alt Hacker News> The growing deployment of DNS Security (DNSSEC) and IPv6 has increased response sizes and therefore the use of TCP.
Yes, but doesn't IPv6 also increase the "maximum safe UDP packet size" from 512 bytes to 1280?
> Existing deployments of DNSSEC [RFC4033] have shown that truncation at the 512-byte boundary is now commonplace. For example, a Non-Existent Domain (NXDOMAIN) (RCODE == 3) response from a DNSSEC-signed zone using NextSECure 3 (NSEC3) [RFC5155] is almost invariably larger than 512 bytes.
This has been a flagged issue in DNSSEC since it was originally considered. This was a massive oversight on their part and was only added because DNSSEC originally made it quite easy to probe entire DNS trees and expose obscured RRs.
> The MTU most commonly found in the core of the Internet is around 1500 bytes, and even that limit is routinely exceeded by DNSSEC-signed responses.
> Stub resolver implementations (e.g., an operating system's DNS resolution library) MUST support TCP since to do otherwise would limit the interoperability between their own clients and upstream servers.
Fair enough but are network clients actually meant to use DNSSEC? Isn't this just an issue for authoritative and recursive DNSSEC resolvers to and down the roots?
Replies
Just to add real quick: there is not in fact a meaningful growing deployment of DNSSEC --- in fact, in North America and the western commercial Internet, the opposite thing is true: the number of signed zones has decreased. This is especially stark if you look at the true figure of merit, DNSSEC deployment on popular zones (take the Tranco academic research ranking of popular zones as a model):
> Fair enough but are network clients actually meant to use DNSSEC?
I dream of an alternate reality where DNSSEC and DANE had become more ubiquitous, and we didn't have need for CAs to sign TLS certificates[1]. But that requires DNSSEC (or some other cryptographic verification) on the client.
[1]: Or something like that. In that mythical world maybe DNSSEC was also better designed...
> Yes, but doesn't IPv6 also increase the "maximum safe UDP packet size" from 512 bytes to 1280?
Sure would be nice if people used IPv6. Even if you're actually sending data over IPv6, that doesn't mean the DNS lookups are going over IPv6. Infrastructure like that lags.
> This has been a flagged issue in DNSSEC since it was originally considered. This was a massive oversight on their part and was only added because DNSSEC originally made it quite easy to probe entire DNS trees and expose obscured RRs.
... probably because the people who originally designed DNSSEC (and DNS) couldn't believe that people would be crazy enough to try to keep their DNS records secret (or run split address spaces, for that matter). But anyway, whatever the reason, the replies are big and that has to be dealt with.
> Fair enough but are network clients actually meant to use DNSSEC?
You should be validating as close to the point of use as possible.
> Isn't this just an issue for authoritative and recursive DNSSEC resolvers to and down the roots?
If by "resolvers" you mean "local resolution-only servers", then that's common, but arguably bad, practice.
Anyway, using TCP also neuters DNS as a DoS amplifier, at least if you can make it universal enough to avoid downgrade attacks.
>> The growing deployment of DNS Security (DNSSEC) and IPv6 has increased response sizes and therefore the use of TCP. > Yes, but doesn't IPv6 also increase the "maximum safe UDP packet size" from 512 bytes to 1280?
DNS mostly has to support larger sizes, and has for decades for things like svc/txt records used for various encryption and large blocks of text. Having worked for a registrar and dealing with ddos, not much you can do but filter more intelligently. There are ddos appliances/services built just to deal with volumetric queries from hosts for such reason.