Out-of-Band Discovery of Authentic Resolvers (ODAR)

This document defines Out-of-Band Discovery of Authentic Resolvers (ODAR), a set of mechanisms for DNS clients to discover and authenticate a resolver's identity via out-of-band channels. A resolver discovered in this manner is referred to as an "Authentic Resolver". These mechanisms can be used to authenticate a resolver when only its IP address is known, and to validate resolver identity information learned via other means. These mechanisms are designed for deployments in which the authenticity information is provided by the out-of-band channels, such as distributed systems, ARPA reverse domain name resolution systems, and InterPlanetary File System (IPFS). This document also clarifies the complementary relationship between ODAR and the Recursive-Identifier mechanism defined in RFC 9499, and specifies how the two mechanisms can be integrated to achieve end-to-end trusted identity transmission of recursive resolvers in the DNS system.