RFC Compliance
BoronDNS implements the DNS standards relevant to a secondary-only authoritative nameserver. This page records the compliance posture as of v0.2.0, synchronized with SRS v0.9.1.
All items marked Partial reflect the current Engineering MVP posture — implementation is in place and tested, but full release traceability, broader interop evidence, or release-level assertions remain open until the formal SRS MVP release. This is honest reporting: we do not claim compliance we cannot yet evidence.
Core DNS
| RFC | Title | Status |
|---|
| RFC 1034 | Domain Names — Concepts and Facilities | Partial (secondary/server-side clauses) |
| RFC 1035 | Domain Names — Implementation and Specification | Partial (wire format, RR format, authoritative response, TCP framing) |
| RFC 2181 | Clarifications to the DNS Specification | Partial (RRset, TTL, SOA, NODATA, truncation) |
| RFC 4343 | DNS Case Insensitivity Clarification | Partial |
| RFC 2308 | Negative Caching of DNS Queries | Partial (authoritative negative-response composition) |
| RFC 8020 | NXDOMAIN Cut | Partial (authoritative empty-subtree response semantics) |
| RFC 8482 | Minimal ANY Responses | Partial (subset-of-available-RRsets; HINFO synthesis prohibited) |
Zone transfers
| RFC | Title | Status |
|---|
| RFC 5936 | DNS Zone Transfer Protocol (AXFR) | Partial (AXFR client-side clauses) |
| RFC 1995 | Incremental Zone Transfer in DNS (IXFR) | Partial (IXFR client-side clauses) |
| RFC 1996 | DNS NOTIFY | Partial (NOTIFY receiver-side clauses) |
| RFC 9432 | DNS Catalog Zones | Partial (catalog consumer; optional BoronDNS member-transfer extension) |
TSIG and authentication
| RFC | Title | Status |
|---|
| RFC 8945 | Secret Key Transaction Authentication for DNS (TSIG) | Partial (request/response, transfer, NOTIFY authentication) |
| RFC 4635 | HMAC SHA TSIG Algorithm Identifiers | Partial |
Transport security
| RFC | Title | Status |
|---|
| RFC 9103 | DNS Zone Transfer over TLS (XoT) | Partial (client-side; TLS 1.3-only, SNI, ALPN dot, configured trust anchors, optional mTLS, no cleartext fallback) |
| RFC 8446 | TLS 1.3 | Partial (via rustls) |
| RFC 9325 | Recommendations for Secure TLS Use | Partial (TLS 1.3-only transfer-client profile via rustls) |
| RFC 6066 | TLS Extensions (SNI) | Partial |
| RFC 5280 | PKIX Certificate and CRL Profile | Partial (X.509 path validation for XoT trust anchors; no revocation checking) |
| RFC 7858 | DNS over TLS (ALPN dot identifier for XoT) | Partial |
EDNS
| RFC | Title | Status |
|---|
| RFC 6891 | Extension Mechanisms for DNS (EDNS(0)) | Partial |
| RFC 7766 | DNS Transport over TCP | Partial |
| RFC 7828 | edns-tcp-keepalive EDNS0 Option | Partial |
| RFC 7830 | EDNS(0) Padding Option | Partial (accepted, not generated) |
| RFC 5001 | DNS Name Server Identifier Option (NSID) | Partial |
| RFC 8914 | Extended DNS Errors | Partial (opt-in: Not Ready and Unsupported NSEC3 Iterations) |
| RFC 5452 | DNS Resilience against Forged Answers | Partial (QID and source-port entropy) |
DoS resistance
| RFC | Title | Status |
|---|
| RFC 7873 | Domain Name System (DNS) Cookies | Partial (server-side; BADCOOKIE; RRL interaction; staged rollover) |
| RFC 9018 | Interoperable DNS Server Cookies | Partial (version-1 server cookie; current-plus-previous staged rollover) |
Record types
BoronDNS transfers, stores, and serves any record type present in the zone. All standard and unknown types are handled faithfully.
| Record types | RFC |
|---|
| A, NS, SOA, MX, TXT, CNAME, PTR, AAAA | RFC 1035, RFC 3596 |
| SRV | RFC 2782 (Partial) |
| NAPTR | RFC 3403 (Partial) |
| DNAME | RFC 6672 (Partial) |
| CAA | RFC 8659 |
| TLSA, SMIMEA | RFC 6698 |
| SSHFP | RFC 4255 |
| HTTPS, SVCB | RFC 9460 (Partial) |
| URI | RFC 7553 (Partial) |
| DANE TLSA | RFC 6698 (Partial — RR format only; no DANE validation) |
| Unknown types (TYPE65XXX) | RFC 3597 (Partial — opaque pass-through) |
DNSSEC
BoronDNS serves DNSSEC records (RRSIG, DNSKEY, DS, NSEC, NSEC3) exactly as received from the primary. It does not perform zone signing, online signing, or signature validation.
| RFC | Title | Status |
|---|
| RFC 4034 | Resource Records for DNSSEC | Partial (serve-only RR formats) |
| RFC 4035 | DNSSEC Protocol Modifications | Partial (authoritative serve-only response behavior; no validation) |
| RFC 5155 | DNSSEC NSEC3 | Partial (serve-only; NSEC3 iterations cap with EDE) |
| RFC 6840 | DNSSEC Clarifications | Partial (serve-only DO, AD, CD bit handling) |
| RFC 1982 | Serial Number Arithmetic | Partial (SOA serial comparison in IXFR and zone refresh) |
Explicitly out of scope
The following are intentionally not implemented — they require recursive or primary-only functionality:
| RFC | Title | Reason |
|---|
| RFC 1034 §4.3.2 | Recursive resolution | BoronDNS is secondary-only |
| RFC 2136 | DNS Dynamic Update | Secondary-only; updates arrive from primary via IXFR |
| RFC 7314 | EDNS EXPIRE Option | Explicitly excluded Experimental option; ordinary SOA refresh/expire is in scope |
| RFC 4033 | DNS Security Introduction | Informative only — cited for architecture context |
The full compliance matrix, evidence pointers, and traceability to SRS v0.9.1 are published in the project repository at github.com/Integrity-Ltd/borondns.