前言

同事发来了一段流量，之前接触的dns流量都为A记录 ；NS记录； MX记录 ；CNAME记录 ；TXT记录 ；TTL值 ；PTR值，但是发现type值为65 新版本的wireshark显示为https

尝试

通过尝试使用dig命令 指定阿里dns 查询https类型的type，结果查询的是a记录

dig @223.5.5.5 log.mmstat.com https

后来看到这样一篇文章

https://blog.csdn.net/lionking1990/article/details/109386947

说是ios设备有这样的特征

复现

通过win10自带的热点功能，打开热点，
首先使用安卓链接，访问网页触发dns请求，结果和电脑本身流量一样 都是a记录之类，
断开安卓 使用ios设备链接

发现有type为https的流量

找到一份原始文档

https://tools.ietf.org/id/draft-ietf-dnsop-svcb-https-01.html#keys

SVCB/HTTPS RRs are intended for distribution over untrusted channels, and clients are REQUIRED to verify that the alternative endpoint is authoritative for the service (similar to Section 2.1 of [AltSvc]). Therefore, DNSSEC signing and validation are OPTIONAL for publishing and using SVCB and HTTPS RRs.

Clients MUST ensure that their DNS cache is partitioned for each local network, or flushed on network changes, to prevent a local adversary in one network from implanting a forged DNS record that allows them to track users or hinder their connections after they leave that network.

An attacker who can prevent SVCB resolution can deny clients any associated security benefits. A hostile recursive resolver can always deny service to SVCB queries, but network intermediaries can often prevent resolution as well, even when the client and recursive resolver validate DNSSEC and use a secure transport. These downgrade attacks can prevent the HTTPS upgrade provided by the HTTPS RR (Section 7.5), and disable the encryption enabled by the echconfig SvcParamKey (Section 8). To prevent downgrades, Section 3.1 recommends that clients abandon the connection attempt when such an attack is detected.

A hostile DNS intermediary might forge AliasForm “.” records (Section 2.5.1) as a way to block clients from accessing particular services. Such an adversary could already block entire domains by forging erroneous responses, but this mechanism allows them to target particular protocols or ports within a domain. Clients that might be subject to such attacks SHOULD ignore AliasForm “.” records.

使用这样的方法来提升安全性