RFC 5855
Nameservers for IPv4 and IPv6 Reverse Zones
RFC 5855: Nameservers for IPv4 and IPv6 Reverse Zones 🦋
okay bestie, so this is RFC 5855, and it's a Best Current Practice (that's BCP 155 if you wanna be fancy 💅). It came out in May 2010, written by J. Abley and T. Manderson from ICANN. It's published under ISSN 2070-1721. The title block doesn't list anything it obsoletes or updates, so it's standing on its own ✨
Abstract
this doc sets up a stable naming scheme for the nameservers that run the IN-ADDR.ARPA and IP6.ARPA zones in the DNS 🌸 those zones hold the data that makes reverse mapping work (address to name), which is basically the "what name goes with this address?" lookup 🔍
Status of This Memo
this is an Internet Best Current Practice 🎀
it's a product of the Internet Engineering Task Force (IETF), it reflects what the IETF community agrees on, it got public review, and the Internet Engineering Steering Group (IESG) approved it for publication 🫶 if you want more on BCPs, check out Section 2 of RFC 5741. info, errata, and feedback for this doc live at http://www.rfc-editor.org/info/rfc5855 💜
Copyright Notice
Copyright (c) 2010 IETF Trust and the persons identified as the document authors. All rights reserved. 🔒
this doc is covered by BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stood when it was published. read those carefully bc they spell out your rights and restrictions 🧐 and if you pull code components out of this doc, they need the Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, same as that license says 💅
Table of Contents 🍓
1. Introduction ....................................................2
2. Nameservers for IN-ADDR.ARPA ....................................3
3. Nameservers for IP6.ARPA ........................................3
4. IAB Statement ...................................................4
5. IANA Considerations .............................................4
6. Security Considerations .........................................4
7. References ......................................................4
7.1. Normative References .......................................4
7.2. Informative References .....................................5
Appendix A. Existing NS RRSets ....................................6
Appendix B. Performance Characteristics ...........................7
B.1. Label Compression ..........................................7
B.2. Query Patterns .............................................9
B.2.1. QNAME under IN-ADDR.ARPA ..............................10
B.2.2. QNAME under IP6.ARPA ..................................101. Introduction ✨
okay so the Domain Name System (DNS) is described in [RFC1034] and [RFC1035] 📖 right now it does keyed data retrieval across three namespaces: domain names, IPv4 addresses, and IPv6 addresses 🧚 IPv4-to-name mapping is done with data published in the IN-ADDR.ARPA zone, and for IPv6 it's the IP6.ARPA zone (see [RFC3596]) 💖 turning an address into a name is called a "reverse lookup", and the two zones are said to support the "reverse DNS" 🌈
hosting IN-ADDR.ARPA and IP6.ARPA securely and stably is super critical for the Internet 😭 so many apps depend on quick reverse lookups just to work normally 💀
fyi, when this was written, IN-ADDR.ARPA was served by a subset of the DNS root servers, and IP6.ARPA was run by APNIC, ARIN, ICANN, LACNIC, and the RIPE NCC (see Appendix A) 🦋
this doc sets up a dedicated, stable set of nameserver names for each of IN-ADDR.ARPA and IP6.ARPA 🎀
the scheme here lets IN-ADDR.ARPA and IP6.ARPA be delegated to two different sets of nameservers, so the infrastructure for each zone can be run separately 🫶 that separation could help make sure that if the IN-ADDR.ARPA servers go down, IPv6 reverse lookups don't get dragged down with them as collateral damage, for example 🙈
who runs each individual nameserver is out of scope for this doc. it's an IANA function under Section 4 of the Memorandum of Understanding (MoU) between the IETF and ICANN [RFC2860] 👑
2. Nameservers for IN-ADDR.ARPA 🌸
this doc specifies the following naming scheme for the servers that host the IN-ADDR.ARPA zone:
A.IN-ADDR-SERVERS.ARPA
B.IN-ADDR-SERVERS.ARPA
C.IN-ADDR-SERVERS.ARPA
D.IN-ADDR-SERVERS.ARPA
E.IN-ADDR-SERVERS.ARPA
F.IN-ADDR-SERVERS.ARPA
...the IN-ADDR-SERVERS.ARPA zone is delegated to the same set of servers as IN-ADDR.ARPA. IPv4 and IPv6 glue records for each of those servers have been added to the ARPA zone 🧚
IN-ADDR-SERVERS.ARPA and IN-ADDR.ARPA share the same servers because they're both dedicated to one single purpose, so they can reasonably share fate 💅
all the servers in the set live under the same domain so label compression works 🎀 and since glue for every server exists in the ARPA zone, using one domain doesn't create a practical single point of failure 🌈
3. Nameservers for IP6.ARPA 💜
this doc specifies the following nameserver set for the IP6.ARPA zone:
A.IP6-SERVERS.ARPA
B.IP6-SERVERS.ARPA
C.IP6-SERVERS.ARPA
D.IP6-SERVERS.ARPA
E.IP6-SERVERS.ARPA
F.IP6-SERVERS.ARPA
...the IP6-SERVERS.ARPA zone is delegated to the same set of servers as IP6.ARPA. IPv4 and IPv6 glue records for each of those servers have been added to the ARPA zone 🔥
4. IAB Statement 👑
so the IAB is the body that gives technical guidance to ICANN for running the ARPA top-level domain, as described in [RFC3172] 🧠 they looked at this proposal and they're on board with it as an operational change that fits how ICANN and the IAB each do their jobs 🫶
5. IANA Considerations 🌈
with the IAB's approval in mind (see Section 4), IANA has delegated:
- IN-ADDR-SERVERS.ARPA to the nameservers listed in Section 2;
- IP6-SERVERS.ARPA to the nameservers listed in Section 3.
IANA also installed IPv4 and IPv6 glue records for the nameservers involved in the ARPA zone 🎀
choosing the operators for all of these nameservers is out of scope for this doc, and it's an IANA function under Section 4 of the MoU between the IETF and ICANN [RFC2860] 💖
B.1. Label Compression 🎀
Okay so, the names we pick for the NS RRSets of IN-ADDR.ARPA and IP6.ARPA don't matter that much for delegation response sizes from the parent zones, since stuff like DNSSEC is way bigger. Still, it's good practice to use a naming scheme that compresses well 💅. These are super frequently queried zones, so that can make at least a measurable difference to aggregate DNS traffic across the whole Internet, and it can help clients whose queries won't get secure replies too 🫶.
The naming schemes in Sections 2 and 3 compress really well 🦋. Once one nameserver name has been encoded in a DNS message, the rest can be specified with a way smaller encoding. It's giving efficiency. ✨
Here's how the math goes. A complete encoding of one a-label is a one-byte length field plus one byte per character of the a-label itself. A domain name is one or more of those encoded a-labels, followed by a single zero byte to terminate it. If a terminating run of a-labels has already been encoded like that, any later terminating reference to the same run can just be a two-byte pointer to that first full encoding 🧚.
The uncompressed version of A.IN-ADDR-SERVERS.ARPA comes out to (1 + 1) + (15 + 1) + (4 + 1) + 1 = 24 bytes 😭.
The uncompressed version of A.IP6-SERVERS.ARPA comes out to (1 + 1) + (10 + 1) + (4 + 1) + 1 = 19 bytes 🌸.
Any later nameserver under either domain is just its initial label plus a two-byte pointer back to the repeated domain somewhere else in the message, so (1 + 1) + 2 = 4 bytes. Lowkey genius 👑.
Here's the encoded size of the a-labels in a twelve-record NS RRSet for IN-ADDR.ARPA, named according to Section 2:
+------------------------+---------------------------------------+
| Nameserver | Encoded Size |
+------------------------+---------------------------------------+
| A.IN-ADDR-SERVERS.ARPA | (1 + 1) + (15 + 1) + (4 + 1) + 1 = 24 |
| | |
| B.IN-ADDR-SERVERS.ARPA | (1 + 1) + 2 = 4 |
| | |
| C.IN-ADDR-SERVERS.ARPA | (1 + 1) + 2 = 4 |
| | |
| D.IN-ADDR-SERVERS.ARPA | (1 + 1) + 2 = 4 |
| | |
| E.IN-ADDR-SERVERS.ARPA | (1 + 1) + 2 = 4 |
| | |
| F.IN-ADDR-SERVERS.ARPA | (1 + 1) + 2 = 4 |
| | |
| G.IN-ADDR-SERVERS.ARPA | (1 + 1) + 2 = 4 |
| | |
| H.IN-ADDR-SERVERS.ARPA | (1 + 1) + 2 = 4 |
| | |
| I.IN-ADDR-SERVERS.ARPA | (1 + 1) + 2 = 4 |
| | |
| J.IN-ADDR-SERVERS.ARPA | (1 + 1) + 2 = 4 |
| | |
| K.IN-ADDR-SERVERS.ARPA | (1 + 1) + 2 = 4 |
| | |
| L.IN-ADDR-SERVERS.ARPA | (1 + 1) + 2 = 4 |
| | |
| Total | 68 bytes |
+------------------------+---------------------------------------+And here's the same thing for a six-record NS RRSet for IP6.ARPA, named according to Section 3, so it's a bit smaller overall ✨:
+--------------------+---------------------------------------+
| Nameserver | Encoded Size |
+--------------------+---------------------------------------+
| A.IP6-SERVERS.ARPA | (1 + 1) + (10 + 1) + (4 + 1) + 1 = 19 |
| | |
| B.IP6-SERVERS.ARPA | (1 + 1) + 2 = 4 |
| | |
| C.IP6-SERVERS.ARPA | (1 + 1) + 2 = 4 |
| | |
| D.IP6-SERVERS.ARPA | (1 + 1) + 2 = 4 |
| | |
| E.IP6-SERVERS.ARPA | (1 + 1) + 2 = 4 |
| | |
| F.IP6-SERVERS.ARPA | (1 + 1) + 2 = 4 |
| | |
| Total | 39 bytes |
+--------------------+---------------------------------------+For comparison, here's the encoded size of the labels in the IP6.ARPA NS RRSet from Appendix A, which is the one that isn't built with this scheme 🙈:
+-----------------+--------------------------------------+
| Nameserver | Encoded Size |
+-----------------+--------------------------------------+
| NS-SEC.RIPE.NET | (6 + 1) + (4 + 1) + (3 + 1) + 1 = 17 |
| | |
| SEC1.APNIC.NET | (4 + 1) + (5 + 1) + 2 + 1 = 14 |
| | |
| NS2.LANIC.NET | (3 + 1) + (6 + 1) + 2 + 1 = 14 |
| | |
| NS.ICANN.ORG | (2 + 1) + (5 + 1) + (3 + 1) + 1 = 14 |
| | |
| TINNIE.ARIN.NET | (6 + 1) + (4 + 1) + 2 + 1 = 15 |
| | |
| Total | 74 bytes |
+-----------------+--------------------------------------+B.2. Query Patterns 👀
Here's a quick rundown of the query patterns you'd probably see with an empty cache, using both the existing and the new NS RRSets 🌈.
B.2.1. QNAME under IN-ADDR.ARPA
Let's start with the existing IN-ADDR.ARPA NS RRSet from Appendix A, and a QNAME that's delegated underneath the IN-ADDR.ARPA zone 💜:
- The query goes to a root server that's also authoritative for IN-ADDR.ARPA, and the response is a referral from the IN-ADDR.ARPA zone.
If the first query goes to the J root server instead, it looks like this:
- The query goes to J.ROOT-SERVERS.NET, which isn't authoritative for the IN-ADDR.ARPA zone. The response is a referral to an ARPA server, with glue in the additional section.
- The query goes to an ARPA server (all of them are also authoritative for IN-ADDR.ARPA in this case). The response is a referral from the IN-ADDR.ARPA zone.
Now the same query, but using the IN-ADDR.ARPA NS RRSet from Section 2 🦋:
- The query goes to a root server that's also authoritative for ARPA, and the response is a referral to an IN-ADDR.ARPA server, with glue in the additional section.
- The query goes to an IN-ADDR.ARPA server, and the response is a referral from the IN-ADDR.ARPA zone.
And if the first query goes to the J root server in this version:
- The query goes to J.ROOT-SERVERS.NET, which isn't authoritative for ARPA. The response is a referral to an ARPA server, with glue in the additional section.
- The query goes to an ARPA server, and the response is a referral to an IN-ADDR.ARPA server, with glue in the additional section.
- The query goes to an IN-ADDR.ARPA server, and the response is a referral from the IN-ADDR.ARPA zone.
B.2.2. QNAME under IP6.ARPA
Next up, the existing IP6.ARPA NS RRSet from Appendix A, with a QNAME delegated beneath the IP6.ARPA zone 🧚:
- The query goes to a root server that's also authoritative for ARPA, and the response is a referral from the ARPA zone to an IP6.ARPA server with no glue in the additional section.
- A recursive lookup for one of the nameservers in that referral now has to happen, so we can get an address for an IP6.ARPA server. In every case, three queries are required. Successive recursive lookups may be performed if a server is unresponsive 😭.
- The query goes to an IP6.ARPA server, and the response is a referral from the IP6.ARPA zone.
If the first query goes to the J root server:
- The query goes to J.ROOT-SERVERS.NET, and the response is a referral to an ARPA server with glue in the additional section.
- The query goes to an ARPA server, and the response is a referral from the ARPA zone to an IP6.ARPA server with no glue in the additional section.
- A recursive lookup for one of the nameservers in that referral now has to happen, to get an address for an IP6.ARPA server. In every case, three queries are required. Successive recursive lookups may be performed if a server is unresponsive.
- The query goes to an IP6.ARPA server, and the response is a referral from the IP6.ARPA zone.
Now the same query using the IP6.ARPA NS RRSet from Section 3 🌸:
- The query goes to a root server that's also authoritative for ARPA, and the response is a referral to an IP6.ARPA server, with glue in the additional section.
- The query goes to an IP6.ARPA server, and the response is a referral from the IP6.ARPA zone.
And if the first query goes to the J root server in this version:
- The query goes to J.ROOT-SERVERS.NET, which isn't authoritative for ARPA. The response is a referral to an ARPA server, with glue in the additional section.
- The query goes to an ARPA server, and the response is a referral to an IP6.ARPA server with glue in the additional section.
- The query goes to an IP6.ARPA server, and the response is a referral from the IP6.ARPA zone.
Authors' Addresses ✨
Meet the authors, bestie 🫶:
Joe Abley
ICANN
4676 Admiralty Way, Suite 330
Marina del Rey, CA 90292
USA
Phone: +1 310 463 9062
EMail: joe.abley@icann.org
Terry Manderson
ICANN
4676 Admiralty Way, Suite 330
Marina del Rey, CA 90292
USA
Phone: +61 4 1127 5673
EMail: terry.manderson@icann.org📦 where this page comes from
- ietf: rfc5855 2010-05
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms