Change:
Note that the length of this structure MUST NOT exceed 2^16 - 1, as the RDLENGTH is only 16 bits RFC1035. <ins> 4.2. This section describes a client ESNI resolution algorithm using a new "address_set" extension described below.  Future specifications may introduce new extensions and corresponding resolution algorithms. 4.2.1. ESNIKeys records MAY indicate a specific IP address(es) for the host(s) in possession of the ESNI private key via the following mandatory "address_set" ESNIKeys extension: The body of this extension is encoded using the following structure. A set of Address structures containing IPv4 or IPv6 addresses to hosts which have the corresponding private ESNI key. 4.2.2. Clients obtain ESNI records by querying the DNS for ESNI-enabled server domains.  In cases where the domain of the A or AAAA records being resolved do not match the SNI Server Name, such as when RFC7838 is being used, the alternate domain should be used for querying the ESNI TXT record.  (See Section 2.3 of RFC7838 for more details.) Clients SHOULD initiate ESNI queries in parallel alongside normal A or AAAA queries to obtain address information in a timely manner in the event that ESNI is available.  The following algorithm describes a procedure by which clients can process ESNIKeys responses as they arrive to produce addresses for ESNI-capable hosts. CD (Connection Delay) is a configurable parameter.  The recommended value is 50 milliseconds, as per the guidance in RFC8305. </ins> 5. The encrypted SNI is carried in an "encrypted_server_name" extension,

Discussion:
This change does the following: Add support for mandatory extensions, which are those that clients must process else reject the ESNIKeys record. Add a mandatory extension carrying a set of v4/v6 addresses, which is effectively the combined record mode. Add text describing how clients ought to resolve ESNI and A/AAAA records, and use the results to initiate TLS connections.
That's fair. However, it seems to be the price to get this sort of simplicity. Moreover, as an extension, it's not pressed upon all clients for all providers. Also true! I'm hoping that folks who are in the position and capable of vending these records can comment on this design's cost.
Given that there was no serious objection to this change and that it works for at least one operator, I'm merging this PR. We can continue to iterate on as needed in parallel.
issues and advocate for the removal of the _esni prefix. A significant side effect of that is that it becomes impossible to use a CNAME at the apex of a zone in order to refer to ESNIKeys of a server operated elsewhere. Inlining keys, as is often done with A/AAAA at the apex, is not plausible due to key rotation. The issue can largely be mitigated with the introduction of an inclusion mechanism directly in the TXT/ESNI record.
This should be fixed by and follow up changes. Closing as such. Please reopen if necessary!
I don't believe resolves this. 136 effectively requires the address and ESNI information to be stapled together (which I still find objectionable). The issue here is that the apex cannot use a CNAME to delegate to the actual third party provider's ESNI record.. typically it just includes an A/AAAA record at the apex and hopes the pointer doesn't go stale. That's bad enough for A/AAAA but it would be terrible for ESNI because it means copying keying information and hoping it doesn't go stale between two different entities. NAME can you reopen?
Sure! Sorry for the misunderstanding. We can probably update this PR to make use of the new DNS-specific extensions.
Fixed by .
This is a substantial step in the right direction, but the fact that A/AAAA records are basically ignored makes me uneasy. The fact that A/AAAA results are essentially fully embedded would imply that all logic involved in selectively returning those responses has to be duplicated for ESNIKeys, which is also sub-optimal.