RFC 3226

Network Working Group, Request for Comments 3226, published December 2001 by Olafur Gudmundsson 💖 It's a Standards Track doc, and it updates RFC 2535 and RFC 2874. It doesn't list anything it obsoletes.

Abstract ✨

okay so this doc says that any DNS entity claiming to support DNS Security Extensions or A6 records MUST support EDNS0 (Extension Mechanisms for DNS) 💅 this is needed bc these features make DNS messages way bigger. if EDNS0 isn't supported, you fall back to TCP, and that hurts query latency and DNS server load 😭 this doc updates RFC 2535 and RFC 2874 by adding new requirements 🎀

Status of this Memo

this is an Internet standards track protocol for the Internet community, and it's open for discussion and suggestions for improvements 🦋 for the current standardization state and status of this protocol, check the "Internet Official Protocol Standards" (STD 1). distribution of this memo is unlimited ✨

Copyright Notice

Copyright (C) The Internet Society (2001). All Rights Reserved. 🌈

1. Introduction 🧚

familiarity with the DNS [RFC1034, RFC1035], DNS Security Extensions [RFC2535], EDNS0 [RFC2671] and A6 [RFC2874] is helpful, bestie 💜

STD 13, RFC 1035 Section 2.3.4 says DNS messages over UDP need a data payload of 512 octets or less 🙈 most DNS software today won't accept bigger UDP datagrams. any answer over 512 octets gets a partial, sometimes useless reply with the Truncation Bit set, and the requester usually retries over TCP. server delivery of truncated responses varies a lot, and resolver handling does too, so truncation gets messy in extra ways 💀

compared to UDP, TCP is expensive for a simple transaction like DNS 😤 a TCP connection needs 5 packets for setup and tear down (not counting data packets), so that's at least 3 round trips on top of the one for the original UDP query. the DNS server also has to keep state for the connection during the transaction. many DNS servers answer thousands of queries per second, so making them use TCP causes serious overhead and delays 🔥

1.1. Requirements 📝

the key words "MUST", "REQUIRED", "SHOULD", "RECOMMENDED", and "MAY" in this document are to be interpreted as described in RFC 2119 🫶

2. Motivating factors 🍓

2.1. DNSSEC motivations 🔐

DNSSEC [RFC2535] secures DNS by adding a Public Key signature on each RR set 🔑 these signatures range from about 80 octets to 800 octets, but most are going to be somewhere between 80 and 200 octets. adding signatures to each or most RR sets in an answer really blows up the size of DNS answers from secure zones 💥

for performance reasons and to cut load on DNS servers, it's important that security aware servers and resolvers get all the data in the Answer and Authority sections in one query without truncation ✨ sending Additional Data in the same query helps when the server is authoritative for the data, and it cuts down round trips.

DNSSEC OK[OK] shows how a client can, using EDNS0, say it wants DNSSEC records 👑 the OK bit doesn't get rid of the need for large answers for DNSSEC capable clients, though 🙃

2.1.1. Message authentication or TSIG motivation 🔏

TSIG [RFC2845] allows light weight authentication of DNS messages, but it makes messages at least 70 octets bigger 📈 DNSSEC specifies computationally expensive message authentication with SIG(0), using a standard public key signature. only one TSIG or SIG(0) can be attached to each DNS answer, so the size increase from message authentication isn't huge, but it can still cause a truncation 😬

2.2. IPv6 Motivations 🌐

IPv6 addresses [RFC2874] are 128 bits and can be represented in the DNS by multiple A6 records, each made of a domain name and a bit field 🦋 the domain name points to an address prefix that may need extra A6 RRs in the answer. answers where the queried name has multiple A6 addresses can overflow a 512-octet UDP packet size 💀

2.3. Root server and TLD server motivations 👑

right now the number of root servers is capped at 13, because that's the most name servers and their address records that fit in one 512-octet answer for a SOA record 🥹 if root servers start advertising A6 or KEY records, the answer for the root NS records won't fit in one 512-octet DNS message, so you'd get a ton of TCP query connections to the root servers 😱 even if every client resolver queries its local name server for info, there are millions of those servers, and each name server has to periodically update its info about the high level servers.

for redundancy, latency and load balancing, some zones need lots of DNS servers 🌸 the root zone is used by the entire net, so it's important to have as many servers as possible. big TLDs (and plenty of high-visibility SLDs) often have enough servers that either A6 or KEY records would make the NS response overflow the 512 byte limit. these zones with tons of servers are often the exact ones that are critical to network operation and already take fairly high loads 🫠

2.4. UDP vs TCP for DNS messages 🎀

given all of this, it's essential that any implementation supporting DNSSEC and/or A6 can use DNS messages bigger than 512 octets 🙌

the original 512 restriction was there to lower the chance of fragmentation of DNS responses 🧩 a fragmented UDP message that loses one of its fragments makes the answer useless, so the query has to be retried. a TCP connection needs more round trips to set up, transfer data, and tear down, but only the lost data segments get retransmitted.

in the early days a bunch of IP implementations didn't handle fragmentation well, but all modern operating systems have fixed that, so sending fragmented messages is fine from that standpoint ✅ the open issue is how losses affect fragmented messages. if a connection has a high loss ratio, only TCP allows reliable transfer of DNS data, but most links have low loss ratios, so sending a fragmented UDP packet in one round trip beats setting up a TCP connection just to move a few thousand octets 🚀

2.5. EDNS0 and large UDP messages 📦

EDNS0 [RFC2671] lets clients declare the maximum size of UDP message they're willing to handle 💅 so if the expected answer is between 512 octets and the max size the client can accept, you can skip the extra overhead of a TCP connection 🥰

3. Protocol changes: ✨

this document updates RFC 2535 and RFC 2874 by adding new requirements 🔧

all RFC 2535 compliant servers and resolvers MUST support EDNS0 and advertise a message size of at least 1220 octets, but SHOULD advertise a message size of 4000 🌈 this value might be too low to get full answers for high level servers, so a successor of this document may require a larger value 👀

all RFC 2874 compliant servers and resolvers MUST support EDNS0 and advertise a message size of at least 1024 octets, but SHOULD advertise a message size of 2048 💖 the IPv6 datagrams should be 1024 octets, unless the MTU of the path is known. (this is smaller than the minimum IPv6 MTU, so there's room for some extension headers and/or encapsulation without going over the minimum MTU 🧁)

all RFC 2535 and RFC 2874 compliant entities MUST be able to handle fragmented IPv4 and IPv6 UDP packets 🧩

all hosts supporting both RFC 2535 and RFC 2874 MUST use the larger required value in EDNS0 advertisements 👑

4. Acknowledgments 🫶

Harald Alvestrand, Rob Austein, Randy Bush, David Conrad, Andreas Gustafsson, Jun-ichiro itojun Hagino, Bob Halley, Edward Lewis, Michael Patton and Kazu Yamamoto were instrumental in motivating and shaping this document 🥹💜

5. Security Considerations: 🚨

there are no additional security considerations other than those in RFC 2671. (go read RFC 2671 bc it's the one doing the heavy lifting here 🔒)

6. IANA Considerations: 🦋

None

7. References 📚

• [RFC1034] Mockapetris, P., "Domain Names - Concepts and Facilities", STD 13, RFC 1034, November 1987.
• [RFC1035] Mockapetris, P., "Domain Names - Implementation and Specification", STD 13, RFC 1035, November 1987.
• [RFC2535] Eastlake, D. "Domain Name System Security Extensions", RFC 2535, March 1999.
• [RFC2671] Vixie, P., "Extension Mechanisms for DNS (EDNS0)", RFC 2671, August 1999.
• [RFC2845] Vixie, P., Gudmundsson, O., Eastlake, D. and B. Wellington, "Secret Key Transaction Authentication for DNS (TSIG)", RFC 2845, May 2000.
• [RFC2874] Crawford, M. and C. Huitema, "DNS Extensions to Support IPv6 Address Aggregation and Renumbering", RFC 2874, July 2000.
• [RFC3225] Conrad, D., "Indicating Resolver Support of DNSSEC", RFC 3225, December 2001.

8. Author Address 🖊️

Olafur Gudmundsson 3826 Legation Street, NW Washington, DC 20015 USA

EMail: ogud@ogud.com

9. Full Copyright Statement ⚖️

Copyright (C) The Internet Society (2001). All Rights Reserved.

This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.

The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.

This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement 🌷

Funding for the RFC Editor function is currently provided by the Internet Society. ✨