RFC 2671
Extension Mechanisms for DNS (EDNS0)
Title Block 📜✨
Okay bestie, this one is RFC 2671: Extension Mechanisms for DNS (EDNS0) 🦋 It's a Standards Track doc from P. Vixie of ISC, dated August 1999, from the Network Working Group. It doesn't list any obsoletes or updates, so there's nothing it replaces or patches. 💅
Status of this Memo 🎀
This is an Internet standards track protocol for the Internet community, and the authors want discussion and suggestions for improvements. For the standardization state and status, check the current edition of "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🌸
Copyright Notice 💜
Copyright (C) The Internet Society (1999). All Rights Reserved.
Abstract ✨
DNS's wire protocol has a bunch of fixed fields whose range has been used up, or is about to be, and clients have no way to tell servers what they can do 😭 This doc describes backward compatible mechanisms so the protocol can grow 🌈
1 - Rationale and Scope 🧚
1.1.
okay so DNS (see [RFC1035]) defines a Message Format, and inside those messages there are standard ways to encode options, errors, and name compression 💖 The max size of a DNS Message is fixed, and a lot of DNS's limits are way too small for stuff people already use or want to use soon 💀 Implementations also have no way to advertise what they can do. Literally no way 🙈
1.2.
existing clients won't know how to read these extensions 😭 In practice they'll get upgraded once they need a new feature, and only the new features will use the extensions. BUT we still have to think about how clients act when they see extra fields, and design a fallback scheme so they can still interoperate with everyone 🫶
2 - Affected Protocol Elements 🍓
2.1.
the DNS Message Header (see [RFC1035 4.1.1]) has a second full 16-bit word split into a 4-bit OPCODE, a 4-bit RCODE, and a bunch of 1-bit flags 🔥 The original reserved Z bits got given jobs, and most of the RCODE values are taken now. We need more flags and more possible RCODEs, iykyk 👑
2.2.
the first two bits of a wire format domain label say what type the label is. [RFC1035 4.1.4] assigns two of the four possible types and reserves the other two. People have way more proposals for the remaining types than there are slots 😭 So we need more label types, period 💅
2.3.
DNS Messages are capped at 512 octets when they go over UDP. The minimum maximum reassembly buffer size still allows a 512-octet UDP payload, but most hosts on the Internet can reassemble bigger datagrams now 🌟 We need a mechanism so requestors can tell responders about larger buffer sizes they can handle 🦋
3 - Extended Label Types 🌸
3.1.
the 0 1 label type will now mean "this is an extended label type" 💖 Its actual value gets encoded in the lower six bits of the label's first octet. Every label type developed from here on should be encoded as an extended label type 🎀
3.2.
the 1 1 1 1 1 1 extended label type is reserved for future expansion of the extended label type code space. Save it for later, bestie 🧚
4 - OPT pseudo-RR 👑
4.1.
one OPT pseudo-RR can be added to the additional data section of either a request or a response. It's called a pseudo-RR because it's about a particular transport level message, not any real DNS data 🤓 OPT RRs shall never be cached, forwarded, or stored in or loaded from master files, no exceptions 🙅♀️ The number of OPT pseudo-RRs per message shall be zero or one, but never more than that 💅
4.2.
an OPT RR has a fixed part and a variable set of options written as {attribute, value} pairs ✨ The fixed part holds some DNS metadata plus a small collection of new protocol elements that are expected to be so popular that encoding them as {attribute, value} pairs would be a waste of wire space 🍓
4.3.
the fixed part of an OPT RR is structured like this 🎀
Field Name Field Type Description
------------------------------------------------------
NAME domain name empty (root domain)
TYPE u_int16_t OPT
CLASS u_int16_t sender's UDP payload size
TTL u_int32_t extended RCODE and flags
RDLEN u_int16_t describes RDATA
RDATA octet stream {attribute,value} pairs4.4.
the variable part of an OPT RR is encoded in its RDATA, and it's structured as zero or more of the following 🧚
+0 (MSB) +1 (LSB)
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
0: | OPTION-CODE |
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
2: | OPTION-LENGTH |
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
4: | |
/ OPTION-DATA /
/ /
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+here's what each piece means:
OPTION-CODE: assigned by IANA 🌈OPTION-LENGTH: size (in octets) ofOPTION-DATA📏OPTION-DATA: varies perOPTION-CODE💜
4.5.
the sender's UDP payload size (which OPT stores in the RR CLASS field) is the number of octets in the largest UDP payload that can be reassembled and delivered in the sender's network stack ✨ Heads up: the path MTU, with or without fragmentation, might be smaller than this, so don't get too confident 💀
4.5.1.
a 512-octet UDP payload needs a 576-octet IP reassembly buffer, so note that 🤓 Choosing 1280 on an Ethernet connected requestor would be reasonable 🌸 Choosing too large a value might get you an ICMP message from an intermediate gateway, or even a silent drop of the response message 😭
4.5.2.
both requestors and responders are advised to take the path's discovered MTU (if it's already known) into account when they consider message sizes 🫶
4.5.3.
the requestor's maximum payload size can change over time, so it should not be cached for use beyond the transaction in which it's advertised 🦋
4.5.4.
the responder's maximum payload size can change over time too, but it can reasonably be expected to stay constant between two sequential transactions. For example: a meaningless QUERY to discover a responder's maximum UDP payload size, followed immediately by an UPDATE that takes advantage of that size 🧚 (This is considered preferrable to the outright use of TCP for oversized requests, if there's any reason to suspect the responder implements EDNS, and if a request won't fit in the default 512 payload size limit 💅)
4.5.5.
due to transaction overhead, it's unwise to advertise an architectural limit as a maximum UDP payload size 🙈 Just because your stack can reassemble 64KB datagrams, don't assume you want to spend more than about 4KB of state memory per ongoing transaction 🍓
4.6.
the extended RCODE and flags (which OPT stores in the RR TTL field) are structured like this 👑
+0 (MSB) +1 (LSB)
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
0: | EXTENDED-RCODE | VERSION |
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
2: | Z |
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+the fields, explained:
EXTENDED-RCODEforms the upper 8 bits of the extended 12-bit RCODE. Note that anEXTENDED-RCODEvalue of "0" means an unextended RCODE is in use (values "0" through "15") 🔥VERSIONshows the implementation level of whoever sets it. Full conformance with this spec is shown by version "0" 💖 Requestors are encouraged to set this to the lowest implemented level that can still express a transaction, to cut down on the responder and network load of finding the greatest common implementation level between requestor and responder 🌸 Ideally, a requestor's version numbering strategy should be a run time configuration option 🎀
Now, if a responder doesn't implement the VERSION level of the request, it answers with RCODE=BADVERS 😭 All responses will be limited in format to the VERSION level of the request, but each response's VERSION will be the highest implementation level of the responder ✨ So a requestor learns the responder's implementation level as a side effect of every response, including error responses, including RCODE=BADVERS 🧚
Zgets set to zero by senders and ignored by receivers, unless a later specification modifies that 🌈
5 - Transport Considerations 🦋
5.1.
the presence of an OPT pseudo-RR in a request should be taken as a sign that the requestor fully implements the given version of EDNS, and can correctly understand any response that conforms to that feature's specification 💅
5.2.
a lack of use of these features in a request must be taken as a sign that the requestor doesn't implement any part of this specification, and that the responder may make no use of any protocol extension described here in its response 🙅♀️
5.3.
responders that don't understand these protocol extensions are expected to send a response with RCODE NOTIMPL, FORMERR, or SERVFAIL 🎀 So use of extensions should be "probed," so that a responder not known to support them can be allowed a retry with no extensions if it responds with one of those RCODEs 🫶 If a requestor caches a responder's capability level, a new probe should be sent periodically to test for changes to that capability 🌸
6 - Security Considerations 💀
Requestor-side specification of the maximum buffer size may open up a new DNS denial of service attack, if responders can be made to send messages that are too large for intermediate gateways to forward. That could lead to potential ICMP storms between gateways and responders 🚨😭🔥
7. IANA Considerations ✨
Okay bestie, IANA gets its own little to-do list here 📋💅
IANA already assigned RR type code 41 to OPT. 🎀 This doc and its working group also recommend that IANA set up three new registries: one for EDNS Extended Label Types, one for EDNS Option Codes, and one for EDNS Version Numbers. 🦋
Here's what this document asks IANA to record:
- Label type
0b01xxxxxxgets named "EDNS Extended Label Type." 🌸 - Extended label type
0bxx111111gets named "Reserved for future extended label types." 🧚 - Option code 65535 gets named "Reserved for future expansion." 💜
- The RCODE space grows from 4 bits to 12 bits 🔥. Right now [RFC1035] only lets you have 16 distinct RCODE values, so this opens up way more room for IANA to assign new ones. Iconic 👑
- EDNS Extended RCODE "16" gets named "BADVERS." 💀
Registry rules, because we need them: creating new entries in the EDNS Extended Label Type or EDNS Version Number registries should need IESG approval 🔒. Getting an EDNS Option Code is way more chill, since any published RFC (Informational, Experimental, or BCP) should be enough grounds for one 🌈.
8. Acknowledgements
Shoutout to the legends who helped make this spec happen 🫶: Paul Mockapetris, Mark Andrews, Robert Elz, Don Lewis, Bob Halley, Donald Eastlake, Rob Austein, Matt Crawford, Randy Bush, and Thomas Narten. Each of them was instrumental in creating and refining this specification, so they're absolutely main character energy ⭐✨.
9. References
[RFC1035] Mockapetris, P., "Domain Names - Implementation and Specification", STD 13, RFC 1035, November 1987. 📚
10. Author's Address
Here's where you can reach the author 💌:
Paul Vixie
Internet Software Consortium
950 Charter Street
Redwood City, CA 94063
Phone: +1 650 779 7001
EMail: vixie@isc.org11. Full Copyright Statement
The legal stuff is kinda important, so here it is word for word 🙈📜:
Copyright (C) The Internet Society (1999). All Rights Reserved.
This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
English.
The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.Acknowledgement
Funding for the RFC Editor function is currently provided by the Internet Society 💖🌸.
📦 where this page comes from
- ietf: rfc2671 1999-08
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms