Topic domain
Internet Protocols
The standards stack that the web and its neighbors run on.
- Articles
- 80
- Clusters
- 8
- Foundational
- 24
- Intermediate
- 32
- Advanced
- 24
DNS
10Resolution, delegation, and record semantics.
- DNS Message Format and Name Compression on the Wire
- Delegation and Zone Cuts: Where Authority Changes Hands
- Iterative Resolution: Walking the Tree from Root Hints to Answer
- Record Semantics: CNAME Exclusivity and RRset Atomicity
- Negative Caching: NXDOMAIN, NODATA, and the SOA Minimum
- EDNS(0) and the Truncation Boundary
HTTP
10Messages, caching, and connection management.
- HTTP Message Framing: Start Lines, Field Lines, and CRLF
- Method Semantics: Safe, Idempotent, and Cacheable Requests
- Status Codes, Interim Responses, and When a Response Has No Body
- Proactive Content Negotiation and the Quality Value Grammar
- Conditional Requests: Entity Tags, Dates, and Preconditions
- Cache Freshness, Age, and the Directive Precedence Rules
TLS
10Handshakes, certificates, and record protection.
- The TLS Record Layer: Framing, Fragmentation, and Sequence Numbers
- The TLS 1.3 Handshake: What Each Flight Commits To
- Path Building and Validity Checking in X.509 Certificate Chains
- The TLS 1.3 Key Schedule: Extract, Expand, and Why Order Matters
- Session Resumption in TLS 1.3: Tickets, Binders, and 0-RTT Replay
- AEAD Usage Limits and the KeyUpdate Handshake
UDP-based transport and stream multiplexing.
- Head-of-Line Blocking and the Transport Gap QUIC Was Built to Fill
- Stream Identifiers and the State Machine That Makes Closing Cheap
- Reading a QUIC Packet: Header Protection, Varints, and Frame Types
- Connection IDs, Migration, and Validating a New Path
- The QUIC Handshake: TLS 1.3 Without a Record Layer
- Loss Detection Without Retransmitted Packets
Submission, delivery, and authentication.
- Envelope and Header Addresses in SMTP Delivery
- Header Folding and the Line Limits That Shape MIME Encoding
- The Split Between Submission and Relay Ports
- Queue Management and Retry Scheduling in MTAs
- MX Resolution, Preference Ordering, and Null MX
- ESMTP Extension Negotiation and Its Failure Modes
RTP, codecs, and jitter handling.
- The RTP Fixed Header: Twelve Bytes That Carry a Media Stream
- Reading Loss and Round-Trip Time from RTCP Sender and Receiver Reports
- Why RTP Timestamps Do Not Count Seconds
- Sizing and Adapting the Jitter Buffer
- Opus: Two Codecs Behind One Payload Type
- Fragmenting Encoded Frames to Fit the Path MTU
OAuth, OIDC, and federation mechanics.
- Delegated Authority: What OAuth's Four Roles Actually Separate
- Authorization Code Flow: Why the Redirect Carries a Code and Not a Token
- PKCE: Binding an Authorization Code to the Client That Asked for It
- Scopes Are Strings, Consent Is Policy: Where Access Limits Actually Live
- Refresh Token Rotation and Replay Detection in OAuth 2.0
- Self-Contained Access Tokens and the Cost of Local Validation
Extensibility, versioning, and ossification.
- Type-Length-Value Framing and the Extension Contract
- Critical Bits and Unknown-Field Handling
- Version Fields, Feature Detection, and Downgrade Semantics
- Reserved Values and the Practice of Keeping Extension Points Alive
- Registry Allocation Policy and the Cost of a Code Point
- Middlebox Ossification and Frozen Invariants
All Internet Protocols articles
- Sep 30, 2026 Why RTP Timestamps Do Not Count Seconds RTP timestamps advance at the codec clock rate, which makes arithmetic modular and stream-relative; the rules that follow for wrap, comparison, and cross-stream sync.
- Sep 28, 2026 The Split Between Submission and Relay Ports Why port 587 exists separately from port 25, which policies differ between the two roles, and how a server distinguishes a user from a peer MTA.
- Sep 26, 2026 Path Building and Validity Checking in X.509 Certificate Chains How a TLS peer turns a list of certificates into a trusted path: name chaining, basic constraints, validity windows, and why path building is search rather than parsing.
- Sep 25, 2026 Authenticated Denial of Existence with NSEC and NSEC3 How a signed zone proves that a name or type is absent, why NSEC leaks the zone inventory, and what hashing with NSEC3 costs in queries and opt-out coverage.
- Sep 21, 2026 Scopes Are Strings, Consent Is Policy: Where Access Limits Actually Live Why the scope parameter is only a request, how authorization servers narrow or refuse it, and what incremental authorization costs in state tracking.
- Sep 19, 2026 Authorization Code Flow: Why the Redirect Carries a Code and Not a Token How the front channel and back channel split the grant, what exact-match redirect URI registration protects, and where state and mix-up defences sit in the exchange.
- Sep 18, 2026 QPACK and the Cost of a Shared Header Table Why HTTP/3 could not reuse HPACK unchanged, how absolute and relative indices decouple encoding from delivery order, and what a blocked stream actually waits for.
- Sep 14, 2026 Zone Transfers and Secondary Replication: AXFR, IXFR, and the SOA Timers How a secondary server detects that a zone changed, what a full transfer costs against an incremental one, and how serial number arithmetic makes wrap-around safe.
- Aug 6, 2026 Congestion Control and Pacing in a Transport That Owns the Socket How a QUIC sender turns acknowledgements into a window, why the window must be spread into a packet schedule, and what changes when the controller is not in the kernel.
- Jul 23, 2026 What TLS 1.3 Removed: Renegotiation, Compression, and Static RSA The features dropped between 1.2 and 1.3, the attacks that motivated each removal, and the compatibility cost that came with a smaller protocol.
- Jul 13, 2026 Head-of-Line Blocking and the Transport Gap QUIC Was Built to Fill Why one lost TCP segment stalls every multiplexed request on a connection, and which parts of that coupling a UDP-based transport can actually remove.
- Jul 13, 2026 Self-Contained Access Tokens and the Cost of Local Validation What a resource server gains and loses when it validates a signed token locally instead of asking the issuer, and where clock skew and key caching change the answer.
- Jul 6, 2026 Critical Bits and Unknown-Field Handling How protocols distinguish a field that may be ignored from one that must be understood, and why the default for unknown fields decides whether a protocol can change.
- Jun 15, 2026 SPF Evaluation and Its Ten-Lookup Budget How a receiver matches a sending IP against a domain policy written in TXT records, why the recursion limit exists, and what each result value actually permits.
- Jun 2, 2026 DMARC Alignment Between Header and Envelope Domains How DMARC combines two independent authentication results into one verdict, why alignment is stricter than either check, and what the policy record actually authorizes.
- May 21, 2026 Persistent Connections, Pipelining, and Connection Reuse Why HTTP/1.1 keeps the connection open, what pipelining actually requires of a server, and how idle timeouts and half-closed sockets break reuse.
- May 16, 2026 The TLS 1.3 Key Schedule: Extract, Expand, and Why Order Matters How HKDF turns one shared secret into six traffic secrets, what the transcript hash does at each stage, and why early secrets are derived before the peer is authenticated.
- May 13, 2026 Status Codes, Interim Responses, and When a Response Has No Body How the three-digit status code steers client behaviour, why 1xx responses break naive parsers, and which statuses forbid or require a body.
- May 12, 2026 The TLS Record Layer: Framing, Fragmentation, and Sequence Numbers How application bytes become protected records: the five-byte header, the 16 KiB fragment limit, implicit sequence numbers, and how the AEAD nonce is assembled.
- May 5, 2026 Early RTCP Feedback: Negative Acknowledgements, Picture Loss, and Transport Congestion How the feedback profiles let a receiver report loss in milliseconds instead of seconds, what each message type asks for, and the timing rules that keep them from flooding a session.
- Apr 22, 2026 Mapping RTP Clocks to Wall Time for Cross-Stream Synchronization Sender reports tie an RTP timestamp to an NTP instant; using that correspondence to align audio and video exposes clock offset, drift, and the limits of the mapping.
- Apr 20, 2026 The TLS 1.3 Handshake: What Each Flight Commits To The four-message exchange that produces keys: what ClientHello offers, what ServerHello selects, why the transcript hash is the spine, and when a retry costs an extra round trip.
- Apr 6, 2026 ID Tokens: Validating the Claims That Establish Who the User Is The claim set OpenID Connect adds to a JWT, the ordered checks a client must perform, and why a valid signature is the least interesting part of validation.
- Apr 1, 2026 ARC and Authentication Across Forwarding Hops How a chain of seals lets a receiving domain trust authentication results recorded before a message was forwarded, and where that trust stops being safe.
- Mar 24, 2026 Discovery Metadata and the Key Set Rotation Problem How a well-known document bootstraps trust in endpoints and signing keys, and what an implementation must do when the published key set changes underneath it.
- Mar 24, 2026 HTTP Message Framing: Start Lines, Field Lines, and CRLF How an HTTP/1.1 message is divided into a start line, a field section, and a body, and which parts of that grammar still decide whether a parser succeeds.
- Mar 22, 2026 Cache Freshness, Age, and the Directive Precedence Rules How a cache computes whether a stored response is fresh, how Age accumulates across hops, and which directive wins when several apply.
- Mar 18, 2026 Session Resumption in TLS 1.3: Tickets, Binders, and 0-RTT Replay How a ticket becomes a pre-shared key, what the binder actually signs over, why early data cannot be made replay-proof, and what servers do about it.
- Jan 29, 2026 Message Delimitation and the Mechanics of Request Smuggling How Content-Length, Transfer-Encoding, and connection close define where a message ends, and how disagreements between parsers turn that boundary into an attack.
- Jan 18, 2026 Name Matching and Revocation: What the Certificate Does Not Tell You Subject alternative names, wildcard coverage, and the two revocation mechanisms, including why a stapled response and a fetched response answer different questions.
- Dec 27, 2025 Loss Detection Without Retransmitted Packets How QUIC infers loss from packet-number gaps and time thresholds, why frames rather than packets are retransmitted, and how probe timeouts keep a connection from stalling.
- Dec 3, 2025 AEAD Usage Limits and the KeyUpdate Handshake Why a TLS 1.3 key has a byte budget as well as a record budget, where the numbers come from, and what happens when a connection outlives its key.
- Nov 25, 2025 Queue Management and Retry Scheduling in MTAs How a mail server decides when to retry a failed delivery, why the four-hour and five-day thresholds exist, and how a permanent failure becomes a bounce.
- Nov 25, 2025 Registry Allocation Policy and the Cost of a Code Point How IANA registries decide who gets a number, why allocation policy is a protocol design decision, and how scarce identifier spaces shape what can be built.
- Nov 20, 2025 HTTP/3 Framing: Request Streams, Control Streams, and the Settings Exchange How HTTP semantics are carried over QUIC streams, which unidirectional streams the connection requires, and why the control channel is a stream rather than a frame type.
- Oct 24, 2025 Sizing and Adapting the Jitter Buffer How a playout buffer trades latency for concealment, the difference between a fixed and an adaptive delay target, and why the delay estimate must not follow every spike.
- Aug 22, 2025 Negative Caching: NXDOMAIN, NODATA, and the SOA Minimum How a resolver distinguishes a name that does not exist from a name with no records of the requested type, and how the SOA fields set the lifetime of both.
- Aug 10, 2025 Stream Identifiers and the State Machine That Makes Closing Cheap How the low two bits of a QUIC stream ID encode direction and initiator, why IDs are never reused, and how reset and stop-sending terminate a stream without waiting for a FIN.
- Aug 4, 2025 Reserved Values and the Practice of Keeping Extension Points Alive How unallocated code points, GREASE values, and deliberate noise keep implementations honest about skipping unknown fields, and what that costs on the wire.
- Jul 18, 2025 The QUIC Handshake: TLS 1.3 Without a Record Layer How CRYPTO frames carry the TLS handshake inside the transport, why encryption levels change mid-handshake, and how Retry forces address validation before a certificate is sent.
- Jun 29, 2025 Tolerant Parsing and Its Limits What the robustness principle actually licenses, where lenient receivers create security and interoperability problems, and how specifications narrow the tolerance they once encouraged.
- Jun 23, 2025 ESMTP Extension Negotiation and Its Failure Modes How EHLO replaced HELO, what the keyword list in the reply actually guarantees, and why PIPELINING and CHUNKING change the shape of a session.
- Jun 9, 2025 Simulcast and Scalable Video: Choosing Which Layer to Send The difference between sending several independent encodings and sending one layered encoding, how receivers request a layer, and what switching costs in decoder state and bandwidth.
- Apr 28, 2025 Connection IDs, Migration, and Validating a New Path Why QUIC addresses packets by connection rather than by four-tuple, how NEW_CONNECTION_ID hands out routable identifiers, and what PATH_CHALLENGE proves about a peer that has moved.
- Apr 14, 2025 Refresh Token Rotation and Replay Detection in OAuth 2.0 How one-time-use refresh tokens turn a stolen credential into a detectable event, what the rotation chain costs in storage, and where concurrent use breaks the model.
- Apr 7, 2025 Fragmenting Encoded Frames to Fit the Path MTU Why a codec frame larger than a datagram needs RTP-level fragmentation, how the marker bit and timestamp stay shared, and what happens when one fragment is lost.
- Mar 31, 2025 Reading Loss and Round-Trip Time from RTCP Sender and Receiver Reports How the fraction-lost, jitter, and LSR/DLSR fields are computed, why the arithmetic is fixed-point, and where the round-trip estimate breaks down.
- Mar 27, 2025 Encrypted DNS Transports and Their Trust Boundaries How DoT, DoH, and DoQ change the transport without changing the protocol, what each hides, and why the resolver becomes the party that sees every name.
- Jan 21, 2025 Iterative Resolution: Walking the Tree from Root Hints to Answer The referral chain a recursive resolver follows, how the cache shortens it, why the answer arrives as an RA response rather than a chain, and where the walk can stall.
- Jan 18, 2025 MX Resolution, Preference Ordering, and Null MX How a sending server turns a domain into a list of hosts, why the preference values are ordered the way they are, and what an empty MX list asserts.
- Dec 22, 2024 Retiring a Protocol Version Without a Flag Day Why old versions persist after they are known to be weak, how deprecation is staged across senders and receivers, and what actually forces a deployment off a protocol.
- Dec 1, 2024 Intermediaries, Hop-by-Hop Fields, and the Via Chain How proxies, gateways, and tunnels differ, which fields an intermediary must consume rather than forward, and what forwarding does to message semantics.
- Oct 14, 2024 Two-Level Flow Control and Why Credit Must Be Advertised How stream and connection limits interact, why a receiver cannot simply stop reading, and what happens to credit when a stream is reset.
- Sep 26, 2024 Version Fields, Feature Detection, and Downgrade Semantics Why a version number in the header is a weak signal, how peers actually establish a common dialect, and what a negotiated downgrade exposes to an attacker.
- Sep 19, 2024 Reading a QUIC Packet: Header Protection, Varints, and Frame Types The byte layout of long and short headers, how header protection hides the packet number, and how the frame type space is partitioned between transport and extension use.
- Aug 29, 2024 SRTP Key Derivation and Per-Packet IV Construction How one master key produces separate encryption, authentication, and salting keys, and why the packet index rather than the sequence number feeds the counter block.
- Aug 23, 2024 Delegation and Zone Cuts: Where Authority Changes Hands How an NS RRset at a delegation point splits a namespace into zones, why glue records are necessary, and what makes a delegation lame or unreachable.
- Jun 4, 2024 PKCE: Binding an Authorization Code to the Client That Asked for It How the code verifier and S256 transformation stop intercepted codes from being redeemed, and why the plain transformation is a fallback rather than an equal.
- May 30, 2024 Middlebox Ossification and Frozen Invariants How on-path devices that parse protocol fields freeze a design, why visible invariants become dependencies, and the strategies that keep extension points usable.
- May 13, 2024 The RTP Fixed Header: Twelve Bytes That Carry a Media Stream What each field of the 12-byte RTP header means, why sequence numbers and timestamps are independent, and which failures the design accepts to stay small.
- May 2, 2024 Federated Session State: Logout, Propagation, and the Limits of Single Sign-Out Why a logout at one relying party cannot reliably end sessions at others, how back-channel and front-channel logout differ, and what session identifiers can and cannot carry.
- Mar 1, 2024 DNSSEC Validation and the Chain of Trust How DNSKEY, DS, and RRSIG records form a verifiable chain from the root to a leaf answer, and what a validator does when a link is missing or a signature has expired.
- Feb 13, 2024 Negotiation Round Trips and What They Cost How capability discovery is paid for in latency, why the cheapest negotiation is one that reuses state, and where a saved round trip becomes a security problem.
- Jan 30, 2024 Traffic Analysis Against TLS: Record Lengths, Timing, and Padding What ciphertext lengths reveal about plaintext, how padding is expressed in the record layer, and why uniform padding is not the same as hiding a request.
- Jan 23, 2024 Method Semantics: Safe, Idempotent, and Cacheable Requests What the three method properties actually license a client, cache, or proxy to do, and where the definitions stop matching what real methods do.
- Dec 29, 2023 Opus: Two Codecs Behind One Payload Type SILK and CELT cover different frequency bands and latencies, and the hybrid mode that combines them explains most of Opus configuration decisions.
- Dec 22, 2023 Byte Ranges, Partial Responses, and Range Request Cost How Range and Content-Range select a byte window, when a server must answer 206 rather than 200, and why many small ranges are a denial-of-service shape.
- Sep 21, 2023 Client Authentication: Secrets, Assertions, and Certificates What each token endpoint authentication method actually proves, why a shared secret is the weakest of them, and how a signed assertion avoids transmitting one.
- Sep 13, 2023 Header Folding and the Line Limits That Shape MIME Encoding How the 998-octet line limit, dot-stuffing, and the 75-character encoded-word bound force the transfer encodings that mail still uses.
- Aug 3, 2023 Encrypted Client Hello and the Limits of Hiding a Hostname How the outer and inner ClientHello split works, what the ECHConfig commits the server to, and which parts of a connection remain visible after ECH.
- Jul 6, 2023 Delegated Authority: What OAuth's Four Roles Actually Separate Why OAuth replaces password sharing with a scoped, revocable token, and how the split between authorization server and resource server makes that possible.
- Jun 30, 2023 Optimistic Extension Use and the Cost of Unconfirmed Capability What it means to use a feature before the peer has agreed to it, how the fallback path is designed, and why unconfirmed state is the hardest part to get right.
- May 25, 2023 Proactive Content Negotiation and the Quality Value Grammar How Accept, Accept-Language, and Accept-Encoding rank representations, what q-values order, and why Vary makes negotiation cacheable.
- Apr 11, 2023 DKIM Canonicalization and What It Actually Signs How a DKIM signature survives transport rewriting, why two canonicalization algorithms exist, and which header fields the signature deliberately excludes.
- Feb 25, 2023 Conditional Requests: Entity Tags, Dates, and Preconditions How If-None-Match and If-Modified-Since turn a full response into 304, how strong and weak validators differ, and why the precondition order is fixed.
- Nov 8, 2022 Envelope and Header Addresses in SMTP Delivery Why a message carries two independent sets of addresses, which one routing and bounces actually consult, and what breaks when a gateway rewrites one but not the other.
- Oct 12, 2022 EDNS(0) and the Truncation Boundary How the OPT pseudo-record extends the header, how the advertised UDP payload size interacts with the 512-byte default, and why truncation is not a partial answer.
- Oct 10, 2022 Record Semantics: CNAME Exclusivity and RRset Atomicity Why a CNAME cannot coexist with other data at the same name, how RRsets are ordered and cached as units, and what an alias does to the query type.
- Jun 23, 2022 Type-Length-Value Framing and the Extension Contract Why a self-describing field is the precondition for every extension mechanism, where length fields count from, and what TLV framing cannot express.
- Nov 11, 2021 DNS Message Format and Name Compression on the Wire How the twelve-byte header, length-prefixed labels, and 0xC0 compression pointers carry a query and its answer, and which encodings a parser must reject.