[rollcat]

> But as a result the browser has to support Apple DNS protocol which can potentially increase attack surface.

The "Apple" DNS protocol is standard DNS, over a multicast IP address, on port 5353. You can literally use plain old dig to perform mDNS lookups:

    $ dig @224.0.0.251 -p 5353 +short hello.local

    192.168.123.45

If DNS lookups considerably increase your attack surface, something is very, very wrong with your architecture.

[webrtcdev1]

> literally

The DNS names WebRTC generates for this purpose are random, and known only to the signaling participants.

[wbl]

I remember old BIND versions