The Domain Name System (DNS) dates back to the early 1980s. Despite its age, it has scaled remarkably well and remains a fundamental building block of today's Internet. However, the way the DNS delegates administrative authority from a parent domain (such as .org) to a child domain (such as example.org) hasn't changed since the DNS was created. An upcoming enhancement to the DNS will change how delegation is indicated and will allow new features, such as further security improvements.
The introduction of DNS Security Extensions (DNSSEC) was a major milestone, but it does not encrypt DNS traffic. Historically, DNS data was considered public, and queries were assumed not to reveal much about users. This thinking turned out to be overly simplistic. In reality, unencrypted DNS traffic enables both surveillance and manipulation.
Encrypting the communication between applications and resolvers is straightforward, but doing so between resolvers and authoritative servers creates a chicken-and-egg problem: How does a resolver learn the required security parameters before connecting?
Today, the only information an authoritative server provides for a delegation is the names of the servers responsible for the next level in the hierarchy and, with DNSSEC, a pointer to the cryptographic key needed to validate answers.
A new DNS enhancement being developed by the Internet Engineering Task Force (IETF) allows additional information to be included as part of the delegation. In the case of encrypted DNS, that additional information could include the cryptographic- and protocol-related parameters that a resolver can use to establish a secure channel to the delegated name servers. Making such a significant change to how DNS delegation works needs some good old fashioned protocol engineering. In fact, this work is being done by the IETF in the DELEG Working Group.
This is not a straightforward exercise. These new delegation extensions (called "DELEG" for short) require additions to the foundation of the DNS protocol, while remaining compatible with the installed base in such a way that it allows gradual deployment. In addition, these new delegation extensions need to be future-proof, so that additional elements can easily be added, without requiring changes to the protocol.
If the DNS is to continue serving as a resilient and trustworthy foundation for the Internet, its delegation model must evolve in line with the increasing threat model. Extending delegations to carry the information needed for encrypted resolver-to-authoritative communication is a natural next step. The DELEG protocol extension preserves the strengths of the existing system while enabling a more secure and flexible future.
The work underway in the DELEG Working Group represents an opportunity to modernize one of the oldest parts of the DNS architecture. By embracing these changes, the DNS community can ensure that the protocol remains robust not only for today's applications, but also for the generations of technologies and users that will rely on it next.