A Framework for Verifying Inter-Domain Relationships Using DANE-Based Trust Models on DNS-over-TLS-Enabled Authoritative Servers

The Domain Name System (DNS) is a fundamental Internet technology that maps domain names to resource information such as IP addresses. DNS Security Extensions (DNSSEC) ensure the integrity of DNS responses, while DNS over TLS (DoT), DNS over HTTPS (DoH), and DNS over QUIC (DoQ) enhance the confidentiality of name resolution communications. However, these technologies do not verify whether domains resembling legitimate domains, or service domains operated by legitimate organizations, are organizationally or operationally related to them. This paper proposes a framework using X.509 certificates presented by DoT-enabled authoritative DNS servers and DNS-Based Authentication of Named Entities (DANE) TLSA resource records. Here, a related domain belongs to a different namespace but is authorized by the same organization, service provider, or similar entity. Standard TLS certificates are verified using the X.509 Public Key Infrastructure (PKIX), whereas additional certificates indicating related domains are verified using DANE Trust Anchor (DANE-TA), with a source-domain private certification authority (CA) as the trust anchor. We implemented additional certificate verification, Server Name Indication (SNI)-based certificate selection, resolver-side relationship verification, and full-certificate caching. Certificate information returned to stub resolvers or applications is converted into TLSA-compatible data and appended to DNS responses. Evaluation results confirmed that the prototype operated at a sufficiently practical speed and that full-certificate caching reduced the latency associated with inter-domain relationship verification.