draft-ietf-dnsext-message-size-02.txt   draft-ietf-dnsext-message-size-03.txt 
DNSEXT Working Group Olafur Gudmundsson (NAI Labs) DNSEXT Working Group Olafur Gudmundsson (NAI Labs)
<draft-ietf-dnsext-message-size-02.txt> <draft-ietf-dnsext-message-size-03.txt>
Updates: RFC 2535, RFC 2874 Updates: RFC 2535, RFC 2874
DNSSEC and IPv6 A6 aware server/resolver message size requirements DNSSEC and IPv6 A6 aware server/resolver message size requirements
Status of this Memo Status of this Memo
This document is an Internet-Draft and is in full conformance with This document is an Internet-Draft and is in full conformance with
all provisions of Section 10 of RFC2026. all provisions of Section 10 of RFC2026.
skipping to change at page 1, line 44 skipping to change at page 1, line 44
This draft expires on July 20, 2001. This draft expires on July 20, 2001.
Copyright Notice Copyright Notice
Copyright (C) The Internet Society (2001). All rights reserved. Copyright (C) The Internet Society (2001). All rights reserved.
Abstract Abstract
This document mandates support for EDNS0 in DNS entities claiming to This document mandates support for EDNS0 in DNS entities claiming to
support DNS Security Extensions and A6 records. This requirement is support either DNS Security Extensions or A6 records. This
necessary because these new features increase the size of DNS requirement is necessary because these new features increase the size
messages. If EDNS0 is not supported fall back to TCP will happen, of DNS messages. If EDNS0 is not supported fall back to TCP will
having a detrimental impact on query latency and DNS server load. happen, having a detrimental impact on query latency and DNS server
load.
1 - Introduction 1 - Introduction
Familiarity with the DNS[RFC1034, RFC1035], DNS Security Familiarity with the DNS[RFC1034, RFC1035], DNS Security
Extensions[RFC2535], EDNS0[RFC2671] and A6[RFC2874] is helpful. Extensions[RFC2535], EDNS0[RFC2671] and A6[RFC2874] is helpful.
RFC 1035[RFC1035] Section 2.3.4 requires that DNS messages over UDP RFC 1035[RFC1035] Section 2.3.4 requires that DNS messages over UDP
have a data payload of 512 octets or less. Most DNS software today have a data payload of 512 octets or less. Most DNS software today
will not accept larger UDP datagram. Any answer that requires more will not accept larger UDP datagrams. Any answer that requires more
than 512 octets, results in a partial and sometimes useless reply than 512 octets, results in a partial and sometimes useless reply
with the Truncation Bit set; in most cases the requester will then with the Truncation Bit set; in most cases the requester will then
retry using TCP. Some DNS servers send back an answer truncating the retry using TCP. Furthermore, server delivery of truncated responses
message at the last RR boundary before truncation, other truncate at varies widely and resolver handling of these responses also varies,
the previous set, some send back empty answer with TC bit set. leading to additional inefficiencies in handling truncation.
Compared to UDP, TCP is an expensive protocol to use for a simple Compared to UDP, TCP is an expensive protocol to use for a simple
transaction like DNS: a TCP connection requires 5 packets for setup transaction like DNS: a TCP connection requires 5 packets for setup
and tear down, excluding data packets, thus requiring at least 3 and tear down, excluding data packets, thus requiring at least 3
round trips on top of the one for the original UDP query. The DNS round trips on top of the one for the original UDP query. The DNS
server also needs to keep a state of the connection during this server also needs to keep a state of the connection during this
transaction. Many DNS servers answer thousands of queries per second, transaction. Many DNS servers answer thousands of queries per
requiring them to use TCP will cause significant overhead and delays. second, requiring them to use TCP will cause significant overhead and
delays.
1.1 - DNSSEC motivations 1.1 - Requirements
The key words ``MUST'' ``REQUIRED'', ``SHOULD'', ``RECOMMENDED'',
and ``MAY'' in this document are to be interpreted as described in
RFC 2119.
2 Motivating factors
2.1 - DNSSEC motivations
DNSSEC[RFC2535] secures DNS by adding a Public Key signature on each DNSSEC[RFC2535] secures DNS by adding a Public Key signature on each
RR set. These signatures range in size from about 80 octets to 800 RR set. These signatures range in size from about 80 octets to 800
octets, most are going to be in the range of 80 to 200 octets. The octets, most are going to be in the range of 80 to 200 octets. The
addition of signatures on each or most RR sets in an answer addition of signatures on each or most RR sets in an answer
significantly increases the size of DNS answers from secure zones. significantly increases the size of DNS answers from secure zones.
For performance reasons and to reduce load on DNS servers, it is For performance reasons and to reduce load on DNS servers, it is
important that security aware servers and resolvers get all the data important that security aware servers and resolvers get all the data
in Answer and Authority section in one query without truncation. in Answer and Authority section in one query without truncation.
Sending Additional Data in the same query is helpful when the server Sending Additional Data in the same query is helpful when the server
is authorative for the data, and this reduces round trips. is authorative for the data, and this reduces round trips.
DNSSEC OK[OK] specifies how a client can, using EDNS0, indicate that
it is interested in receiving DNSSEC records. The OK bit does not
eliminate the need for large answers for DNSSEC capable clients.
2.1.1 Message authenticaion or TSIG motivation
TSIG[RFC2845] allows for the light weight authentication of DNS TSIG[RFC2845] allows for the light weight authentication of DNS
messages, but increases the size of the messages by at least 70 messages, but increases the size of the messages by at least 70
octets. DNSSEC specifies for computationally expensive message octets. DNSSEC specifies for computationally expensive message
authentication SIG(0) using a standard public key signature. As only authentication SIG(0) using a standard public key signature. As only
one TSIG or SIG(0) can be attached to each DNS answer the size one TSIG or SIG(0) can be attached to each DNS answer the size
increase of message authentication is not significant, but may still increase of message authentication is not significant, but may still
lead to a truncation. lead to a truncation.
DNSSEC OK[OK] specifies how a client can, using EDNS0, indicate that 2.2 - IPv6 Motivations
it is interested in receiving DNSSEC records. The OK bit does not
eliminate the need for large answers for DNSSEC capable clients.
1.2 - IPv6 Motivations
IPv6 addresses[RFC2874] are 128 bits and are represented in the DNS IPv6 addresses[RFC2874] are 128 bits and are represented in the DNS
by multiple A6 records, each consisting of a domain name and a bit by multiple A6 records, each consisting of a domain name and a bit
field. The domain name refers to an address prefix that may require field. The domain name refers to an address prefix that may require
additional A6 RRs to be included in the answer. Answers where additional A6 RRs to be included in the answer. Answers where the
queried name has multiple A6 addresses may overflow a 512-octet UDP queried name has multiple A6 addresses may overflow a 512-octet UDP
packet size. packet size.
1.3 Root server and TLD server motivations 2.3 Root server and TLD server motivations
The current number of root servers is limited to 13 as that is the The current number of root servers is limited to 13 as that is the
maximum number of name servers and their address records that fit in maximum number of name servers and their address records that fit in
one 512-octet answer for a SOA record. If root servers start one 512-octet answer for a SOA record. If root servers start
advertising A6 or KEY records then the answer for the root NS records advertising A6 or KEY records then the answer for the root NS records
will not fit in a single 512-octet DNS message, resulting in a large will not fit in a single 512-octet DNS message, resulting in a large
number of TCP query connections to the root servers. number of TCP query connections to the root servers. Even if all
client resolver query their local name server for information, there
are millions of these servers. Each name server must periodically
update its information about the high level servers.
For redundancy, latency and load balancing reasons it is important For redundancy, latency and load balancing reasons, large numbers of
large number of DNS servers are used for Root and large TLD's. DNS servers are required for some zones. Since the root zone is used
by the entire net, it is important to have as many servers as
possible. Large TLDs (and many high-visibility SLDs) often have
enough servers that either A6 or KEY records would cause the NS
response to overflow the 512 byte limit. Note that these zones with
large numbers of servers are often exactly those zones that are
critical to network operation and that already sustain fairly high
loads.
1.4 UDP vs TCP for DNS messages 2.4 UDP vs TCP for DNS messages
Given all these factors, it is essential that any implementations Given all these factors, it is essential that any implementation that
that supports DNSSEC and or A6 be able to use larger DNS messages supports DNSSEC and or A6 be able to use larger DNS messages than 512
than 512 octets. octets.
The original 512 restriction was put in place to avoid fragmentation The original 512 restriction was put in place to avoid fragmentation
of DNS responses. A fragmented UDP message that suffers a loss off of DNS responses. A fragmented UDP message that suffers a loss of
one of the fragments renders the answer useless and query must be one of the fragments renders the answer useless and the query must be
retried. TCP connection requires number of round trips for retried. A TCP connection requires a larger number of round trips
establishment, data transfer and tear down, but only the lost data for establishment, data transfer and tear down, but only the lost
segments are retransmitted. data segments are retransmitted.
In the early days number of IP implementations did not handle In the early days a number of IP implementations did not handle
fragmentation well, but all modern operating systems have overcome fragmentation well, but all modern operating systems have overcome
that issue thus sending fragmented messages is fine from that that issue thus sending fragmented messages is fine from that
standpoint. The open issue is the effect of losses on fragmented standpoint. The open issue is the effect of losses on fragmented
messages. If connection has high loss ratio only TCP will allow messages. If connection has high loss ratio only TCP will allow
reliable transfer of DNS data, most links have low loss ratios thus reliable transfer of DNS data, most links have low loss ratios thus
sending fragmented UDP packet in one round trip is better than sending fragmented UDP packet in one round trip is better than
establishing a TCP connection to transfer few thousand octets. establishing a TCP connection to transfer a few thousand octets.
1.5 EDNS0 and large UDP messages 2.5 EDNS0 and large UDP messages
EDNS0[RFC2671] allows clients to declare the maximum size of UDP EDNS0[RFC2671] allows clients to declare the maximum size of UDP
message they are willing to handle. Thus, if the expected answer is message they are willing to handle. Thus, if the expected answer is
between 512 octets and the maximum size that the client can accept, between 512 octets and the maximum size that the client can accept,
the additional overhead of a TCP connection can be avoided. the additional overhead of a TCP connection can be avoided.
1.6 - Requirements 3 - Protocol changes:
The key words ``MUST'' ``REQUIRED'', ``SHOULD'', ``RECOMMENDED'',
and ``MAY'' in this document are to be interpreted as described in
RFC 2119.
2 - Protocol changes:
This document updates [RFC2535] and [RFC2874], by adding new This document updates [RFC2535] and [RFC2874], by adding new
requirements. requirements.
All RFC2535-compliant servers and resolvers MUST support EDNS0 and All RFC2535-compliant servers and resolvers MUST support EDNS0 and
advertise message size of at least 1220 octets, but SHOULD advertise advertise message size of at least 1220 octets, but SHOULD advertise
message size of 4000. This value might be too low to get full message size of 4000. This value might be too low to get full
answers for high level servers and successor of this document may answers for high level servers and successor of this document may
require a larger value. require a larger value.
skipping to change at page 4, line 40 skipping to change at page 5, line 8
advertise message size of at least 1024 octets, but SHOULD advertise advertise message size of at least 1024 octets, but SHOULD advertise
message size of 2048. The IPv6 datagrams should be 1024 octets, message size of 2048. The IPv6 datagrams should be 1024 octets,
unless the MTU of the path is known. unless the MTU of the path is known.
All RFC2535 and RFC2874 compliant entities MUST be able to handle All RFC2535 and RFC2874 compliant entities MUST be able to handle
fragmented IP and IPv6 UDP packets. fragmented IP and IPv6 UDP packets.
All hosts supporting both RFC2535 and RFC2874 MUST use the larger All hosts supporting both RFC2535 and RFC2874 MUST use the larger
required value in EDNS0 advertisements. required value in EDNS0 advertisements.
3 Acknowledgments 4 Acknowledgments
Harald Alvestrand, Rob Austein, Randy Bush, David Conrad, Andreas Harald Alvestrand, Rob Austein, Randy Bush, David Conrad, Andreas
Gustafsson, Jun-ichiro itojun Hagino, Bob Halley, Edward Lewis and Gustafsson, Jun-ichiro itojun Hagino, Bob Halley, Edward Lewis
Kazu Yamamoto where instrumental in motivating and shaping this Michael Patton and Kazu Yamamoto were instrumental in motivating and
document. shaping this document.
4 - Security Considerations: 4 - Security Considerations:
There are no additional security considerations other than those in There are no additional security considerations other than those in
RFC2671. RFC2671.
5 - IANA Considerations: 5 - IANA Considerations:
None None
skipping to change at page 6, line 8 skipping to change at page 6, line 12
[RFC2874] M. Crawford, C. Huitema, ``DNS Extensions to Support IPv6 [RFC2874] M. Crawford, C. Huitema, ``DNS Extensions to Support IPv6
Address Aggregation and Renumbering'', RFC2874, July 2000. Address Aggregation and Renumbering'', RFC2874, July 2000.
[OK] D. Conrad, ``Indicating Resolver Support of DNSSEC'', Work in [OK] D. Conrad, ``Indicating Resolver Support of DNSSEC'', Work in
progress, draft-ietf-dnsext-dnssec-okbit-xx.txt, November progress, draft-ietf-dnsext-dnssec-okbit-xx.txt, November
2000. 2000.
Author Address Author Address
Olafur Gudmundsson Olafur Gudmundsson
NAI Labs NAI Labs/Network Associates
Network Associates
3060 Washington Road (Rt. 97) 3060 Washington Road (Rt. 97)
Glenwood, MD 21738 Glenwood, MD 21738
USA USA
<ogud@tislabs.com> <ogud@tislabs.com>
Full Copyright Statement Full Copyright Statement
Copyright (C) The Internet Society (2001). All Rights Reserved. Copyright (C) The Internet Society (2001). All Rights Reserved.
This document and translations of it may be copied and furnished to This document and translations of it may be copied and furnished to
 End of changes. 

This html diff was produced by rfcdiff 1.23, available from http://www.levkowetz.com/ietf/tools/rfcdiff/