DRIVERS-3329: Configurable DNS domain validation for SRV records by sleepyStick · Pull Request #1950 · mongodb/specifications

sleepyStick · 2026-06-11T21:33:22Z

Please complete the following before merging:

Is the relevant DRIVERS ticket in the PR title?

Update changelog.
Test changes in at least one language driver.
Python PR: PYTHON-5814 Configurable DNS domain validation for SRV records mongo-python-driver#2868
Test these changes against all server versions and topologies (including standalone, replica set, and sharded
clusters).

rozza

It looks good, I have one comment about if an invalid srvAllowedHostsSuffix should throw an error explicitly? (if so should we update the yml?)

Also the yml and json has diverged for srvAllowedHostsSuffix-without_dot_pass - which is probably the lint error.

matthewdale · 2026-06-17T21:09:08Z


+#### srvAllowedHostsSuffix
+
+This option is used to validate hosts. If present, its value MUST be treated as the domain for DNS validation. For


Optional: Consider linking to the Querying DNS section, which is where the DNS validation is described.

added! thanks!

codeowners-service-app · 2026-06-22T06:42:51Z

Assigned vector-of-bool for team dbx-spec-maintainers-connection-string because aclark4life is out of office.

…covery.md Co-authored-by: Matt Dale <9760375+matthewdale@users.noreply.github.com>

matthewdale

Looks good! 👍

aclark4life · 2026-06-23T20:06:38Z

@@ -0,0 +1,6 @@
+{
+  "uri": "mongodb+srv://test12.test.build.10gen.cc/?srvAllowedHostsSuffix=uild.10gen.cc",


Looks like the convention in yml is no quotes around uri

aclark4life · 2026-06-23T20:08:26Z

+This option is used to validate hosts. If present, its value MUST be treated as the `{domainname}` for
+[DNS validation](#querying-dns). For example, `srvAllowedHostsSuffix=.mydomain.net`. If the value does not begin with a
+`.`, for example, `srvAllowedHostsSuffix=mydomain.net`, the `.` MUST be automatically prepended prior to validation. If
+this option is not present, the`{domainname}` MUST be inferred from the `{hostname}` (as described in


Missing space

aclark4life · 2026-06-23T20:10:29Z

+uri: "mongodb+srv://test12.test.build.10gen.cc/?srvAllowedHostsSuffix=test.build.10gen.cc"
+seeds: []
+hosts: []
+error: true


Also a convention apparently is new lines at the end of yaml files.

aclark4life

Pending nit fixes LGTM

ajcvickers · 2026-06-25T12:14:14Z

Setting srvAllowedHostsSuffix to a public suffix neuters SRV anti-spoofing, turning mongodb+srv:// into an unbounded DNS redirect. A merely broad private domain doesn't make it unbounded, but widens the redirect to anywhere under that domain. There is no PSL/minimum-label guard to prevent either. Example:

Preconditions:

Misconfiguration. App sets a too-broad suffix:
mongodb+srv://mycluster.mongodb.example.com/?srvAllowedHostsSuffix=.com
Attacker runs a malicious/compromised resolver, or poisons the cache. (DNSSEC is not enforced per SECURITY-488).
Attacker obtains a CA-valid cert for a domain they own.

Step-by-step:

Client SRV-queries _mongodb._tcp.mycluster.mongodb.example.com.
Attacker forges the SRV response: target db1.attacker-evil.com:27017.
Suffix validation passes (db1.attacker-evil.com ends in .com).
mongodb+srv forces TLS; the client validates the cert against the SRV-returned name (db1.attacker-evil.com), not the typed name (mycluster.mongodb.example.com).
Attacker owns that name and holds a valid cert → TLS verification passes → client connects to the attacker's server.

ajcvickers · 2026-06-25T12:23:25Z

I think the parsing needs to be much better specified and tested. It's important to understand what DNS entries allow and how to safely handle these things. These should be specified at the spec level, so all drivers will get the parsing correct. For example, most of these are not specified or tested:

DNS is case-insensitive. (Also, ASCII-only case-folding.)
SRV targets often return trailing dots. For example: host.citi.net. These must be normalized.
IDN / punycode / homographs. Don't compare raw Unicode.
Probably more... (I'm not an expert, but the above are the obvious ones.)

There needs to be much better test coverage here.

sanych-sun · 2026-09-01T16:18:31Z

@Jibola Thank you for your response!

we can feel pretty good about this option and its blend of simplicity for the end-user whilst also balancing some layer of validation that can let us rest knowing we've done something for this can of worms.

The problem with current solution that it trying to put the very dynamic dataset into the driver without ability to override it at all. Which means if there is any inconsistency or bug in the dataset - users will have no way to workaround it. And also it means we will need to update this embedded resource to catch up with the changes - correct me if I'm wrong, but proposed changes to spec does not define the update process.

About size: in the PR referenced by @adelinowona we are going to include the dat file as embedded resource into the dotnet assembly (which means the file as is will be included into the dll). Then we have a multi-target package because of how dotnet packaging works - currently we have 3 targets - which basically means there will be 3 version of driver packed - so 3 MongoDB.Driver.dll files - which makes 140kB to be present 3 times in the package. But I do agree - this is the smallest problem.

We're providing a base layer of protection for the user. With the implementation now being to check against a static list, it keeps a minimum layer of security.

Yes, we providing very-basic some-kind of security which does not really protect, but creating additional headache on our side.

A callback handler can be done outside of setting this URI. Giving the end-user the option of making something up and then believing they'll do exactly the right thing doesn't always work out.

Yes. This is the point. If users are interested - they will investigate and create as complex solution as they want. They will be in charge. Why do we think they cannot create comprehensive solution when they totally know their infrastructure and having all that info they can implement more strict and more reliable validation?

Again: callback is generic approach, and if we feel like PSL is the greatest thing ever and it will cover 99.9% of all our use-cases - I'm more then OK to implement extension library which will have different release-cycle then driver itself and will be explicitly added by end-users as a form of callback. But such approach will also unlock some corner cases which we do not think of, because end-user will be able to specify their own callback if needed.

adelinowona · 2026-09-02T17:05:42Z

+addition, when `srvAllowedHostsSuffix` is not configured and the SRV record hostname has fewer than three `.` separated
+parts, the returned hostname MUST have at least one more domain level than the SRV record hostname. Drivers MUST raise
+an error and MUST NOT initiate a connection to any returned hostname which does not fulfill these requirements. This
+additional requirement does not apply when `srvAllowedHostsSuffix` is configured.


Just noting that If we add the two-label MUST, this carve-out stays correct and nothing here needs to change. If we don't, this sentence has to go, because the property it relies on no longer holds.

…covery.md Co-authored-by: Adelin Owona <51498470+adelinowona@users.noreply.github.com>

Dismissing review as we've addressed comments on security in an outside thread and continued on completing the pull request.

aclark4life · 2026-09-02T21:36:51Z


 The `srvAllowedHostsSuffix-psl-*` tests in the
 [Initial DNS Seedlist Discovery tests](https://github.com/mongodb/specifications/tree/master/source/initial-dns-seedlist-discovery/tests/replica-set)
 cover the two cases that are observable through a connection string: a suffix that is a public suffix (`cc`) is


Since the two-label MUST at step 4 rejects any single-label value first cc and COM never reach the public suffix check. So of the three only psl-not-public-suffix still exercises the PSL and only its accept path.

Nothing covers rejecting a public suffix. Repointing one test at a multi-label public suffix like com.ac would restore that and make tld-only unnecessary since .cc and cc are the same test once step 1 strips the dot.

given that the full/"official" use of the PSL is potentially not going to be used, i think this would be really hard to test -- like how do we decide which multi-label public suffix every driver should deny? I feel like that's a conversation that would take more time to decide (and is not in the scope of this ticket)? idk does that make sense?

given that the full/"official" use of the PSL is potentially not going to be used, i think this would be really hard to test -- like how do we decide which multi-label public suffix every driver should deny? I feel like that's a conversation that would take more time to decide? idk does that make sense?

My understanding that we need to make those decisions now and leave the implementation to later, @Jibola ? Maybe the callback rejects it? I'm not sure TBH but worst case I suppose we could just remove these psl tests.

I don't think we should remove the PSL tests. I believe the tests that are there can be kept and that testing the DENY path would require us to pick a deniable PSL that we can say for absolute certainty isn't needed. I don't think that makes as much sense given things in the PSL are allowed to leave.

In the worst case, we can remove just the acceptance path test.

Overall, the should doesn't invalidate our expectations, it just makes it such that if you do not have something within the PSL you're still a valid implementation.

We do plan on including callbacks but not having a PSL whatsoever is currently not in scope.

I push we leave the testing as is and raise it as a point in our next iteration that leverages custom resolvers.

…covery.md Co-authored-by: Jeffrey 'Alex' Clark <aclark@aclark.net>

aclark4life

LGTM ~~pending resolution of #1950 (comment)~~!

aclark4life · 2026-09-03T00:11:08Z


+- 2026-08-31: Specify that host names returned through SRV records, and the `{domainname}` they are validated against,
+    are both normalized -- trailing dot stripped, converted to A-label form, ASCII lowercased -- before validation.
+    lowercase -- before validation.


Just noticed this dup line, can be dropped

good catch, fixed in c7c7726

aclark4life · 2026-09-03T00:23:29Z

Probably should drop "and the public suffix check is the only thing that can change the outcome."

fixed in c7c7726

add srvAllowedHostsSuffix

8c7bc69

rozza reviewed Jun 15, 2026

View reviewed changes

Comment thread ...initial-dns-seedlist-discovery/tests/replica-set/srvAllowedHostsSuffix-without_dot_pass.json Outdated

rozza reviewed Jun 15, 2026

View reviewed changes

sleepyStick added 2 commits June 15, 2026 10:41

fix yml test

790505e

tests should error

914c830

sleepyStick marked this pull request as ready for review June 16, 2026 19:50

sleepyStick requested review from a team as code owners June 16, 2026 19:50

sleepyStick requested review from aclark4life and matthewdale June 16, 2026 19:50

matthewdale requested changes Jun 17, 2026

View reviewed changes

codeowners-service-app Bot requested a review from vector-of-bool June 22, 2026 06:42

Jibola requested a review from rozza June 22, 2026 15:37

sleepyStick and others added 5 commits June 22, 2026 11:40

Update source/initial-dns-seedlist-discovery/initial-dns-seedlist-dis…

529ad3b

…covery.md Co-authored-by: Matt Dale <9760375+matthewdale@users.noreply.github.com>

Update source/initial-dns-seedlist-discovery/initial-dns-seedlist-dis…

6556c30

…covery.md Co-authored-by: Matt Dale <9760375+matthewdale@users.noreply.github.com>

address MD feedback

871c812

edit comment on yml test

c3f590c

minor edit to comment again haha

2dd89df

sleepyStick requested a review from matthewdale June 22, 2026 19:07

matthewdale previously approved these changes Jun 23, 2026

View reviewed changes

aclark4life reviewed Jun 23, 2026

View reviewed changes

aclark4life previously approved these changes Jun 23, 2026

View reviewed changes

sleepyStick requested review from Jibola and ajcvickers June 23, 2026 20:20

AC feedback

86d1633

adelinowona mentioned this pull request Sep 1, 2026

CSHARP-6213: Normalize SRV target host names to lower case during SRV polling mongodb/mongo-csharp-driver#2112

Merged

compromise 1

6f4dea1

sleepyStick requested a review from adelinowona September 2, 2026 15:43

Jibola approved these changes Sep 2, 2026

View reviewed changes

adelinowona reviewed Sep 2, 2026

View reviewed changes

sleepyStick and others added 2 commits September 2, 2026 10:24

Update source/initial-dns-seedlist-discovery/initial-dns-seedlist-dis…

bf61386

…covery.md Co-authored-by: Adelin Owona <51498470+adelinowona@users.noreply.github.com>

i think rule 1-3 were accidentally removed? and run pre-commit

7f5ef49

sleepyStick requested a review from aclark4life September 2, 2026 18:10

aclark4life requested changes Sep 2, 2026

View reviewed changes

AC feedback

774e15a

sleepyStick requested a review from aclark4life September 2, 2026 21:03

aclark4life requested changes Sep 2, 2026

View reviewed changes

AC feedback pt 2

4be82e2

sleepyStick requested a review from aclark4life September 2, 2026 21:29

aclark4life requested changes Sep 2, 2026

View reviewed changes

AC feedback pt 3

5ab10b2

sleepyStick requested a review from aclark4life September 2, 2026 21:46

aclark4life requested changes Sep 2, 2026

View reviewed changes

Comment thread .../initial-dns-seedlist-discovery/tests/replica-set/srvAllowedHostsSuffix-without_dot_pass.yml Outdated

Comment thread source/initial-dns-seedlist-discovery/initial-dns-seedlist-discovery.md Outdated

sleepyStick and others added 2 commits September 2, 2026 15:06

Update source/initial-dns-seedlist-discovery/initial-dns-seedlist-dis…

e3393a8

…covery.md Co-authored-by: Jeffrey 'Alex' Clark <aclark@aclark.net>

AC feedback pt 4

7711c55

sleepyStick requested a review from aclark4life September 2, 2026 22:07

aclark4life approved these changes Sep 2, 2026

View reviewed changes

aclark4life requested changes Sep 3, 2026

View reviewed changes

fix changelog dates and AC feedback pt 5

c7c7726

sleepyStick requested a review from aclark4life September 3, 2026 00:34

aclark4life approved these changes Sep 3, 2026

View reviewed changes

Jibola merged commit 131ab56 into mongodb:master Sep 3, 2026
6 checks passed

PavelSafronov mentioned this pull request Oct 1, 2026

feat(NODE-7830): add srvAllowedHostsSuffix and srvHostValidator options mongodb/node-mongodb-native#5065

Open

5 tasks


		#### srvAllowedHostsSuffix

		This option is used to validate hosts. If present, its value MUST be treated as the domain for DNS validation. For

		@@ -0,0 +1,6 @@
		{
		"uri": "mongodb+srv://test12.test.build.10gen.cc/?srvAllowedHostsSuffix=uild.10gen.cc",

Conversation

sleepyStick commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

rozza left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

codeowners-service-app Bot commented Jun 22, 2026

Uh oh!

matthewdale left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aclark4life left a comment

Choose a reason for hiding this comment

Uh oh!

ajcvickers commented Jun 25, 2026

Uh oh!

ajcvickers commented Jun 25, 2026

Uh oh!

sanych-sun commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sleepyStick Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

aclark4life left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

sleepyStick commented Jun 11, 2026 •

edited

Loading

sanych-sun commented Sep 1, 2026 •

edited

Loading

sleepyStick Sep 2, 2026 •

edited

Loading

aclark4life left a comment •

edited

Loading