%% You should probably cite rfc9102 instead of this I-D. @techreport{dukhovni-tls-dnssec-chain-08, number = {draft-dukhovni-tls-dnssec-chain-08}, type = {Internet-Draft}, institution = {Internet Engineering Task Force}, publisher = {Internet Engineering Task Force}, note = {Work in Progress}, url = {https://datatracker.ietf.org/doc/draft-dukhovni-tls-dnssec-chain/08/}, author = {Viktor Dukhovni and Shumon Huque and Willem Toorop and Paul Wouters and Melinda Shore}, title = {{TLS DNSSEC Chain Extension}}, pagetotal = 43, year = 2021, month = jun, day = 10, abstract = {This document describes an experimental TLS extension for the in-band transport of the complete set of records that can be validated by DNSSEC and that are needed to perform DNS-Based Authentication of Named Entities (DANE) of a TLS server. This extension obviates the need to perform separate, out-of-band DNS lookups. When the requisite DNS records do not exist, the extension conveys a denial-of-existence proof that can be validated. This experimental extension is developed outside the IETF and is published here to guide implementation of the extension and to ensure interoperability among implementations.}, }