Some users of my baresip Android app are complaining that baresip does
not use TLS to send messages to registrar/sip proxy if there is no NAPTR
records defined for the account's domain that would prioritize TLS over
other transports.
I tested it and indeed if I remove these:
$ host -t naptr
test.tutpro.com
test.tutpro.com has NAPTR record 100 10 "s" "SIPS+D2T" "" _sips._
tcp.test.tutpro.com.
test.tutpro.com has NAPTR record 102 10 "s" "SIP+D2U" "" _sip._
udp.test.tutpro.com.
test.tutpro.com has NAPTR record 101 10 "s" "SIP+D2T" "" _sip._
tcp.test.tutpro.com.
and leave only SRV records in place:
$ host -t srv _sip._
udp.test.tutpro.com.
_sip._
udp.test.tutpro.com has SRV record 0 0 5060
test.tutpro.com.
$ host -t srv _sip._
tcp.test.tutpro.com.
_sip._
tcp.test.tutpro.com has SRV record 0 0 5060
test.tutpro.com.
$ host -t srv _sips._
tcp.test.tutpro.com.
_sips._
tcp.test.tutpro.com has SRV record 0 0 5061
test.tutpro.com.
baresip chooses to register over TCP.
This is not against RFC 3263:
If no NAPTR records are found, the client constructs SRV queries for
those transport protocols it supports, and does a query for
each. Queries are done using the service identifier "_sip" for SIP URIs
and "_sips" for SIPS URIs. A particular transport is supported if the
query is successful. The client MAY use any transport protocol it
desires which is supported by the server.
But the problem is that nowadays many service providers don't anymore
configure NAPTR records and, for example, this blog claims that NAPTR
records is an "older method":
https://www.nurango.ca/blog/using-sip-srv-records
So what would it take to make baresip by default prioritize TLS if there
is no NAPTR records? That kind of behavior would not break RFC 3263
that allows choosing any transport protocol.
-- Juha