RFC 1995
Incremental Zone Transfer in DNS
Incremental Zone Transfer in DNS 🦋
okay bestie, here's the paperwork vibe check ✨
- RFC: 1995
- Author: M. Ohta, Tokyo Institute of Technology 🌸
- Working group: Network Working Group
- Date: August 1996
- Category: Standards Track 👑
- Updates: 1035 🔥
Status of this Memo
This document specifies an Internet standards track protocol for the Internet community, and it asks for discussion and suggestions for improvements 🎀. For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1) 📚. Distribution of this memo is unlimited, so go wild 💅.
Abstract
This document proposes extensions to the DNS protocols to provide an incremental zone transfer (IXFR) mechanism 💖.
1. Introduction ✨
So, for changes to a DNS database [STD13] to spread fast, you have to cut down on latency by actively notifying servers about the change 🏃♀️. That's what the NOTIFY extension of the DNS [NOTIFY] does, bestie.
The current full zone transfer (AXFR) is kinda inefficient for sending changes to just a small piece of a zone, because it sends the entire zone file 💀.
Incremental transfer (IXFR) is the proposed upgrade, and it's way more efficient because it only sends the changed portion(s) of a zone 🧚.
In this doc, a secondary name server that asks for an IXFR is an IXFR client, and a primary or secondary name server that answers the request is an IXFR server 🎀.
2. Brief Description of the Protocol 💖
So an IXFR client (probably holding an older version of a zone) decides it needs fresh info, usually because its SOA refresh timeout went off or a NOTIFY came in 🔔. Then it sends an IXFR message carrying the SOA serial number of its copy of the zone, which is presumably outdated 🦋.
An IXFR server should keep track of the newest version of the zone, plus the differences between that copy and several older versions 📖. When an IXFR request with an older version number shows up, the server only needs to send the differences needed to bring that version up to date. Or, the server may choose to send the whole zone, just like a normal full zone transfer 💅.
When a zone gets updated, it should be saved to stable storage before the new version is used to answer IXFR (or AXFR) queries. Otherwise, if the server crashes, data that's gone might already have been handed out to secondary servers, and that can cause persistent database inconsistencies 😭.
If an IXFR query comes in with the same or a newer version number than the server's, the server replies with a single SOA record of its current version, just like in AXFR 🌸.
A query can travel over either UDP or TCP 🛰️. If the IXFR query came in over UDP, the server may try to reply over UDP if the whole response fits in a single DNS packet. If the UDP reply won't fit, the server responds with a single SOA record of its current version to let the client know it should start a TCP query 🧚.
So, a client should start by sending an IXFR query over UDP 🚀. If the server doesn't recognize the query type, an AXFR (preceded by a UDP SOA query) should be tried, which keeps things backward compatible 🫶. If the response is a single packet with the entire new zone, or the server doesn't have a newer version than the client, you're all done 🎉. Otherwise, a TCP IXFR query should be tried 👑.
To keep things intact, servers should use UDP checksums for all UDP responses 🔒. A cautious client that gets a UDP packet with a checksum value of 0 should ignore the result and try a TCP IXFR instead 🔥.
The query type value of IXFR assigned by IANA is 251 🍓.
3. Query Format 🧚
An IXFR query packet looks exactly like a normal DNS query, except the query type is IXFR and the authority section holds the SOA record of the client's version of the zone 💜.
7. Example ✨
Okay bestie, let's walk through a full example 🎀 Say we have three generations of the zone data, and the current serial number is 3:
JAIN.AD.JP. IN SOA NS.JAIN.AD.JP. mohta.jain.ad.jp. (
1 600 600 3600000 604800)
IN NS NS.JAIN.AD.JP.
NS.JAIN.AD.JP. IN A 133.69.136.1
NEZU.JAIN.AD.JP. IN A 133.69.136.5Then NEZU.JAIN.AD.JP. gets removed and JAIN-BB.JAIN.AD.JP. gets added 💅
jain.ad.jp. IN SOA ns.jain.ad.jp. mohta.jain.ad.jp. (
2 600 600 3600000 604800)
IN NS NS.JAIN.AD.JP.
NS.JAIN.AD.JP. IN A 133.69.136.1
JAIN-BB.JAIN.AD.JP. IN A 133.69.136.4
IN A 192.41.197.2Next, one of the IP addresses of JAIN-BB.JAIN.AD.JP. gets changed 🥺
JAIN.AD.JP. IN SOA ns.jain.ad.jp. mohta.jain.ad.jp. (
3 600 600 3600000 604800)
IN NS NS.JAIN.AD.JP.
NS.JAIN.AD.JP. IN A 133.69.136.1
JAIN-BB.JAIN.AD.JP. IN A 133.69.136.3
IN A 192.41.197.2So now the following IXFR query shows up 👀
+---------------------------------------------------+
Header | OPCODE=SQUERY |
+---------------------------------------------------+
Question | QNAME=JAIN.AD.JP., QCLASS=IN, QTYPE=IXFR |
+---------------------------------------------------+
Answer | <empty> |
+---------------------------------------------------+
Authority | JAIN.AD.JP. IN SOA serial=1 |
+---------------------------------------------------+
Additional | <empty> |
+---------------------------------------------------+and it could get answered with the following full zone transfer message 🎁
+---------------------------------------------------+
Header | OPCODE=SQUERY, RESPONSE |
+---------------------------------------------------+
Question | QNAME=JAIN.AD.JP., QCLASS=IN, QTYPE=IXFR |
+---------------------------------------------------+
Answer | JAIN.AD.JP. IN SOA serial=3 |
| JAIN.AD.JP. IN NS NS.JAIN.AD.JP. |
| NS.JAIN.AD.JP. IN A 133.69.136.1 |
| JAIN-BB.JAIN.AD.JP. IN A 133.69.136.3 |
| JAIN-BB.JAIN.AD.JP. IN A 192.41.197.2 |
| JAIN.AD.JP. IN SOA serial=3 |
+---------------------------------------------------+
Authority | <empty> |
+---------------------------------------------------+
Additional | <empty> |
+---------------------------------------------------+or with this incremental message, which is giving full history vibes 📜
+---------------------------------------------------+
Header | OPCODE=SQUERY, RESPONSE |
+---------------------------------------------------+
Question | QNAME=JAIN.AD.JP., QCLASS=IN, QTYPE=IXFR |
+---------------------------------------------------+
Answer | JAIN.AD.JP. IN SOA serial=3 |
| JAIN.AD.JP. IN SOA serial=1 |
| NEZU.JAIN.AD.JP. IN A 133.69.136.5 |
| JAIN.AD.JP. IN SOA serial=2 |
| JAIN-BB.JAIN.AD.JP. IN A 133.69.136.4 |
| JAIN-BB.JAIN.AD.JP. IN A 192.41.197.2 |
| JAIN.AD.JP. IN SOA serial=2 |
| JAIN-BB.JAIN.AD.JP. IN A 133.69.136.4 |
| JAIN.AD.JP. IN SOA serial=3 |
| JAIN-BB.JAIN.AD.JP. IN A 133.69.136.3 |
| JAIN.AD.JP. IN SOA serial=3 |
+---------------------------------------------------+
Authority | <empty> |
+---------------------------------------------------+
Additional | <empty> |
+---------------------------------------------------+or with this condensed incremental message, which is the slimmed-down version 🦋
+---------------------------------------------------+
Header | OPCODE=SQUERY, RESPONSE |
+---------------------------------------------------+
Question | QNAME=JAIN.AD.JP., QCLASS=IN, QTYPE=IXFR |
+---------------------------------------------------+
Answer | JAIN.AD.JP. IN SOA serial=3 |
| JAIN.AD.JP. IN SOA serial=1 |
| NEZU.JAIN.AD.JP. IN A 133.69.136.5 |
| JAIN.AD.JP. IN SOA serial=3 |
| JAIN-BB.JAIN.AD.JP. IN A 133.69.136.3 |
| JAIN-BB.JAIN.AD.JP. IN A 192.41.197.2 |
| JAIN.AD.JP. IN SOA serial=3 |
+---------------------------------------------------+
Authority | <empty> |
+---------------------------------------------------+
Additional | <empty> |
+---------------------------------------------------+or, if a UDP packet overflow happens, it falls back to this one 🥹
+---------------------------------------------------+
Header | OPCODE=SQUERY, RESPONSE |
+---------------------------------------------------+
Question | QNAME=JAIN.AD.JP., QCLASS=IN, QTYPE=IXFR |
+---------------------------------------------------+
Answer | JAIN.AD.JP. IN SOA serial=3 |
+---------------------------------------------------+
Authority | <empty> |
+---------------------------------------------------+
Additional | <empty> |
+---------------------------------------------------+8. Acknowledgements 🫶
The original idea of IXFR came from Anant Kumar, Steve Hotz and Jon Postel. Iconic founders 👑
A whole crowd helped refine the protocol and its docs, including but not limited to Anant Kumar, Robert Austein, Paul Vixie, Randy Bush, Mark Andrews, Robert Elz and the members of the IETF DNSIND working group. Thank you all 💜
9. References 📚
[NOTIFY] Vixie, P., "DNS NOTIFY: A Mechanism for Prompt Notification of Zone Changes", RFC 1996, August 1996.
[STD13] Mockapetris, P., "Domain Name System", STD 13, RFC 1034 and RFC 1035), November 1987.
10. Security Considerations 💀
Okay, real talk. DNS comes with several security problems 😭 and this document does not try to fix them.
This document is believed to introduce no additional security problems to the current DNS protocol. Phew 🛡️
11. Author's Address 🦋
Masataka Ohta
Computer Center
Tokyo Institute of Technology
2-12-1, O-okayama, Meguro-ku, Tokyo 152, JAPAN
Phone: +81-3-5734-3299
Fax: +81-3-5734-3415
EMail: mohta@necom830.hpcl.titech.ac.jp📦 where this page comes from
- ietf: rfc1995 1996-08
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms