Subject: [websec] HSTS at DNS level

From: Anne van Kesteren <[email-masked]>
Date: Wed, 29 Oct 2014 19:55:57 +0100

Is there some way we could add an annotation to DNS that makes it
clear a given domain for the purposes of HTTP is only available over
port 443 using TLS? DNS can be easily spoofed of course so you also
want HSTS, but perhaps it would be sufficient to be able to disable
port 80 entirely.

-- 
https://annevankesteren.nl/

---

From: Yoav Nir <[email-masked]>
Date: Thu, 30 Oct 2014 07:33:29 +0200

In the early days of WebSec there was such a goal. That is why HSTS begins with an “H”. It differentiates it with the DSTS that is based on DNS. 

Nobody ever got around to writing a DSTS draft. HPKP does have a DNS equivalent - it’s DANE. 

Yoav

> On Oct 29, 2014, at 8:55 PM, Anne van Kesteren <[email-masked]> wrote:
> 
> _______________________________________________
> websec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/websec

---

From: Anne van Kesteren <[email-masked]>
Date: Thu, 30 Oct 2014 10:23:20 +0100

> In the early days of WebSec there was such a goal. That is why HSTS begins with an “H”. It differentiates it with the DSTS that is based on DNS.

Thanks! I should have checked the archives.

http://www.ietf.org/mail-archive/web/websec/current/msg00004.html
seems pretty clear on why this would be hard.