On Wed, Aug 20, 2008 at 04:06:05PM -0700, David Conrad wrote:
> - if the advertised EDNS0 buffer size is not large enough, it will
> trigger truncation and, as a result, an increase in the number of TCP
> sessions going to the root.
assumed that it's reasonable to focus on referrals and NXDOMAIN responses
only, we'd usually see a DS and RRSIG(DS) or an NSEC plus RRSIG(NSEC) for
the former and two NSECs plus two RRSIG(NSEC) for the latter.
As per RFC 3226 (or 4035, section 6), the resolver sending DO is expected
to support at least 1220 octet responses.
Hard data on the advertized sizes for both DO and "EDNS, but not DO" would
be helpful.
> - if the advertised EDNS0 buffer size is large enough, but the network
> MTU is too small, fragmentation will occur which may cause the
> response to be dropped (for a variety of reasons).
Since, as Mark has pointed out, EDNS is used in many queries today, resulting
in referral responses larger than 512, this problem should have been faced
even without DNSSEC (or DO inparticular) involved. Again, measurement data
showing the response size distributions for root name servers would be helpful.
> - if there are middle boxes in the way that do stupid things (e.g.,
> disallow DNS over TCP), those middle boxes will likely drop the larger
> responses.
Much of this has already been initiated by resolvers using EDNS (with sizes
> 512 octets) and either large referrals or RRs in priming responses.
The remaining risk is that DNSSEC responses would increase the size above
some critical value that doesn't regularily appear today.
> The concern I see (that I had hoped would be avoided by DO being set
> to 1 only when the caching server administrator had explicitly
> configured DNSSEC awareness) is that folks who are blissfully unaware
DO can only signal from the resolver to the server, but for responses to
reach the resolver, anything in the way must also leave "larger packets"
alone.
One other issue around DO is that it was introduced to signal "understanding"
of DNSSEC as per RFC 2535. The reaction of hypothetical 2535 only
resolvers to DNSSECbis responses is to be explored. I vaguely remember that
we've had this discussion of versioning the DO "bit".
-Peter
___
DNSOP mailing list
DNSOP@ietf.org
https://www.ietf.org/mailman/listinfo/dnsop
