For the technical audience

Standards we speak

Status comes from one data file that the build checks against the project roadmap, so this page can't quietly drift from the code.

supportedpartialplannedRequirement IDs link to the specification.

25 supported · 1 partial · 1 planned

RFCStandardStatusRequirements
RFC 1035Domain names — implementation and specificationsupportedDNS-001
RFC 2308Negative caching of DNS queriessupportedDNS-006
RFC 4033DNSSEC introduction and requirementssupportedDNS-011
RFC 4034Resource records for DNSSECsupportedDNS-011
RFC 4035Protocol modifications for DNSSECsupportedDNS-011
RFC 4343DNS case insensitivity clarificationsupportedDNS-006
RFC 5001DNS Name Server Identifier (NSID) optionsupportedDNS-021
RFC 5424The Syslog ProtocolsupportedOBS-010
RFC 5452Measures for making DNS more resilient against forged answerssupportedUPS-001
RFC 6147DNS64supportedDNS-016
RFC 6666A discard prefix for IPv6 (100::/64)supportedFLT-017
RFC 6761Special-use domain namessupportedDNS-019
RFC 6762Multicast DNS (listening for device names)supportedAPI-010
RFC 6891Extension mechanisms for DNS (EDNS(0))supportedDNS-005
RFC 7766DNS transport over TCPsupportedDNS-001 UPS-008
RFC 7858DNS over TLS (DoT)supportedUPS-001 DNS-002
RFC 7871Client subnet in DNS queries (ECS)supportedDNS-015
RFC 8109Initializing a DNS resolver with priming queriessupportedDNS-012
RFC 8482Minimal responses to ANY queriessupportedDNS-019
RFC 8484DNS queries over HTTPS (DoH)supportedUPS-001 DNS-003
RFC 8767Serving stale data to improve DNS resiliencysupportedDNS-007
RFC 8914Extended DNS ErrorssupportedDNS-013
RFC 9156QNAME minimizationsupportedDNS-012 UPS-012
RFC 9250DNS over dedicated QUIC (DoQ)supportedDNS-004 UPS-002
RFC 9520Negative caching of DNS resolution failuressupportedDNS-006
RFC 8198Aggressive use of DNSSEC-validated cachepartialDNS-011
RFC 9462Discovery of designated resolvers (DDR)plannedDNS-002

What each one adds

RFC 1035 supported

Domain names — implementation and specification. The DNS message format and UDP/TCP transport. Parsed zero-copy; malformed packets get FORMERR or are dropped cheaply.

DNS message: header, question, answer, authority, additional Header · ID · flags · 4 counts (12 bytes) Question: name · type · class Answer records Authority records Additional records (incl. OPT)

RFC 2308 supported

Negative caching of DNS queries. "No such name" answers are cached for the SOA-derived time (capped), so repeated typos and tracker probes don't hit upstreams.

NXDOMAIN cached for min(SOA TTL, SOA minimum, cap) NXDOMAIN SOA in authority answered from cache TTL = min(SOA TTL, MINIMUM, 1 h cap). No SOA → not cached.

RFC 4033 supported

DNSSEC introduction and requirements. Forwarded and recursive answers are validated from the root key down (with [dnssec] mode = "validate"; the 2017 and 2024 root keys are built in, or a trust anchors file): secure answers get AD, unsigned ones pass as they are, and bogus ones become SERVFAIL with EDE 6, or 7, 8, or 10 when the signatures show why.

The chain of trust from the root key to the answer, and what each verdict does root key TLD (DS) zone keys RRSIG secure → AD unsigned → as is bogus → SERVFAIL Forwarded with DO and CD; keys and proofs cached. Bogus carries EDE 6. CD from the client, or a negative trust anchor, skips validation.

RFC 4034 supported

Resource records for DNSSEC. DNSKEY, DS, RRSIG, NSEC, and NSEC3 are understood and checked; they're removed from answers for clients that didn't ask for them (no DO bit).

The chain of trust from the root key to the answer, and what each verdict does root key TLD (DS) zone keys RRSIG secure → AD unsigned → as is bogus → SERVFAIL Forwarded with DO and CD; keys and proofs cached. Bogus carries EDE 6. CD from the client, or a negative trust anchor, skips validation.

RFC 4035 supported

Protocol modifications for DNSSEC. DO and CD toward upstreams, AD only for answers proven here and clients that asked, CD from the client returns unvalidated data, and NXDOMAIN or NODATA answers are checked against their NSEC/NSEC3 proofs.

The chain of trust from the root key to the answer, and what each verdict does root key TLD (DS) zone keys RRSIG secure → AD unsigned → as is bogus → SERVFAIL Forwarded with DO and CD; keys and proofs cached. Bogus carries EDE 6. CD from the client, or a negative trust anchor, skips validation.

RFC 4343 supported

DNS case insensitivity clarification. Names are compared case-insensitively, but each client's exact letter case (0x20 randomization) is echoed back, even from cache.

Mixed-case question is echoed exactly, even from cache ExAmPlE.CoM? ExAmPlE.CoM The cache key uses the lowercase name; the reply echoes the client's exact bytes (0x20 anti-spoofing keeps working).

RFC 5001 supported

DNS Name Server Identifier (NSID) option. Off by default. Turned on, a query that asks for NSID learns which node or pod answered, handy behind a load balancer or a shared address; nobody else's answers change.

NSID option: the query asks with an empty option 3, the answer names the node query 3 0 answer 3 len resolver-pod-a dig +nsid: which node or pod answered

RFC 5424 supported

The Syslog Protocol. Query events to a syslog collector over UDP or TCP (RFC 6587 octet counting), one RFC 5424 message each with the event as JSON; notice severity for blocks.

Syslog message: priority, version, time, host, app name, then the query event as JSON <PRI>1 TIME HOST telltale - query - {"name": …, "status": "blocked", …} UDP datagram · TCP octet-counted frame event sink ✓ · notice for blocks, info otherwise

RFC 5452 supported

Measures for making DNS more resilient against forged answers. Every upstream query uses a fresh random ID and source port; answers must match ID, question, and type exactly or they're ignored.

Random ID and port; only exact matches are accepted ID 0x9f3a · :51873 upstream ✓same ID + question + type → accepted ✗anything else → ignored, keep waiting Client EDNS options are never forwarded.

RFC 6147 supported

DNS64. Per group: AAAA made from A records in the NAT64 prefix (64:ff9b::/96 by default) when a name has no AAAA; CNAMEs kept; not for CD clients.

DNS64: no AAAA for the name, so its A record becomes an AAAA inside the NAT64 prefix AAAA github.com? → no data A github.com → 140.82.112.4 AAAA 64:ff9b::8c52:7004 per group · NAT64 prefix /96 · not for CD clients

RFC 6666 supported

A discard prefix for IPv6 (100::/64). A Kubernetes workload counts in the analytics under one key, whichever pods ask: an address inside 100::/64, which is set aside for discarding traffic and never routes, so a key can't be mistaken for a real device. The query log keeps each pod's own address.

A workload's pods share one analytics key inside the discard prefix 100::/64, which never routes 10.42.0.11 10.42.0.12 10.42.0.13 100::… jellyfin one device per workload · the key never routes

RFC 6761 supported

Special-use domain names. localhost answers with loopback, .invalid and the Firefox canary get NXDOMAIN, CHAOS queries are refused, and reverse lookups for private addresses (RFC 6303) stay local unless a route covers them.

Reserved names are answered locally and never sent upstream localhost 127.0.0.1 / ::1 x.invalid NXDOMAIN 5.1.168.192… local data, else NXDOMAIN none of these leave your network

RFC 6762 supported

Multicast DNS (listening for device names). Opt-in and listen-only: the <name>.local a device announces names it in the query log and the UI when you haven't named it. TelltaleDNS never sends mDNS and doesn't answer .local queries.

A device's mDNS announcement names it in TelltaleDNS, which only listens nas.local 224.0.0.251:5353 192.168.1.9 → nas your names win listen only · nothing sent

RFC 6891 supported

Extension mechanisms for DNS (EDNS(0)). Bigger UDP answers, the DO bit, and options. We advertise 1232 bytes (DNS Flag Day 2020), answer unknown versions with BADVERS, and never send OPT to clients that didn't.

The OPT pseudo-record carries payload size, version, DO bit and options OPT record (in Additional) . 41 1232 B v0 · DO opts roottypeUDP sizeext · flagsEDE… • No OPT from the client → none in our reply. • Version ≠ 0 → BADVERS (extended RCODE 16).

RFC 7766 supported

DNS transport over TCP. Pipelined queries on one connection, answered in completion order; idle timeouts and connection caps. Upstream TCP/DoT connections are pooled and pipelined too.

Pipelined TCP: three queries sent at once, answers return as they finish clientTelltaleDNS Q1 Q2 Q3 (one write) A2 (cached) A3 A1 (slow upstream)

RFC 7858 supported

DNS over TLS (DoT). Encrypted upstreams with certificate verification, SNI, and connection reuse, and a DoT listener for your devices (ALPN dot, pipelining, client IDs from the server name, certificates reloaded on renewal).

DNS over TLS stack: DNS over TLS over TCP port 853 DNS message (length-prefixed, pipelined) TLS 1.2/1.3 · verified cert · SNI TCP :853 (pooled, reused) upstreams ✓ · client listener next

RFC 7871 supported

Client subnet in DNS queries (ECS). Never leaked: clients' ECS is stripped, and an upstream can be given a fixed subnet to send instead (cache-safe). Passing each client's own subnet through isn't supported.

ECS: devices' subnets never leave; an upstream can be sent one fixed subnet instead device query (its ECS is dropped) upstream query + ECS 203.0.113.0/24 answer cached for everyone (same subnet) strip by default · fixed subnet per upstream

RFC 8109 supported

Initializing a DNS resolver with priming queries. The recursive:// upstream asks the built-in root hints for the root's current servers once, then uses that list (renewed daily), so a root server's new address needs no new build.

The built-in hints are asked once for the root's servers; that list is used from then on built-in hints . NS ? 13 root servers + glue cached for a day · used for every lookup

RFC 8482 supported

Minimal responses to ANY queries. ANY gets a tiny synthesized HINFO answer instead of everything we know, which removes an amplification vector.

ANY gets one tiny HINFO record instead of a huge answer ANY? HINFO "RFC8482" not sent: every record(amplification risk)

RFC 8484 supported

DNS queries over HTTPS (DoH). Encrypted upstreams over HTTP/2 with one multiplexed connection per server, and a DoH listener for your devices (HTTP/2 and HTTP/1.1, GET and POST, client IDs in the path, Cache-Control from the answer TTL).

DNS over HTTPS: many queries as HTTP/2 streams on one connection POST/dns-queryapplication/dns-message streams on 1 HTTP/2 + TLS connection upstreams ✓ · client listener next

RFC 8767 supported

Serving stale data to improve DNS resiliency. If upstreams are slow or down, an expired answer (up to a day old) is served with TTL 30 and EDE 3 while the refresh continues.

Fresh, then a stale window where expired data is served if upstreams fail fresh (TTL) stale window (1 day) Upstreams silent for 1.8 s → stale answer, TTL 30, EDE 3; the refresh keeps going.

RFC 8914 supported

Extended DNS Errors. Every unusual answer says why: stale answer, blocked, not ready, no reachable upstream, overloaded.

Extended DNS Error option: code 15, info code, and text 15 len info "no upstream…" 3 Stale Answer · 14 Not Ready · 15 Blocked 17 Filtered · 22 No Reachable Authority 23 Network Error (overloaded)

RFC 9156 supported

QNAME minimization. The recursive:// upstream asks each server only for the next label (relaxed mode: a failed minimized query falls back to the full name), so the root sees `com`, not `www.example.com`.

QNAME minimization: the root sees com, com sees example.com, example.com's servers see www.example.com root ← A com? com ← A example.com? example.com ← A www.example.com? recursive:// upstream ✓ · relaxed fallback

RFC 9250 supported

DNS over dedicated QUIC (DoQ). QUIC transport for clients (a doq listener, UDP 853) and upstreams (quic:// URLs), one stream per query, 0-RTT off.

DNS over QUIC stack: one DNS message per QUIC stream, over UDP port 853 DNS message (one per stream, ID 0) QUIC · TLS 1.3 · ALPN doq · no 0-RTT UDP :853 (one connection, many streams) client listener ✓ · upstreams ✓

RFC 9520 supported

Negative caching of DNS resolution failures. SERVFAIL answers are cached for 5 seconds so a broken domain can't trigger a storm of retries.

A failing domain is remembered for 5 seconds SERVFAIL 5 s: retries answered locally Stops a broken domain from turning into a retry storm against upstreams.

RFC 8198 partial

Aggressive use of DNSSEC-validated cache. A validated NSEC denial proves a range of names absent: later questions inside it get a signed NXDOMAIN or NODATA without asking upstream (`[dnssec] aggressive_nsec`, on by default). Partial: NSEC only; NSEC3-signed zones still ask (ADR-092).

A validated NSEC range proves later names don't exist, so they're answered without asking zz-a1. ? NXDOMAIN zw. NSEC → . zz-b2. ? NXDOMAIN, local signed proof reused · no upstream query

RFC 9462 planned

Discovery of designated resolvers (DDR). Let clients discover our encrypted endpoints automatically.

Planned On the roadmap; the diagram lands with the feature