Experimental DNS over TLS support

The USC/ISI root server began experiment support for DNS-over-TLS in 2023. Although our implementation predates the Experimental IETF’s RFC9539 that defines how recursive to authoritative DNS service should work, we believe our implementation closely aligns with its specification as much as possible.

Note that this service is experimental and we consider service of DNS-over-UDP and -TCP to be higher priority than DNS-over-TLS. (We reserve the right to halt TLS service without notice if needed.)

Testing it

You can test our TLS support using the ISC bind package’s dig utility, using the +tls option:

   $ dig +tls @b.root-servers.net . soa
   ...
   
   .			86400	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2024082600 1800 900 604800 86400
   
   ...
   
   ;; SERVER: 170.247.170.2#853(b.root-servers.net) (TLS)
   
   ...

Further information

Wes Hardaker announced USC/ISI’s TLS deployment at DNS-OARC. He also gave a presentation discussing DNS Security that discusses the differences in DNSSEC and DNS over TLS, and why they are complimentary solutions.

B-Root announced experimental TLS service in Feb. 2023.

PKIX Trust Anchor

The following trust anchor can used to authenticate our servers, or as a file: b.root-servers.net-CA.crt.