for queries over 512 bytes, affecting the device's efficiency. Other research findings include increased processing overhead and devices failing to maintain their network connectivity when responses to DNS requests exceed 512 bytes.¶
IoT devices MUST support EDNS(0) and send a supported UDP packet size via OPT 41 [RFC6891]. To avoid fragmentation of UDP packets, which may be dropped by intervening networks, manufacturers MUST follow guidance in [RFC9715], although device configuration MAY allow this to be configurable. Although the networks to which IoT devices connect may support larger packet sizes, the nature of these devices in being deployed on many network types, and DNS queries traversing networks controlled by different operators, means it is operationally more effective to use a smaller size that avoids fragmentation. In addition, IoT devices MUST support using both TCP and UDP for queries, and support switching to TCP when a TC bit is returned from the resolver [RFC1035].¶
For constrained networks where DNS messages may exceed the available link-layer frame size, implementations SHOULD also consider DNS over CoAP as described in Section 4.8.¶
When resolving domain names, IoT devices may not receive a response from a resolver. This can result in surges in DNS queries and retries, or increased use of an alternative protocol (e.g., querying over IPv6 more frequently than over IPv4).¶
Device resolver implementations MUST comply with the retry and resolution-failure caching requirements in Section 3.2 of [RFC9520]. In particular, a resolver MUST NOT retry a given query to the same server address over the same DNS transport more than twice before considering that server address unresponsive for the query, and MUST cache resolution failures for at least one second. Implementations SHOULD limit the memory and processing resources allocated to the resolution-failure cache.¶
If supported by the stub-resolver implementation on device operating systems, the use of serve-stale [RFC8767] on the IoT device may mitigate the impact of failed resolution, such as when authoritative servers are unavailable. This will reduce the impact of surges in DNS traffic if the network resolver is unreachable, and it may allow the device to maintain ongoing communication with endpoints for which previously valid DNS data remain usable.¶
The majority of IoT devices use unencrypted DNS over port 53, which means this traffic can be captured and is open to interception and manipulation. Encrypted DNS protocols are not mandated for compliance with DNS standards, but the use of encrypted DNS may be mandated by some regulators and advised by competent authorities [ENISAGuidanceForNIS2] in deployment guidelines. Encrypted DNS support is widely deployed, and it is possible for IoT devices to discover DNS resolver support for this as described in Section 4.1.¶
IoT devices SHOULD support at least one encrypted DNS transport, such as DNS over TLS (DoT) [RFC7858], DNS over QUIC (DoQ) [RFC9250], or DNS over HTTPS (DoH) [RFC8484], when doing so is feasible and does not impair device operation because of power, memory, computational, or other deployment constraints. This enhances privacy by preventing passive observation of DNS queries, improves security by mitigating adversary-in-the-middle (AiTM) attacks, and enables compatibility with resolvers that require encrypted transport. When encrypted DNS is used, devices SHOULD use EDNS(0) padding as described in [RFC7830] and [RFC8467] to reduce size-based traffic fingerprinting, where doing so does not cause excessive fragmentation, energy consumption, or other operational costs. Padding policies suitable for conventional networks may be inappropriate on constrained links with small frame sizes.¶
IoT devices can be induced to connect to an adversary's server or make large volumes of DNS queries via spoofed responses to queries. It would be difficult for manufacturers to mitigate this by implementing checks of data received via DNS queries, such as validating IP addresses in the A/AAAA record RDATA, as this does not reliably prevent malicious redirection. In addition, any validation of this type does not address the problem of AiTM attacks targeting DNS query responses.¶
DNSSEC can be implemented by manufacturers to mitigate AiTM attacks on DNS query responses. Note that manufacturers MUST have signed public zones used for device management and services so that validation can take place. This improves security when devices do not perform local validation, as many network operators deploy validating resolvers.¶
Manufacturers MAY improve device security by utilizing DNSSEC validation [RFC9364] on the stub resolver. When supported, devices typically follow one of two models for validation (see Table 3) by setting a combination of the DO and CD bits in DNS queries:¶
Stub-resolver checking for validation - the stub resolver checks for the Authenticated Data (AD) bit in the response, which is suitable for constrained devices but requires explicit trust in the upstream resolver performing correct DNSSEC validation¶
Stub-resolver performing full validation - local cryptographic checks of DNSSEC-related records, providing stronger assurance¶
Both models improve security over unvalidated queries, but manufacturers should weigh the security considerations, such as trust assumptions, against the operational feasibility when determining which approach to adopt. Manufacturers should consider the type of network the device is likely to be deployed on, such as a home network vs. other environments, in determining the likelihood of DNSSEC validation being available on the network and thus deciding if the device should rely on a validating resolver or be independently capable of performing DNSSEC validation.¶
The deployment options are summarised below, with two constituting the typical deployment scenarios:¶
| DO Bit | CD Bit | Resolver Validated? | DNSSEC RRs Returned? | Notes |
|---|---|---|---|---|
| Y | Y | N | Y | Resolver does not validate. DNSSEC data returned. Stub-resolver performing full validation deployment. |
| Y | N | Y | Y | Resolver validates. DNSSEC data returned. Stub-resolver can use AD bit to check validation. |
| N | Y | N | N | Resolver does not validate. No DNSSEC data returned. Do not use. |
| N | N | Y | N | Resolver validates. No DNSSEC data. Stub-resolver checking for validation deployment. |
Where a manufacturer implements DNSSEC validation on the device, the minimum implementation will be a stub resolver checking the AD bit to see if the answer has been validated. Relying solely on the AD bit assumes that the upstream resolver is trustworthy and uncompromised.¶
Manufacturers may implement a testing mechanism to determine if the network resolver supports DNSSEC, enabling the device to utilize validation when available in a network that supports it, or falls back to unvalidated answers. Any such test of the resolver will only validate that it supports DNSSEC; given that the resolver is performing the validation, it must be explicitly trusted.¶
To determine whether a DNS response has been validated, a stub resolver MUST check the Authenticated Data (AD) bit [RFC4035] in responses to determine whether data was validated by the resolver it is using. When checking for the AD bit, stub resolvers MUST treat DNSSEC validation failures as fatal. Responses that fail validation MUST NOT be used for name resolution.¶
A device stub resolver MAY perform DNSSEC validation locally when the network resolver does not perform validation or when the device does not trust the network resolver to do so. Local validation introduces additional implementation, processing, memory, and trust-anchor-management requirements that manufacturers need to consider for constrained devices.¶
Considerations for device manufacturers in implementing full validation include:¶
Devices performing local validation gain end-to-end trust but at a higher computational cost¶
Devices should cache results, including validation outcomes, to reduce repeated computation¶
Devices need to be shipped with a root trust anchor and have a mechanism to update this securely¶
IoT devices that perform local DNSSEC validation MUST conform to the applicable DNSSEC validation requirements in [RFC4035]. Manufacturers MAY implement this functionality in a validating stub resolver, a local validating resolver, or another suitable local resolver component.¶
Devices performing local DNSSEC validation MUST maintain authenticated DNS trust anchors and MUST provide a secure mechanism to provision and update them. Manufacturers SHOULD support automated trust-anchor updates as described in [RFC5011] and SHOULD account for changes to DNSSEC cryptographic algorithms. Device software updates MAY include changes to the CA root store to support the TLS used in Encrypted DNS protocols.¶
DNS over CoAP (DoC) [RFC9953] provides a DNS transport for constrained IoT environments using CoAP [RFC7252], with confidentiality and integrity provided by (D)TLS or OSCORE [RFC8613]. DoC is appropriate where the resource or transport characteristics of constrained devices make DoT, DoH, or DoQ unsuitable. The choice of DNS transport SHOULD consider device resources, available protocol stacks, network characteristics, and operational requirements.¶
Implementations MUST conform to all requirements specified in [RFC9953], these include resolver configuration, request/response matching, caching, retransmission, and security. Implementations MUST additionally follow [RFC7252] and [RFC7959] where requirements interact with the underlying CoAP transport.¶
Implementations where traffic analysis is a concern SHOULD consider message size, timing, and packet-count characteristics when selecting DoC block sizes, padding, and header-compression mechanisms. Mitigations including block-size selection and final-block padding are discussed in [RFC9953] and [LendersDoCPrivacy]; SCHC [RFC8724] MAY additionally be used to reduce observable header information.¶
Manufacturers SHOULD provide network operators with accurate and current information about the domain names, domain-name patterns, and external services required for device operation. When providing details of the domains used by a device for network security, manufacturers SHOULD include all such domains, including those outside their direct control, such as content delivery networks or cloud services. This allows network operators to distinguish legitimate device traffic from anomalous or malicious traffic.¶
Manufacturer Usage Descriptions (MUDs) [RFC8520] can provide machine-readable information that defines the network communications required for device operation and can support the deployment of network security controls. Manufacturers SHOULD publish device communication requirements, including relevant management domain names, in a publicly retrievable MUD file [RFC8520] where applicable, or in comparable manufacturer documentation.¶
Manufacturers SHOULD update this information when device dependencies change so that device operations are not impacted.¶
Manufacturers use public authoritative DNS zones for purposes such as device configuration, control, and upgrades. This section covers guidance for manufacturers in operating these zones.¶
Zones supporting the management and data collection of devices MUST be DNSSEC signed in order to support the behavior described in Section 4.7 and Section 6.1. The zones used for these purposes SHOULD be publicly listed for network operators to use in securing their networks as described in Section 6.2.¶
As stated in Section 4.3, manufacturers MUST configure TTL values for management zone records that are appropriate for device operations, considering a balance between avoiding excessive query traffic, maintaining continuous operation in the event the resolver is unreachable, and accommodating potential changes in RDATA such as management IP addresses.¶
This section provides guidance to operators that have IoT devices on their networks. Manufacturers should be aware of the network operator guidance in this section as devices will use these resolvers, even though this infrastructure is not under the manufacturer's control.¶
Most IoT devices do not have dedicated security software agents, as are commonly available for general-purpose operating systems. In addition, supply chain vulnerabilities may result in devices being compromised before they reach the consumer. Network operators can use DNS resolvers to mitigate these risks, although this will vary depending on policy. These networks may be public, without restrictions on DNS usage, or may be private networks that could be dedicated to IoT devices where operators implement more security controls to mitigate these risks.¶
Some aspects of DNS security rely on the resolution process between stub resolver, resolver, and authoritative servers, as well as DNS record types (notably DNSSEC). It is therefore necessary for network operators to implement DNS in such a way as to support some of the recommendations in Section 4.¶
In order to support improving device DNS security as described in Section 4.7, resolvers SHOULD be configured to validate DNS responses using DNSSEC.¶
Private network operators may block DNS traffic to resolvers not managed by the operator to prevent bypass of DNS security controls, such as Response Policy Zones (RPZs) and DNS traffic logging. This practice is more common on enterprise and other private networks than on service-provider networks, where operators may avoid restricting customers' use of alternative resolvers.¶
Where operators maintain networks dedicated to IoT devices, they MAY restrict DNS resolution to domain names that are necessary for normal device operation in order to reduce the impact of a device compromise.¶
Network operators MAY use manufacturer-provided domain dependency information, including MUDs [RFC8520], to distinguish legitimate device traffic from anomalous or malicious traffic.¶
Recursive resolvers serving constrained IoT networks SHOULD minimize unnecessary DNS response data where supported by the resolver implementation. In particular, operators SHOULD use minimal-response configurations that avoid unnecessary Additional-section records while retaining records required for correct DNS resolution and the semantics of the queried RR type [RFC9715].¶
Reducing unnecessary response data can reduce bandwidth usage, processing overhead, energy consumption, and the likelihood of fragmentation on constrained links.¶
Providers should optimize resolver configurations to mitigate the security and operational risks identified in this document, provided that such optimizations do not adversely affect the operation of other DNS clients.¶
Network operators SHOULD optimize DNS resolver configurations through the use of serve-stale mechanisms, as specified in [RFC8767]. This is particularly recommended in environments dedicated to supporting IoT devices, in order to minimize operational disruption during DNS resolution failures. Recursive DNS resolvers provided to IoT devices SHOULD be able to perform dual-stack DNS resolution, consistent with [RFC10001].¶
DNS queries are most commonly transported over UDP, and compromised devices have been used to launch DoS attacks by sending queries with forged source addresses. Therefore, network operators MUST implement [RFC2827] network ingress filtering. Network operators SHOULD implement DNS Response Rate Limiting (RRL) on resolvers to mitigate high query volumes from devices causing DoS attacks against DNS infrastructure.¶
IoT devices are often deployed at scale, operate under resource constraints, and typically lack host-based security controls. Consequently, weaknesses in DNS behavior can increase exposure to spoofing, on-path attacks, amplification, and fingerprinting. The recommendations in this document improve the security properties of DNS resolution by promoting correct protocol behavior, reducing unnecessary or anomalous query traffic, and supporting the use of authenticated and integrity-protected data (e.g., DNSSEC) and encrypted transport. The effectiveness of these measures depends on coordinated deployment across stub resolvers, recursive resolvers, and authoritative servers. Partial deployment may reduce the benefits of some mechanisms.¶
Residual risks remain, including device compromise outside the DNS layer, misconfiguration, and reliance on untrusted upstream resolvers. In addition, the use of encrypted DNS may limit network-based inspection and policy enforcement. This document does not introduce new protocols or mechanisms; it reduces the attack surface and improves the predictability and resilience of DNS interactions in IoT environments.¶
This document has no IANA actions.¶
We thank the researchers, reviewers, and engineers who contributed to the analysis and testing process.¶
The authors thank Mohamed Boucadair, Chris Box, Ross Gibson, Eliot Lear, Jim Reid, Martine Lenders, Michael Richardson, Patrick Mevzek and Hannes Tschofenig for their contributions, questions and comments.¶