[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8oN-sdo05XA7dGiN1IrQaqxfWUcKro6Tfkc_Z15NJUI":3},{"item":4,"related":44},{"id":5,"type":6,"title":7,"slug":8,"summary":9,"body":10,"coverUrl":11,"productScreenshots":12,"productLinks":13,"authorName":14,"authorUrl":15,"authorSubject":16,"category":17,"tags":22,"sourceLabel":35,"sourceName":35,"sourceUrl":36,"status":37,"seoTitle":7,"seoDescription":9,"canonicalUrl":38,"isFeatured":39,"sno":40,"sortOrder":41,"publishedAt":42,"updatedAt":43,"createdAt":43},"73ed5abb-b622-4f17-9a81-6388f891a042","article","DNS HTTPS 记录：域名解析为什么不只回答“服务器 IP 是多少”？","dns-https-svcb-service-binding-records","DNS 的 HTTPS 与 SVCB 记录可以发布服务目标、协议和端口等连接参数，帮助客户端更早选择合适的访问方式。本文区分服务发现与传统地址解析，并说明记录能提供线索，却不能替代客户端能力与安全验证。","传统 DNS 查询常被简化成一个问题：“这个域名对应哪个 IP 地址？”但现代连接还要回答更多问题：服务支持哪种传输协议、应连哪个主机或端口、是否有特定连接参数？SVCB 与 HTTPS 记录就是为这类服务绑定信息设计的 DNS 记录类型。\n\n## DNS 可以给出“怎么连接”的线索\n\nSVCB 记录可以发布服务目标和一组参数。HTTPS 记录则是面向 HTTPS 服务的特定形式。客户端除了获得目标名称，还可能读取协议标识、端口、地址提示及其他参数，从而在开始连接前更早选择合适路径。记录支持 AliasMode 与 ServiceMode 等不同表达方式：前者可将查询引向另一个名称，后者直接描述服务端点和参数。\n\n可以把 DNS 想成导航台。A 或 AAAA 记录像给出一个街道地址；HTTPS\u002FSVCB 则还可能附上“从哪个入口进、用哪种交通方式、服务台在哪个楼层”等说明。客户端仍需结合自身支持的协议、缓存结果和安全策略作决定，不会因为 DNS 给了线索就无条件照做。\n\n## 服务绑定不是身份认证的替代品\n\nDNS 记录可以帮助发现端点，但客户端仍需验证 TLS 证书、目标名称和连接安全。地址提示可能过期，客户端也可能不支持某个参数。若使用 DNSSEC，可以验证 DNS 数据来源和完整性，但 DNSSEC 不负责加密查询内容，也不自动证明目标应用值得信任。\n\nHTTPS 记录还可以携带与加密客户端问候相关的配置线索；实际隐私收益依赖客户端、递归解析器、权威 DNS 和服务器等多方支持。记录里出现某项能力，不代表中间网络一定不会观察到其他元数据，也不表示所有连接都会采用同一协议。\n\nSVCB\u002FHTTPS 的价值，是让 DNS 从“查地址”扩展到“发现服务端点及连接参数”，帮助客户端更聪明地建立连接。理解它时要分清解析与验证：DNS 提供可用的连接信息，客户端和传输安全机制仍负责确认“我到底连到了谁”。\n\n来源：[IETF RFC 9460：Service Binding and Parameter Specification via the DNS](https:\u002F\u002Fwww.rfc-editor.org\u002Finfo\u002Frfc9460\u002F)","\u002Fuploads\u002F2026-10-17\u002F8fa22967-2695-42cc-8d39-61695c707074.jpg",[],[],"Foundit","https:\u002F\u002Ffoundit.cn","foundit-ai-editorial",{"id":18,"name":19,"slug":20,"description":21},"6179d3b6-dc34-4483-9ded-3cd9f1b37a47","科普","abbreviation","介绍各领域新兴概念",[23,27,31],{"id":24,"name":25,"slug":26},"7c76bfc2-f80f-4ee0-a95d-27bd8708b434","技术","slug",{"id":28,"name":29,"slug":30},"a202d639-99a6-488a-a712-4d4c6ffd7e15","开发","dev",{"id":32,"name":33,"slug":34},"4c2bbea6-eab7-40a8-8447-1de478ff7749","分析","analyse","IETF RFC 9460","https:\u002F\u002Fwww.rfc-editor.org\u002Finfo\u002Frfc9460\u002F","published",null,false,53,0,"2026-10-17T00:00:00.000Z","2026-10-17T03:09:04.971Z",[45,54,62],{"id":46,"type":6,"title":47,"slug":48,"summary":49,"coverUrl":50,"authorName":14,"sno":51,"publishedAt":52,"createdAt":53},"9ccde95c-d754-4808-91f7-488f392e3eeb","你的品牌在AI眼里到底存不存在？这套系统说了算","automated-geo-monitoring-system","靠手动抽查来验证GEO效果，本质上是在跟概率玩游戏。赢一次，不代表能一直赢。","\u002Fuploads\u002F2026-08-07\u002Fdf111c0d-f14a-4b2a-8347-141e96b71654.jpg",1,"2026-08-07T00:00:00.000Z","2026-08-07T04:31:30.843Z",{"id":55,"type":6,"title":56,"slug":57,"summary":58,"coverUrl":59,"authorName":14,"sno":60,"publishedAt":42,"createdAt":61},"9865c835-21fc-4f74-b154-19c054173557","fscrypt：只给手机里的某个文件夹加密，系统怎么做到？","linux-fscrypt-file-based-encryption","Linux fscrypt 在支持的文件系统中为目录树、文件内容和文件名提供文件级加密。它与整盘加密保护的范围不同，也不会隐藏所有文件系统元数据；本文从解锁密钥说到备份与恢复的边界。","\u002Fuploads\u002F2026-10-17\u002Fdec803fe-0da3-4a9e-8ffc-47427cf599d6.jpg",41,"2026-10-17T03:08:37.641Z",{"id":63,"type":6,"title":64,"slug":65,"summary":66,"coverUrl":67,"authorName":14,"sno":68,"publishedAt":69,"createdAt":70},"56d3ebcb-170a-4f96-9134-ae85fb65542b","DANE\u002FTLSA：DNSSEC 能否帮助验证网站的 TLS 证书？","dane-tlsa-dnssec-tls-authentication","DANE 使用 DNS 中的 TLSA 记录发布与 TLS 服务证书或公钥相关的约束，并依赖 DNSSEC 验证记录来源。本文解释它如何补充信任路径，以及为什么它不等于所有网站都能抛弃 CA。","\u002Fuploads\u002F2026-10-13\u002F8c7d9bf5-62c6-47d4-b8eb-c4db7a21fa61.jpg",42,"2026-10-13T00:00:00.000Z","2026-10-13T02:13:55.563Z"]