Domain Name System Operations                                J. Kristoff
Internet-Draft                                         DePaul University
Intended status: Best Current Practice                   August 25, 2016
Expires: February 26, 2017


           DNS Transport over TCP - Operational Requirements
              draft-kristoff-dnsop-dns-tcp-requirements-01

Abstract

   This document encourages the practice of permitting DNS messages to
   be carried over TCP on the Internet.  It also describes some of the
   consequences of this behavior and the potential operational issues
   that can arise when this best common practice is not applied.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on February 26, 2017.

Copyright Notice

   Copyright (c) 2016 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.




Kristoff                Expires February 26, 2017               [Page 1]

 
Internet-Draft           DNS Transport over TCP              August 2016


Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
     1.1.  Requirements Language . . . . . . . . . . . . . . . . . .   2
   2.  Background  . . . . . . . . . . . . . . . . . . . . . . . . .   2
     2.1.  Uneven Transport Usage and Preference . . . . . . . . . .   2
     2.2.  Waiting for Large Messages and Reliability  . . . . . . .   3
     2.3.  EDNS0 . . . . . . . . . . . . . . . . . . . . . . . . . .   4
   3.  DNS over TCP Requirements . . . . . . . . . . . . . . . . . .   4
   4.  DNS over TCP Filtering Risks  . . . . . . . . . . . . . . . .   5
   5.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . .   5
   6.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   5
   7.  Security Considerations . . . . . . . . . . . . . . . . . . .   5
   8.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   6
     8.1.  Normative References  . . . . . . . . . . . . . . . . . .   6
     8.2.  Informative References  . . . . . . . . . . . . . . . . .   6
   Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .   8

.  Introduction

   DNS messages may be delivered using UDP or TCP communications.  While
   most DNS transactions are carried over UDP, some operators have been
   led to believe that any DNS over TCP traffic is unwanted or
   unnecessary for general DNS operation.  As usage and features have
   evolved, TCP transport has become increasingly important for correct
   and safe operation of the Internet DNS.  Reflecting modern usage, the
   DNS standards were recently updated to declare support for TCP is now
   a required part of the DNS implementation specifications in
   [RFC7766].  This document is the formal requirements equivalent for
   the operational community, encouraging operators to ensure DNS over
   TCP communications support in on par with DNS over UDP
   communications.

1.1.  Requirements Language

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in RFC 2119 [RFC2119].

.  Background

2.1.  Uneven Transport Usage and Preference

   In the original suite of DNS specifications, [RFC1034] and [RFC1035]
   clearly specified that DNS messages could be carried in either UDP or
   TCP, but they also made clear a preference for UDP as the transport
   for queries in the general case.  As stated in [RFC1035]:




Kristoff                Expires February 26, 2017               [Page 2]

 
Internet-Draft           DNS Transport over TCP              August 2016


      "While virtual circuits can be used for any DNS activity,
      datagrams are preferred for queries due to their lower overhead
      and better performance."

   Another early, important, and influential document, [RFC1123],
   detailed the preference for UDP more explicitly:

      "DNS resolvers and recursive servers MUST support UDP, and SHOULD
      support TCP, for sending (non-zone-transfer) queries."

   and further stipulated:

      A name server MAY limit the resources it devotes to TCP queries,
      but it SHOULD NOT refuse to service a TCP query just because it
      would have succeeded with UDP.

   Culminating in [RFC1536], DNS over TCP came to be associated
   primarily with the zone transfer mechanism, while most DNS queries
   and responses were seen as the dominion of UDP.

2.2.  Waiting for Large Messages and Reliability

   As stipulated in the original specifications, DNS messages over UDP
   were restricted to a 512-byte message size.  However, even while
   [RFC1123] made a clear preference for UDP, it foresaw DNS over TCP
   becoming more popular in the future:

      "[...] it is also clear that some new DNS record types defined in
      the future will contain information exceeding the 512 byte limit
      that applies to UDP, and hence will require TCP.

   At least two new, widely anticipated developments were set to elevate
   the need for DNS over TCP transactions.  The first was dynamic
   updates defined in [RFC2136] and the second was the set of extensions
   collectively known as DNSSEC originally specified in [RFC2541].  The
   former suggested "requestors who require an accurate response code
   must use TCP", while the later warned "[...] larger keys increase the
   size of KEY and SIG RRs.  This increases the chance of DNS UDP packet
   overflow and the possible necessity for using higher overhead TCP in
   responses."

   Yet defying some expectations, DNS over TCP remained little used in
   real traffic across the Internet.  Dynamic updates saw little
   deployment between autonomous networks.  Around the time DNSSEC was
   first defined, another new feature affecting DNS over UDP helped
   solidify its dominance for message transactions.





Kristoff                Expires February 26, 2017               [Page 3]

 
Internet-Draft           DNS Transport over TCP              August 2016


2.3.  EDNS0

   In 1999 the IETF published the Extension Mechanisms for DNS (EDNS0)
   in [RFC2671].  This document standardized a way for communicating DNS
   nodes to perform rudimentary capabilities negotiation.  One such
   capability written into the base specification and present in every
   ENDS0 compatible message is the value of the maximum UDP payload size
   the sender can support.  This unsigned 16-bit field specifies in
   bytes the maximum DNS MTU.  In practice, typical values are a subset
   of the 512 to 4096 byte range.  EDNS0 was rapidly and widely deployed
   over the next several years and numerous surveys have shown many
   systems currently support larger UDP MTUs [CASTRO2010], [NETALYZR]
   with EDNS0.

   The natural effect of EDNS0 deployment meant large DNS messages would
   be less reliant on TCP than they might otherwise have been.  While a
   nonneglible population of DNS systems lack EDNS0 or may still fall
   back to TCP for some transactions, DNS over TCP transactions remain a
   very small fraction of overall DNS traffic [VERISIGN].  Nevertheless,
   some average increase in DNS message size, the continued development
   of new DNS features and a denial of service mitigation technique (see
   Section 7) have suggested that DNS over TCP transactions are as
   important to the correct and safe operation of the Internet DNS as
   ever, if not more so.  Furthermore, there has been serious research
   that has suggested connection-oriented DNS transactions may provide
   security and privacy advantages over UDP transport [TDNS].
   Therefore, it might be desirable for network operators to avoid
   artificially inhibiting the potential utility and advances in the DNS
   such as these.

.  DNS over TCP Requirements

   Even while many in the DNS community expect DNS over TCP transactions
   to occur without interference, in practice there has been a long held
   belief by some operators, particularly for security-related reasons,
   to the contrary [CHES94], [DJBDNS].  A popular meme has also held the
   imagination of some that DNS over TCP is only ever used for zone
   transfers and is generally unnecessary otherwise, with filtering all
   DNS over TCP traffic even described as a best practice.  Arguably any
   exposed Internet service poses some risk, but these beliefs are often
   invalid.  DNS over TCP filtering is considered harmful in the general
   case.  DNS resolver and server operators MUST provide DNS service
   over both UDP and TCP transports.  Likewise, network operators MUST
   allow DNS service over both UDP and TCP transports.







Kristoff                Expires February 26, 2017               [Page 4]

 
Internet-Draft           DNS Transport over TCP              August 2016


.  DNS over TCP Filtering Risks

   Networks that filter DNS over TCP may inadvertently cause problems
   for third party resolvers as experienced by [TOYAMA].  If for
   instance a resolver receives a truncated answer from a server, but if
   when the resolver resends the query using TCP and the TCP response
   never arrives, the resolver will incur the full extent of TCP
   retransmissions and time outs.

   Networks that filter DNS over TCP risk losing access to significant
   or important pieces of the DNS name space.  For a variety of reasons
   a DNS answer may require a DNS over TCP query.  This may include
   large message sizes, lack of EDNS0 support, DDoS mitigation
   techniques, or perhaps some future capability that is as yet
   unforeseen will also demand TCP transport.

   Even if any or all particular answers have consistently been returned
   successfuly with UDP in the past, this continued behavior cannot be
   guaranteed when DNS messages are exchanged between autonomous
   systems.  Therefore, filtering of DNS over TCP is considered harmful
   and contrary to the safe and successful operation of the Internet.

.  Acknowledgements

   This document was initially motivated by feedback from students who
   pointed out that they were hearing contradictory information about
   filtering DNS over TCP messages.  Thanks in particular to my teaching
   colleague, JPL, who perhaps unknowingly encouraged the initial
   research into the differences of what the IETF community has
   historically said and did.  Thanks to all the NANOG 63 attendees who
   provided feedback to an early talk on this subject.

.  IANA Considerations

   This memo includes no request to IANA.

.  Security Considerations

   Ironically, returning truncated DNS over UDP answers in order to
   induce a client query to switch to DNS over TCP has become a common
   response to source address spoofed, DNS denial-of-service attacks
   [RRL].  Historically, operators have been wary of TCP-based attacks,
   but in recent years, UDP-based flooding attacks have proven to be the
   most common protocol attack on the DNS.  Nevertheless, a high rate of
   short-lived DNS transactions over TCP may pose challenges.  While
   many operators have provided DNS over TCP service for many years
   without duress, past experience is no guarantee of future success.




Kristoff                Expires February 26, 2017               [Page 5]

 
Internet-Draft           DNS Transport over TCP              August 2016


   DNS over TCP is not unlike many other Internet TCP services.  TCP
   threats and many mitigation strategies have been well documented in
   series of documents such as [RFC4953], [RFC4987], [RFC5927], and
   [RFC5961].

.  References

8.1.  Normative References

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119,
              DOI 10.17487/RFC2119, March 1997,
              <http://www.rfc-editor.org/info/rfc2119>.

8.2.  Informative References

   [CASTRO2010]
              Castro, S., Zhang, M., John, W., Wessels, D., and k.
              claffy, "Understanding and preparing for DNS evolution",
              2010.

   [CHES94]   Cheswick, W. and S. Bellovin, "Firewalls and Internet
              Security: Repelling the Wily Hacker", 1994.

   [DJBDNS]   D.J. Bernstein, "When are TCP queries sent?", 2002,
              <https://cr.yp.to/djbdns/tcp.html#why>.

   [NETALYZR]
              Kreibich, C., Weaver, N., Nechaev, B., and V. Paxson,
              "Netalyzr: Illuminating The Edge Network", 2010.

   [RFC1034]  Mockapetris, P., "Domain names - concepts and facilities",
              STD 13, RFC 1034, DOI 10.17487/RFC1034, November 1987,
              <http://www.rfc-editor.org/info/rfc1034>.

   [RFC1035]  Mockapetris, P., "Domain names - implementation and
              specification", STD 13, RFC 1035, DOI 10.17487/RFC1035,
              November 1987, <http://www.rfc-editor.org/info/rfc1035>.

   [RFC1123]  Braden, R., Ed., "Requirements for Internet Hosts -
              Application and Support", STD 3, RFC 1123,
              DOI 10.17487/RFC1123, October 1989,
              <http://www.rfc-editor.org/info/rfc1123>.

   [RFC1536]  Kumar, A., Postel, J., Neuman, C., Danzig, P., and S.
              Miller, "Common DNS Implementation Errors and Suggested
              Fixes", RFC 1536, DOI 10.17487/RFC1536, October 1993,
              <http://www.rfc-editor.org/info/rfc1536>.



Kristoff                Expires February 26, 2017               [Page 6]

 
Internet-Draft           DNS Transport over TCP              August 2016


   [RFC2136]  Vixie, P., Ed., Thomson, S., Rekhter, Y., and J. Bound,
              "Dynamic Updates in the Domain Name System (DNS UPDATE)",
              RFC 2136, DOI 10.17487/RFC2136, April 1997,
              <http://www.rfc-editor.org/info/rfc2136>.

   [RFC2541]  Eastlake 3rd, D., "DNS Security Operational
              Considerations", RFC 2541, DOI 10.17487/RFC2541, March
              1999, <http://www.rfc-editor.org/info/rfc2541>.

   [RFC2671]  Vixie, P., "Extension Mechanisms for DNS (EDNS0)",
              RFC 2671, DOI 10.17487/RFC2671, August 1999,
              <http://www.rfc-editor.org/info/rfc2671>.

   [RFC4953]  Touch, J., "Defending TCP Against Spoofing Attacks",
              RFC 4953, DOI 10.17487/RFC4953, July 2007,
              <http://www.rfc-editor.org/info/rfc4953>.

   [RFC4987]  Eddy, W., "TCP SYN Flooding Attacks and Common
              Mitigations", RFC 4987, DOI 10.17487/RFC4987, August 2007,
              <http://www.rfc-editor.org/info/rfc4987>.

   [RFC5927]  Gont, F., "ICMP Attacks against TCP", RFC 5927,
              DOI 10.17487/RFC5927, July 2010,
              <http://www.rfc-editor.org/info/rfc5927>.

   [RFC5961]  Ramaiah, A., Stewart, R., and M. Dalal, "Improving TCP's
              Robustness to Blind In-Window Attacks", RFC 5961,
              DOI 10.17487/RFC5961, August 2010,
              <http://www.rfc-editor.org/info/rfc5961>.

   [RFC7766]  Dickinson, J., Dickinson, S., Bellis, R., Mankin, A., and
              D. Wessels, "DNS Transport over TCP - Implementation
              Requirements", RFC 7766, DOI 10.17487/RFC7766, March 2016,
              <http://www.rfc-editor.org/info/rfc7766>.

   [RRL]      Vixie, P. and V. Schryver, "DNS Response Rate Limiting
              (DNS RRL)", ISC-TN 2012-1 Draft1, April 2012.

   [TDNS]     Zhu, L., Heidemann, J., Wessels, D., Mankin, A., and N.
              Somaiya, "Connection-oriented DNS to Improve Privacy and
              Security", 2015.

   [TOYAMA]   Toyama, K., Ishibashi, K., Ishino, M., Yoshimura, C., and
              K. Fujiwara, "DNS Anomalies and Their Impacts on DNS Cache
              Servers", NANOG 32 Reston, VA USA, 2004.






Kristoff                Expires February 26, 2017               [Page 7]

 
Internet-Draft           DNS Transport over TCP              August 2016


   [VERISIGN]
              Thomas, M. and D. Wessels, "An Analysis of TCP Traffic in
              Root Server DITL Data", DNS-OARC 2014 Fall Workshop Los
              Angeles, 2014.

Author's Address

   John Kristoff
   DePaul University
   Chicago, IL
   US

   Phone: +1 312 493 0305
   Email: jtk@depaul.edu





































Kristoff                Expires February 26, 2017               [Page 8]