Skip to content

Comments

feat: align with IETF draft-mozleywilliams-dnsop-dnsaid-01 (v0.8.0)#36

Merged
iracic82 merged 1 commit intomainfrom
feat/ietf-dnsaid-01-alignment
Feb 21, 2026
Merged

feat: align with IETF draft-mozleywilliams-dnsop-dnsaid-01 (v0.8.0)#36
iracic82 merged 1 commit intomainfrom
feat/ietf-dnsaid-01-alignment

Conversation

@iracic82
Copy link
Collaborator

Summary

  • SVCB AliasMode (priority 0) — Discoverer follows alias records to resolve canonical ServiceMode targets per RFC 9460 and IETF draft §4.4.2
  • SVCB ipv4hint/ipv6hint — Extract address hints (SvcParamKey 4, 6) to reduce follow-up A/AAAA queries per IETF draft §4.4.2
  • DANE dynamic verificationverify() returns context-aware dane_note messages (advisory vs full cert matching) with DNSSEC coupling warning per IETF draft §4.4.1
  • BANDAID → DNS-AID rename — All references updated across 35 files (source, tests, docs, metadata). Draft reference updated from bandaid-02 to dnsaid-01. TXT prefix changed from bandaid_ to dnsaid_
  • bap SvcParamKey fix — Changed from key65003 to key65010 to match IETF draft §4.4.3 example
  • Version bump — 0.7.3 → 0.8.0

Breaking Changes

  • bap SvcParamKey changed from key65003 to key65010 — existing DNS records using key65003 for bap must be re-published
  • TXT record prefix changed from bandaid_ to dnsaid_ — existing demoted TXT records (Route53, Cloudflare) must be re-published

Test plan

  • uv run pytest tests/ -x -q — 750 passed, 32 skipped, 0 failures
  • uv run ruff check src/dns_aid/ — all checks passed
  • uv run ruff format --check src/dns_aid/ — 50 files formatted
  • uv run mypy src/dns_aid/ — no issues in 50 source files
  • Verified zero remaining BANDAID/bandaid references via grep
  • Verified zero remaining key65003 references via grep
  • Cross-checked all changes against full IETF draft-mozleywilliams-dnsop-dnsaid-01 text

Align dns-aid-core with the renamed IETF draft (v01) and address
reviewer feedback on missing SVCB features and DANE coverage.

- Add SVCB AliasMode (priority 0) handling in discoverer
- Extract ipv4hint/ipv6hint from SVCB params (SvcParamKey 4, 6)
- Dynamic DANE verification notes with DNSSEC coupling warning
- Rename BANDAID → DNS-AID across all source, tests, docs, metadata
- Fix bap SvcParamKey from key65003 to key65010 per draft example
- Update draft reference from bandaid-02 to dnsaid-01
- Add DNSSEC/DANE security section to README
- Bump version to 0.8.0

BREAKING CHANGE: bap SvcParamKey changed from key65003 to key65010.
Existing DNS records using key65003 for bap must be re-published.
TXT record prefix changed from bandaid_ to dnsaid_.

Signed-off-by: Igor Racic <iracic82@gmail.com>
@iracic82 iracic82 merged commit 9405a27 into main Feb 21, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant