RFC 6891

Q: What does the Introduction section cover in RFC 6891 — EDNS0?

The Introduction section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 6891 — EDNS0. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the OPT Pseudo-RR section cover in RFC 6891 — EDNS0?

The OPT Pseudo-RR section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 6891 — EDNS0. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Key Extensions section cover in RFC 6891 — EDNS0?

The Key Extensions section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 6891 — EDNS0. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Security Considerations section cover in RFC 6891 — EDNS0?

The Security Considerations section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 6891 — EDNS0. This content is part of the BLACKLABS RFC Reference Library.

BLACKLABS

Extension Mechanisms for DNS (EDNS(0))

Standards Track Obsoletes: RFC 2671

April 2013

Abstract: EDNS(0) extends the DNS protocol to support larger messages, additional flags, and new option codes. It is required by DNSSEC and enables modern DNS features needed for 3GPP DNS-based service discovery.

Canonical source: https://www.rfc-editor.org/rfc/rfc6891 | IETF Datatracker

1. Introduction

▶

The original DNS message format (RFC 1035) limits messages to 512 bytes (UDP) and has no extension mechanism. EDNS(0) uses a pseudo-resource-record (OPT RR) in the additional section to advertise extended capabilities.

EDNS(0) is mandatory for DNSSEC (which requires larger messages for signatures). It is also needed for DNS-based service discovery in 3GPP networks where SRV records with multiple entries may exceed 512 bytes.

2. OPT Pseudo-RR

▶

Field	Meaning
NAME	Always root domain (0x00)
TYPE	41 (OPT)
CLASS	Requestor's UDP payload size (e.g., 4096)
TTL	Extended RCODE + flags (DO bit for DNSSEC)
RDDATA	Variable-length options (OPTION-CODE + OPTION-DATA)

3. Key Extensions

▶

UDP message size: Advertise support for messages up to 4096+ bytes (vs. 512 byte limit)
DO (DNSSEC OK) bit: Enables DNSSEC-aware responses with RRSIG records
Extended RCODE: 12-bit RCODE support (vs. 4-bit original) for additional error codes
EDNS options: Extensible option codes for future features
COOKIE option: DNS Cookies for DoS mitigation and off-path spoofing protection

4. Security Considerations

▶

Larger DNS messages can be used for amplification attacks — rate limiting recommended
EDNS is required for DNSSEC validation — disabling EDNS breaks DNSSEC
DNS Cookie option helps prevent address spoofing and amplification
Middleboxes that strip OPT records can break DNSSEC and other modern DNS features