1

Is there a way to specify 2 SRV records for the same service, one implementing security and one not? Is there enough information on the specification to indicate such a thing?

Improve this question
2
  • 4
    You can specify whatever you want in SRV records (as long as it complies with RFC 2782), it depends on the client if and how they get interpreted, but I imagine the service name would have to be different for the best result i.e. I would expect an _ldaps._tcp.example.com to differentiate from _ldap._tcp.example.com
    – HBruijn
    Apr 13, 2016 at 8:40
  • 5
    Before you consider to deploy a service with multiple security levels, you need to understand how downgrade attacks work. If you don't want to spend time carefully researching downgrade attacks, you may be better off choosing just one security level and supporting only that.
    – kasperd
    Apr 13, 2016 at 14:17

1 Answer 1

Reset to default
6

You can use a standard SRV record to point to different port numbers for a service, perhaps one for a secure and another for an insecure port.

The DNS doesn't understand the distinction nor does it understand that it might receive a different level of service if using one versus the other. The onus will be on your application to encode the semantics of the secure and insecure records, and ensure it looks up the appropriate record on each occasion for the desired connection security level.

See HBruijn's comment for a good example using LDAP and LDAPS records.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .