DNSEXT Working Group Olafur Gudmundsson (NAI Labs) INTERNET-DRAFT October 2000 Updates: RFC 2535, RFC 2874 DNSSEC and IPv6 A6 aware server/resolver message size requirements Status of this Memo This document is an Internet-Draft and is in full conformance with all provisions of Section 10 of RFC2026. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet- Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as ``work in progress.'' The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html Comments should be sent to the authors or the DNSEXT WG mailing list namedroppers@ops.ietf.org This draft expires on March 29, 2001. Copyright Notice Copyright (C) The Internet Society (2000). All rights reserved. Expires March 2001 [Page 1] INTERNET-DRAFT DNSSEC and IPng message size requirement October 2000 Abstract This document mandates support for EDNS0 in DNS entities claiming to support DNS Security Extensions and A6 records. This requirement is necessary because these new features increase the size of DNS messages. If EDNS0 is not supported fall back to TCP will happen, having a detrimental impact on query latency and DNS server load. 1 - Introduction Familiarity with the DNS[RFC1034, RFC1035], DNS Security Extensions[RFC2535], EDNS0[RFC2671] and A6[RFC2874] is helpful. RFC 1035[RFC1035] Section 2.3.4 requires that DNS messages over UDP have a data payload of 512 octets or less. Most DNS software today will not accept larger size UDP datagrams. Thus, any answer that requires more than 512 octets will result in a partial and probably useless reply with the Truncation Bit set; in most cases the requester will then retry using TCP. Some DNS servers send back an answer truncating the message at the last RR boundary before truncation, other servers truncate at the previous set, some send back empty answer with TC bit set. Compared to UDP, TCP is an expensive protocol to use for a simple transaction like DNS: a TCP connection requires 5 packets for setup and tear down, excluding data packets, thus requiring at least 3 round trips on top of the one for the original UDP query. The DNS server also needs to keep a state of the connection during this transaction. As many DNS servers answer thousands of queries per second, requiring them to use TCP will cause significant overhead and delays. 1.1 - DNSSEC motivations DNSSEC[RFC2535] secures DNS by adding a Public Key signature on each RR set. These signatures range in size from about 80 octets to 800 octets most are going to be in the range of 80..200 octets. The addition of these signatures on each or most RR sets in an answer will significantly increase the size of DNS answers from secure zones. It is important that security aware servers and resolvers get all the data in Answer and Authority section in one query without truncation. In some cases it is important that some Additional Data be sent Expires March 2001 [Page 2] INTERNET-DRAFT DNSSEC and IPng message size requirement October 2000 along, mainly in delegation cases. TSIG[RFC2845] allows for the light weight authentication of DNS messages, but increases the size of the messages by at least 70 octets. DNSSEC allows for computationally expensive message authentication with a standard public key signature. As only one TSIG or SIG(0) can be attached to each DNS answer the size increase of message authentication is not significant, but may still lead to a truncation. 1.2 - IPv6 Motivations IPv6 addresses[RFC2874] are 128 bits and are represented in the DNS by multiple A6 records, each consisting of a domain name and a bit field. The domain name refers to an address prefix that may require additional A6 RRs to be included in the answer. Answers where queried name has multiple A6 addresses may overflow a 512-octet UDP packet size. 1.3 Root server and TLD server motivations The current number of root servers is limited to 13 as that is the maximum number of name servers and their address records that fit in one 512-octet DNS message. If root servers start advertising A6 or KEY records then the root zone answer for NS records will not fit in an single 512-octet DNS message. Resulting in a large number of TCP connections to the root servers. It is important that a high level domains have a high number of domain name servers for redundancy, latency and load balancing reasons. 1.4 UDP vs TCP for DNS messages Given all these factors, it is essential that any implementations that supports DNSSEC and or A6 be able to use larger DNS messages than 512 octets. The original 512 restriction was put in place to avoid fragmentation of DNS responses. A fragmented UDP message that suffers a loss off one of the fragments renders the answer useless and DNS must retransmit the query. TCP connection requires number of round trips for establishment, data transfer and tear down, but only the lost data segments are retransmitted. Expires March 2001 [Page 3] INTERNET-DRAFT DNSSEC and IPng message size requirement October 2000 In the early days number of IP implementations did not handle fragmentation well, but all modern operating systems have overcome that issue thus sending fragmented messages is fine from that standpoint. The open issue is the effect of losses on fragmented messages. If connection has high loss ratio only TCP will allow reliable transfer of DNS data, most links have low loss ratios thus sending fragmented UDP packet in one round trip is better than establishing a TCP connection to transfer few thousand octets. 1.5 EDNS0 and large UDP messages EDNS0[RFC2671] allows clients to declare the maximum size of UDP message they are willing to handle. Thus, if the expected answer is between 512 octets and the maximum size that the client can accept, the additional overhead of a TCP connection can be avoided. 1.7 - Requirements The key words "MUST", "REQUIRED", "SHOULD", "RECOMMENDED", and "MAY" in this document are to be interpreted as described in RFC 2119. 2 - Protocol changes: This document updates [RFC2535] and [RFC2874], by adding new requirements. All RFC2535-compliant servers and resolvers MUST support EDNS0 and advertise message size of at least 1220 octets, but SHOULD advertise message size of 4000. This value might be too low to get full answers for high level servers and successor of this document may require a larger value. All RFC2874-compliant servers and resolver MUST support EDNS0 and advertise message size of at least 1024 octets, but SHOULD advertise message size of 2048. All RFC2535 and RFC2874 compliant entities MUST be able to handle fragmented IP and IPv6 UDP packets. All hosts supporting both RFC2535 and RFC2874 MUST use the larger required value in EDNS0 advertisements. Expires March 2001 [Page 4] INTERNET-DRAFT DNSSEC and IPng message size requirement October 2000 3 Acknowledgments Harald Alvestrand, Rob Austein, Randy Bush, David Conrad, Andreas Gustafsson, Bob Halley, Edward Lewis and Kazu Yamamoto where instrumental in motivating and shaping this document. 4 - Security Considerations: There are no additional security considerations other than those in RFC2671. 5 - IANA Considerations: None References: [RFC1034] P. Mockapetris, ``Domain Names - Concepts and Facilities'' STD 13, RFC 1034, November 1987. [RFC1035] P. Mockapetris, ``Domain Names - Implementation and Specification'', STD 13, RFC 1035, November 1987. [RFC2535] D. Eastlake, ``Domain Name System Security Extensions'', RFC 2535, March 1999. [RFC2671] P. Vixie, ``Extension Mechanisms for DNS (EDNS0)'', RFC 2671, August 1999. [RFC2845] P. Vixie, O. Gudmundsson, D. Eastlake, B. Wellington, ``Secret Key Transaction Authentication for DNS (TSIG)'', RFC 2845, May 2000. [RFC2874] M. Crawford, C. Huitema, S. Thompson, ``DNS Extensions to Support IPv6 Address Aggregation and Renumbering'', RFC2874, Sometime 2000. Expires March 2001 [Page 5] INTERNET-DRAFT DNSSEC and IPng message size requirement October 2000 Author Address Olafur Gudmundsson NAI Labs Network Associates 3060 Washington Road (Rt. 97) Glenwood, MD 21738 USA +1 443 259 2389 Full Copyright Statement Copyright (C) The Internet Society (2000). All Rights Reserved. This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English. The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns. This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." Expires March 2001 [Page 6]