Hello, welcome to the Wednesday, November 8, 2020,

edition of the Sandcent Storm Center's Stormcast.

My name is Johannes Ulrich,

and today I'm recording from Jacksonville, Florida.

Wrote up a quick new addition to DNS

that you may be seeing in your networks. It was included with the update

to iOS 17 apparently and also can be enabled in Windows. The extension here is the discovery

of designated resolvers or DDR and thanks to Twitter user HQuest for pointing this out to me.

The idea behind this protocol is that it allows clients to automatically discover any resolvers

that offer DNS over TLS, DNS over HDPS, or DNS over Quick.

The way this works is that you will see requests for underscore DNS.resolver.orga.

Resolver.

Arpa is reserved for this particular feature, and then a resolver that your client is using

may respond essentially with instruction

telling it how to use this reserver

or an other resolver for that matter

using one of these more secure protocols.

The record being used here is a service binding record

or SVCB record,

a little bit sort of like HTTP records in that it'll tell you what application layer protocol

to use, what port the Resolver is listening on, and then in the case of DNS over HTTP,

it will also basically tell you the URL to then access and where to add

...