draft-ietf-dnsext-message-size-00.txt   draft-ietf-dnsext-message-size-01.txt 
DNSEXT Working Group Olafur Gudmundsson (NAI Labs) DNSEXT Working Group Olafur Gudmundsson (NAI Labs)
<draft-ietf-dnsext-message-size-00.txt> <draft-ietf-dnsext-message-size-01.txt>
Updates: RFC 2535 Updates: RFC 2535, RFC 2874
DNSSEC and IPv6 A6 aware server/resolver message size requirements DNSSEC and IPv6 A6 aware server/resolver message size requirements
Status of this Memo Status of this Memo
This document is an Internet-Draft and is in full conformance with This document is an Internet-Draft and is in full conformance with
all provisions of Section 10 of RFC2026. all provisions of Section 10 of RFC2026.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that Task Force (IETF), its areas, and its working groups. Note that
skipping to change at page 1, line 35 skipping to change at page 1, line 35
The list of current Internet-Drafts can be accessed at The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt http://www.ietf.org/ietf/1id-abstracts.txt
The list of Internet-Draft Shadow Directories can be accessed at The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html http://www.ietf.org/shadow.html
Comments should be sent to the authors or the DNSEXT WG mailing list Comments should be sent to the authors or the DNSEXT WG mailing list
namedroppers@ops.ietf.org namedroppers@ops.ietf.org
This draft expires on December 29, 2000. This draft expires on March 29, 2001.
Copyright Notice Copyright Notice
Copyright (C) The Internet Society (2000). All rights reserved. Copyright (C) The Internet Society (2000). All rights reserved.
Abstract Abstract
This document mandates support for EDNS0 in DNS entities claiming to This document mandates support for EDNS0 in DNS entities claiming to
support DNS Security Extensions and A6 records. This requirement is support DNS Security Extensions and A6 records. This requirement is
necessary because these new features increase the size of DNS necessary because these new features increase the size of DNS
messages. If EDNS0 is not supported fallback to TCP will happen, messages. If EDNS0 is not supported fallback to TCP will happen,
having a detrimental impact on query latency and DNS server load. having a detrimental impact on query latency and DNS server load.
1 - Introduction 1 - Introduction
Familiarity with the DNS [RFC1034, RFC1035], DNS Security Extensions Familiarity with the DNS[RFC1034, RFC1035], DNS Security
[RFC2535], EDNS0[RFC2671] and A6 [RFCA6] is helpful. Extensions[RFC2535], EDNS0[RFC2671] and A6[RFC2874] is helpful.
RFC 1035[RFC1035] Section 2.3.4 requires that DNS messages over UDP RFC 1035[RFC1035] Section 2.3.4 requires that DNS messages over UDP
have a data payload of 512 octets or less. Most DNS software today have a data payload of 512 octets or less. Most DNS software today
will not accept larger size UDP datagrams. Thus, any answer that will not accept larger size UDP datagrams. Thus, any answer that
requires more than 512 octets will result in a partial and probably requires more than 512 octets will result in a partial and probably
useless reply with the Truncation Bit set; in most cases the useless reply with the Truncation Bit set; in most cases the
requester will then retry using TCP. Some DNS servers send back an requester will then retry using TCP. Some DNS servers send back an
answer truncating the message at the last RR boundary before answer truncating the message at the last RR boundary before
truncation, other servers truncate at the previous set, some send truncation, other servers truncate at the previous set, some send
back empty answer with TC bit set. back empty answer with TC bit set.
Compared to UDP, TCP is an expensive protocol to use for a simple Compared to UDP, TCP is an expensive protocol to use for a simple
transaction like DNS: a TCP connection requires 5 packets for setup transaction like DNS: a TCP connection requires 5 packets for setup
and teardown, excluding data packets, thus requiring at least 3 and teardown, excluding data packets, thus requiring at least 3
round trips on top of the one for the original UDP query. The DNS round trips on top of the one for the original UDP query. The DNS
server also needs to keep a state of the connection during this server also needs to keep a state of the connection during this
transaction. As many DNS servers answer thousands of queries per transaction. As many DNS servers answer thousands of queries per
second, requiring them to use TCP will cause significant overhead and second, requiring them to use TCP will cause significant overhead and
delays. delays.
1.1 - DNSSEC motivations
DNSSEC[RFC2535] secures DNS by adding a Public Key signature on each DNSSEC[RFC2535] secures DNS by adding a Public Key signature on each
RR set. These signatures range in size from about 80 octets to 800 RR set. These signatures range in size from about 80 octets to 800
octets most are going to be in the range of 80..200 octets. The octets most are going to be in the range of 80..200 octets. The
addition of these signatures on each or most RR sets in an answer addition of these signatures on each or most RR sets in an answer
will significantly increase the size of DNS answers from secure will significantly increase the size of DNS answers from secure
zones. zones.
It is important that security aware servers and resolvers get all the
data in Answer and Authority section in one query without truncation.
In some cases it is important that some Additional Data be sent
along, mainly in delegation cases.
TSIG[RFC2845] allows for the light weight authentication of DNS TSIG[RFC2845] allows for the light weight authentication of DNS
messages, but increases the size of the messages by at least 70 messages, but increases the size of the messages by at least 70
octets. DNSSEC allows for computationally expensive message octets. DNSSEC allows for computationally expensive message
authentication with a standard public key signature. As only one TSIG authentication with a standard public key signature. As only one TSIG
or SIG(0) can be attached to each DNS answer the size increase of or SIG(0) can be attached to each DNS answer the size increase of
message authentication is not significant. message authentication is not significant, but may still lead to a
truncation.
IPv6 addresses[A6] are 128 bits and are represented in the DNS by 1.2 - IPv6 Motivations
multiple A6 records, each consisting of a domain name and a bit
IPv6 addresses[RFC2874] are 128 bits and are represented in the DNS
by multiple A6 records, each consisting of a domain name and a bit
field. The domain name refers to an address prefix that may require field. The domain name refers to an address prefix that may require
additional A6 RRs to be included in the answer. Answers where additional A6 RRs to be included in the answer. Answers where
queried name has multiple A6 addresses may overflow a 512-octet UDP queried name has multiple A6 addresses may overflow a 512-octet UDP
packet size. packet size.
1.3 Root server and TLD server motivations
The current number of root servers is limited to 13 as that is the The current number of root servers is limited to 13 as that is the
maximum number of name servers and their address records that fit in maximum number of name servers and their address records that fit in
one 512-octet DNS message. If root servers start advertising A6 or one 512-octet DNS message. If root servers start advertising A6 or
KEY records then the root zone answer for NS records will not fit in KEY records then the root zone answer for NS records will not fit in
an single 512-octet DNS message. Resulting in a large number of TCP an single 512-octet DNS message. Resulting in a large number of TCP
connections to the root servers. connections to the root servers.
It is important that a high level domains have a high number of
domain name servers for redundancy, latency and load balancing
reasons.
1.4 UDP vs TCP for DNS messages
Given all these factors, it is essential that any implementations Given all these factors, it is essential that any implementations
that supports DNSSEC and or A6 be able to use larger DNS messages that supports DNSSEC and or A6 be able to use larger DNS messages
than 512 octets. than 512 octets.
The original 512 restriction was put in place to avoid fragmentation
of DNS responses. A fragmented UDP message that suffers a loss off
one of the fragments renders the answer useless and DNS must
retransmit the query. TCP connection requires number of round trips
for establishment, data transfer and tear down, but only the lost
data segments are retransmitted.
In the early days number of IP implementations did not handle
fragmentation well, but all modern operating systems have overcome
that issue thus sending fragmented messages is fine from that
standpoint. The open issue is the effect of losses on fragmented
messages. If connection has high loss ratio only TCP will allow
reliable transfer of DNS data, most links have low loss ratios thus
sending fragmented UDP packet in one round trip is better than
establishing a TCP connection to transfer few thousand octets.
1.5 EDNS0 and large UDP messages
EDNS0[RFC2671] allows clients to declare the maximum size of UDP EDNS0[RFC2671] allows clients to declare the maximum size of UDP
message they are willing to handle. Thus, if the expected answer is message they are willing to handle. Thus, if the expected answer is
between 512 octets and the maximum size that the client can accept, between 512 octets and the maximum size that the client can accept,
the additional overhead of a TCP connection can be avoided. the additional overhead of a TCP connection can be avoided.
1.2 - Requirements 1.7 - Requirements
The key words "MUST", "REQUIRED", "SHOULD", "RECOMMENDED", and "MAY" The key words "MUST", "REQUIRED", "SHOULD", "RECOMMENDED", and "MAY"
in this document are to be interpreted as described in RFC 2119. in this document are to be interpreted as described in RFC 2119.
2 - Protocol changes: 2 - Protocol changes:
This document updates [RFC2535] and [A6]. This document updates [RFC2535] and [RFC2874], by adding new
requirements.
All RFC2535-compliant servers and resolvers MUST support EDNS0 and All RFC2535-compliant servers and resolvers MUST support EDNS0 and
advertise message size of at least 1280 octets. advertise message size of at least 1220 octets, but SHOULD advertise
message size of 4000. This value might be too low to get full
answers for high level servers and successor of this document may
require a larger value.
All [A6] compliant servers and resolver MUST support EDNS0 and All RFC2874-compliant servers and resolver MUST support EDNS0 and
advertise message size of at least 1280 octets. advertise message size of at least 1024 octets, but SHOULD advertise
message size of 2048.
All RFC2535 and RFC2874 compliant entities MUST be able to handle
fragmented IP and IPv6 UDP packets.
All hosts supporting both RFC2535 and RFC2874 MUST use the larger
required value in EDNS0 advertisements.
3 Acknowledgments 3 Acknowledgments
Harald Alvestrand, Rob Austein, Randy Bush, David Conrad, Andreas Harald Alvestrand, Rob Austein, Randy Bush, David Conrad, Andreas
Gustafsson, Bob Halley and Edward Lewis where instrumental in Gustafsson, Bob Halley, Edward Lewis and Kazu Yamamoto where
motivating and shaping this document. instrumental in motivating and shaping this document.
4 - Security Considerations: 4 - Security Considerations:
There are no additional security considerations other than those in There are no additional security considerations other than those in
RFC2671. RFC2671.
5 - IANA Considerations: 5 - IANA Considerations:
None None
References: References:
[RFC1034] P. Mockapetris, ``Domain Names - Concepts and Facilities''
STD 13, RFC 1034, November 1987.
[RFC1035] P. Mockapetris, ``Domain Names - Implementation and [RFC1035] P. Mockapetris, ``Domain Names - Implementation and
Specification'', STD 13, RFC 1035, November 1987. Specification'', STD 13, RFC 1035, November 1987.
[RFC2535] D. Eastlake, ``Domain Name System Security Extensions'', RFC [RFC2535] D. Eastlake, ``Domain Name System Security Extensions'', RFC
2535, March 1999. 2535, March 1999.
[RFC2671] P. Vixie, ``Extension Mechanisms for DNS (EDNS0)'', RFC [RFC2671] P. Vixie, ``Extension Mechanisms for DNS (EDNS0)'', RFC
2671, August 1999. 2671, August 1999.
[RFC2845] P. Vixie, O. Gudmundsson, D. Eastlake, B. Wellington, [RFC2845] P. Vixie, O. Gudmundsson, D. Eastlake, B. Wellington,
``Secret Key Transaction Authentication for DNS (TSIG)'', RFC ``Secret Key Transaction Authentication for DNS (TSIG)'', RFC
2845, May 2000. 2845, May 2000.
[A6] M. Crawford, C. Huitema, S. Thompson, ``DNS Extensions to [RFC2874] M. Crawford, C. Huitema, S. Thompson, ``DNS Extensions to
Support IPv6 Address Aggregation and Renumbering'', RFCxxx, Support IPv6 Address Aggregation and Renumbering'', RFC2874,
Sometime 2000. Sometime 2000.
Author Address Author Address
Olafur Gudmundsson Olafur Gudmundsson
NAI Labs NAI Labs
Network Associates Network Associates
3060 Washington Road (Rt. 97) 3060 Washington Road (Rt. 97)
Glenwood, MD 21738 Glenwood, MD 21738
USA USA
 End of changes. 

This html diff was produced by rfcdiff 1.23, available from http://www.levkowetz.com/ietf/tools/rfcdiff/