RFC 9210
DNS Transport over TCP - Operational Requirements
RFC 9210 · DNS Transport over TCP - Operational Requirements 🎀
- Authors: J. Kristoff (Dataplane.org) and D. Wessels (Verisign) 💖
- Category: Best Current Practice (BCP 235) 👑
- Date: March 2022 🌸
- Updates: 1123, 1536 🦋
- ISSN: 2070-1721
Abstract ✨
okay so this doc updates RFCs 1123 and 1536 🫶 and it basically says that letting DNS messages travel over TCP on the Internet is a Best Current Practice, not a "maybe if we feel like it" thing 💅 this lines up with the implementation requirements in RFC 7766. TCP can carry DNS over plain unencrypted TCP and over an encrypted TLS session 🔐 the doc also looks at what goes wrong when this Best Current Practice doesn't get upheld, which is giving "why is nothing working" energy 😭
Status of This Memo 🍓
This memo documents an Internet Best Current Practice.
This document is a product of the Internet Engineering Task Force (IETF) 🧚 it represents the consensus of the IETF community, it got public review, and the Internet Engineering Steering Group (IESG) approved it for publication ✅ if you want more info on BCPs, check out Section 2 of RFC 7841 📚
For the current status, any errata, and how to send feedback, head to https://www.rfc-editor.org/info/rfc9210 🔗
Copyright Notice 🌈
Copyright (c) 2022 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they stand on the date of publication 📜 please actually read these, because they spell out your rights and restrictions for this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions, and they're provided without warranty as described in the Revised BSD License ⚠️
Table of Contents 🧚
1. Introduction
1.1. Requirements Language
2. History of DNS over TCP
2.1. Uneven Transport Usage and Preference
2.2. Waiting for Large Messages and Reliability
2.3. EDNS(0)
2.4. Fragmentation and Truncation
2.5. "Only Zone Transfers Use TCP"
2.6. Reuse, Pipelining, and Out-of-Order Processing
3. DNS-over-TCP Requirements
4. Network and System Considerations
4.1. Connection Establishment and Admission
4.2. Connection Management
4.3. Connection Termination
4.4. DNS over TLS
4.5. Defaults and Recommended Limits
5. DNS-over-TCP Filtering Risks
5.1. Truncation, Retries, and Timeouts
5.2. DNS Root Zone KSK Rollover
6. Logging and Monitoring
7. IANA Considerations
8. Security Considerations
9. Privacy Considerations
10. References
10.1. Normative References
10.2. Informative References
Appendix A. RFCs Related to DNS Transport over TCP
A.1. RFC 1035 - DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION
A.2. RFC 1536 - Common DNS Implementation Errors and Suggested
Fixes
A.3. RFC 1995 - Incremental Zone Transfer in DNS
A.4. RFC 1996 - A Mechanism for Prompt Notification of Zone
Changes (DNS NOTIFY)
A.5. RFC 2181 - Clarifications to the DNS Specification
A.6. RFC 2694 - DNS extensions to Network Address Translators
(DNS_ALG)
A.7. RFC 3225 - Indicating Resolver Support of DNSSEC
A.8. RFC 3226 - DNSSEC and IPv6 A6 aware server/resolver message
size requirements
A.9. RFC 4472 - Operational Considerations and Issues with IPv6
DNS
A.10. RFC 5452 - Measures for Making DNS More Resilient against
Forged Answers
A.11. RFC 5507 - Design Choices When Expanding the DNS
A.12. RFC 5625 - DNS Proxy Implementation Guidelines
A.13. RFC 5936 - DNS Zone Transfer Protocol (AXFR)
A.14. RFC 7534 - AS112 Nameserver Operations
A.15. RFC 6762 - Multicast DNS
A.16. RFC 6891 - Extension Mechanisms for DNS (EDNS(0))
A.17. IAB RFC 6950 - Architectural Considerations on Application
Features in the DNS
A.18. RFC 7477 - Child-to-Parent Synchronization in DNS
A.19. RFC 7720 - DNS Root Name Service Protocol and Deployment
Requirements
A.20. RFC 7766 - DNS Transport over TCP - Implementation
Requirements
A.21. RFC 7828 - The edns-tcp-keepalive EDNS(0) Option
A.22. RFC 7858 - Specification for DNS over Transport Layer
Security (TLS)
A.23. RFC 7873 - Domain Name System (DNS) Cookies
A.24. RFC 7901 - CHAIN Query Requests in DNS
A.25. RFC 8027 - DNSSEC Roadblock Avoidance
A.26. RFC 8094 - DNS over Datagram Transport Layer Security
(DTLS)
A.27. RFC 8162 - Using Secure DNS to Associate Certificates with
Domain Names for S/MIME
A.28. RFC 8324 - DNS Privacy, Authorization, Special Uses,
Encoding, Characters, Matching, and Root Structure: Time for
Another Look?
A.29. RFC 8467 - Padding Policies for Extension Mechanisms for
DNS (EDNS(0))
A.30. RFC 8482 - Providing Minimal-Sized Responses to DNS Queries
That Have QTYPE=ANY
A.31. RFC 8483 - Yeti DNS Testbed
A.32. RFC 8484 - DNS Queries over HTTPS (DoH)
A.33. RFC 8490 - DNS Stateful Operations
A.34. RFC 8501 - Reverse DNS in IPv6 for Internet Service
Providers
A.35. RFC 8806 - Running a Root Server Local to a Resolver
A.36. RFC 8906 - A Common Operational Problem in DNS Servers:
Failure to Communicate
A.37. RFC 8932 - Recommendations for DNS Privacy Service
Operators
A.38. RFC 8945 - Secret Key Transaction Authentication for DNS
(TSIG)
Acknowledgments
Authors' Addresses1. Introduction ✨
okay bestie, DNS messages get delivered over UDP or TCP 🦋 most DNS stuff goes over UDP, but some operators got the vibe that any DNS-over-TCP traffic is unwanted or unnecessary 🙃 and when DNS over TCP gets restricted, you get a bunch of random communication failures and debugging nightmares 😭 as DNS and its new naming system features have glowed up, TCP has become a huge deal for DNS working correctly and safely on the Internet 💜 the DNS standards now say that TCP support is a required part of DNS implementations [RFC7766], so this doc is basically the formal-requirements version for the ops crowd 📋 it's here to hype up sysadmins, network engineers, and security folks to make sure DNS-over-TCP support is on par with DNS-over-UDP 🫶
it also updates [RFC1123], Section 6.1.3.2 to make it crystal clear that all DNS resolvers and recursive servers MUST support and service both TCP and UDP queries 🔥 and it updates [RFC1536] to kill the myth that TCP is only good for zone transfers 💀
1.1. Requirements Language
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. 🎀 (translation: the caps lock words are the real rules, lowercase is just vibes 💅)
2. History of DNS over TCP 🕰️
ngl the history here is kind of messy 🙈 the mixed-up state between operational best practices and DNS transport guidance comes from conflicting messages that operators got from other operators, implementers, and even the IETF 🌀 sometimes those signals were explicit, and sometimes they were implicit 🌸 this section is one take on the twisty history that led to this document, and it's included for informational purposes only ✨
2.1. Uneven Transport Usage and Preference
in the original DNS specs, [RFC1034] and [RFC1035] clearly say DNS messages can ride on either UDP or TCP, but they also say UDP is preferred as the best transport for queries in the general case 💖 as [RFC1035] puts it:
While virtual circuits can be used for any DNS activity, datagrams are preferred for queries due to their lower overhead and better performance.
another early and super influential doc, [RFC1123], spells out the preference more directly:
DNS resolvers and recursive servers MUST support UDP, and SHOULD support TCP, for sending (non-zone-transfer) queries.
and it goes on to say:
A name server MAY limit the resources it devotes to TCP queries, but it SHOULD NOT refuse to service a TCP query just because it would have succeeded with UDP.
then came [RFC1536], and DNS over TCP ended up being mostly linked to zone transfers 🥹 while most queries and responses were treated as UDP territory 💜
2.2. Waiting for Large Messages and Reliability
in the original specs, the max DNS-over-UDP message size was locked at 512 bytes 📏 but even while [RFC1123] favored UDP for non-zone-transfer queries, it saw coming that DNS over TCP would get more popular later to get around that limit 🔮
[...] it is also clear that some new DNS record types defined in the future will contain information exceeding the 512 byte limit that applies to UDP, and hence will require TCP.
at least two big, widely expected developments were about to make DNS-over-TCP transactions way more necessary 🚀 the first was dynamic updates, defined in [RFC2136], and the second was the bundle of extensions called "DNSSEC", whose operational considerations were first given in [RFC2541] (fun fact: [RFC2541] has since been obsoleted by [RFC6781] 📝). the first one suggests that
...requestors who require an accurate response code must use TCP.
while the second one warns that
... larger keys increase the size of the KEY and SIG RRs. This increases the chance of DNS UDP packet overflow and the possible necessity for using higher overhead TCP in responses.
but plot twist 🙃 DNS over TCP stayed barely used in real traffic across the Internet in the late 1990s 😭 dynamic updates barely got deployed between autonomous networks, and right around when DNSSEC was first defined, another new feature locked in UDP as the king of message transactions 👑
2.3. EDNS(0) ✨
Back in 1999, the IETF gave us Extension Mechanisms for DNS (EDNS(0)) in [RFC2671], which got replaced by [RFC6891] in 2013 🎀. It was a standard way for DNS nodes to do basic capabilities negotiation, kinda like a little handshake going "okay, what can you handle?" One capability that lives in the base spec and shows up in every EDNS(0)-compatible message is the maximum UDP payload size the sender can support. It's an unsigned 16-bit field, measured in bytes, that says the biggest (possibly fragmented) DNS message a node can receive over UDP. In practice, the typical values fall somewhere in the 512 to 4096 byte range. EDNS(0) got really popular over the next few years, and a bunch of surveys (see [CASTRO2010] and [NETALYZR]) showed that lots of systems can handle bigger UDP MTUs with EDNS(0) 🦋
The side effect of EDNS(0) rolling out was that DNS messages bigger than 512 bytes ended up leaning less on TCP than they otherwise might have. Sure, there's still a not-tiny crowd of DNS systems without EDNS(0), or that don't fall back to TCP when they need to. But clients still strongly prefer UDP over TCP 💅 For example, as of 2014, DNS-over-TCP was a very small slice of the overall DNS traffic root name servers got [VERISIGN] 🙈
2.4. Fragmentation and Truncation 🧩
Even though EDNS(0) lets endpoints say they support DNS messages over 512 bytes, the messy, unevenly deployed Internet means some big messages might never reach their destination. Any IP datagram bigger than the MTU of a link it crosses gets fragmented, then reassembled by the receiving host. The problem is that middleboxes and firewalls blocking IP fragments is not rare 😭 If even one fragment goes missing, the application never gets the message and the request times out.
For IPv4-connected hosts, the MTU is often an Ethernet payload size of 1500 bytes. So the largest unfragmented UDP DNS message you can send over IPv4 is likely 1472 bytes, though tunnel encapsulation can shrink that maximum in some cases.
IPv6 is a bit more of a situation 🙈 First, IPv6 headers are 40 bytes (versus 20 without options in IPv4). Second, roughly one-third of DNS recursive resolvers use the minimum MTU of 1280 bytes [APNIC]. Third, only the originating host can fragment in IPv6. The need to fragment gets signaled with an ICMPv6 Packet Too Big message, and the originating host marks a fragmented datagram with IPv6 extension headers. The catch is that ICMPv6 and IPv6 extension headers are both super commonly blocked by middleboxes. According to [HUSTON], about 35% of IPv6-capable recursive resolvers were unable to receive a fragmented IPv6 packet. When the originating host gets the signal that fragmentation is required, it's expected to populate its path MTU cache for that destination. Then the application retries the query after a timeout, since the host generally doesn't keep copies of UDP messages it sent in case they need retransmitting.
So the practical takeaway is that DNS requestors must be prepared to retry queries with different EDNS(0) maximum message size values. Administrators of [BIND] are probably familiar with seeing this message in their system logs: success resolving ... after reducing the advertised EDNS(0) UDP packet size to 512 octets 🥲
Often, reducing the EDNS(0) UDP packet size leads to a successful response, because the necessary data fits in the smaller message size. But when the data doesn't fit, the server sets the truncated flag in its response, which tells the client to retry over TCP to get the whole thing. This is a bit of a bummer from the client's side, since it adds latency. It can also be a bummer from the server's side, because TCP has higher resource requirements. 💀
Note that a receiver can't tell the difference between packets lost to congestion and packets (fragments) that were intentionally dropped by firewalls or middleboxes. Over network paths with a non-trivial amount of packet loss, bigger, fragmented DNS responses are more likely to never arrive and time out than smaller, unfragmented ones. So clients might be misled into retrying queries with different EDNS(0) UDP packet size values for the wrong reason 🤔
The fragmentation, truncation, and TCP drama is driving some implementation and policy decisions in DNS. Notably, Cloudflare built a technique that minimizes the number of DNSSEC denial-of-existence records (for its online signing platform) [CLOUDFLARE], and it uses an Elliptic Curve Digital Signature Algorithm (ECDSA) so its signed responses fit easily in 512 bytes ✨ The Key Signing Key (KSK) Rollover Design Team [DESIGNTEAM] spent a lot of time thinking and worrying about response sizes. There's also growing sentiment in the DNSSEC community that RSA key sizes beyond 2048 bits are impractical, and that critical infrastructure zones should move to elliptic curve algorithms to keep response sizes manageable [ECDSA] 🔥
More recently, renewed security concerns about fragmented DNS messages (see [AVOID_FRAGS] and [FRAG_POISON]) have implementors considering smaller responses and lower default EDNS(0) UDP payload size values for both queriers and responders [FLAGDAY2020] 👑
2.5. "Only Zone Transfers Use TCP" 🎀
Today, the majority of the DNS community expects, or at least really wants, to see DNS-over-TCP transactions happen without interference [FLAGDAY2020]. However, some operators have long believed, mostly for security reasons, that DNS-over-TCP services should be deliberately limited or not offered at all [CHES94] [DJBDNS]. A popular meme is that DNS over TCP is only ever used for zone transfers and is generally unnecessary otherwise. Filtering all DNS-over-TCP traffic has even been described as a best practice 🙄
That position had some justification, since historical DNS name server implementations provided very little in the way of TCP connection management (see Section 6.1.2 of [RFC7766] for more details). But modern standards and implementations are getting close to parity with the more sophisticated TCP management techniques used by, for example, HTTP(S) servers and load balancers 🌸
2.6. Reuse, Pipelining, and Out-of-Order Processing 🦋
The idea that one TCP connection can handle multiple transactions goes all the way back to [RFC0883], which says: "Multiple messages may be sent over a virtual circuit." Although [RFC1035], which updates the former, leaves out this particular detail, it has been widely accepted that a TCP connection can be used for more than one query and response 💜
[RFC5966] clarifies that servers are not required to preserve the order of queries and responses over any transport. Then [RFC7766], which updates the former, encourages query pipelining over TCP to get performance on par with UDP. A server that sends out-of-order responses to pipelined queries avoids head-of-line blocking when the response for a later query is ready before the response to an earlier one ✨
But TCP can potentially suffer from a different head-of-line blocking problem due to packet loss. Since TCP itself enforces ordering, a single lost segment delays delivery of data in any following segments until the lost segment is retransmitted and successfully received 😤
3. DNS-over-TCP Requirements 💖
An average increase in DNS message size (e.g., due to DNSSEC), the continued development of new DNS features (Appendix A), and a denial-of-service mitigation technique (Section 8) all show that DNS-over-TCP transactions are as important to the correct and safe operation of the Internet DNS as ever, if not more so. Furthermore, there's research arguing that connection-oriented DNS transactions may provide security and privacy advantages over UDP transport [TDNS]. In fact, the standard for DNS over TLS [RFC7858] is exactly this sort of specification. Therefore, this document makes it explicit that it is undesirable for network operators to artificially inhibit DNS-over-TCP transport. 🫶
Section 6.1.3.2 of [RFC1123] is updated as follows:
OLD:
DNS resolvers and recursive servers MUST support UDP, and SHOULD support TCP, for sending (non-zone-transfer) queries.
NEW:
All DNS resolvers and servers MUST support and service both UDP and TCP queries.
Note that:
- DNS servers (including forwarders) MUST support and service TCP for receiving queries so that clients can reliably receive responses that are larger than what either side considers too large for UDP.
- DNS clients MUST support TCP for sending queries so that they can retry truncated UDP responses as necessary.
Furthermore, the requirement in Section 6.1.3.2 of [RFC1123] around limiting the resources a server devotes to queries is hereby updated:
OLD:
A name server MAY limit the resources it devotes to TCP queries, but it SHOULD NOT refuse to service a TCP query just because it would have succeeded with UDP.
NEW:
A name server MAY limit the resources it devotes to queries, but it MUST NOT refuse to service a query just because it would have succeeded with another transport protocol.
Lastly, Section 1 of [RFC1536] is updated to eliminate the misconception that TCP is only useful for zone transfers:
OLD:
DNS implements the classic request-response scheme of client-server interaction. UDP is, therefore, the chosen protocol for communication though TCP is used for zone transfers.
NEW:
DNS implements the classic request-response scheme of client-server interaction.
The filtering of DNS over TCP is harmful in the general case 🚫 DNS resolver and server operators MUST support and provide DNS service over both UDP and TCP transports. Likewise, network operators MUST allow DNS service over both UDP and TCP transports. It's acknowledged that DNS-over-TCP service can pose operational challenges that aren't present when running DNS over UDP alone, and vice versa. Still, the potential damage from prohibiting DNS-over-TCP service is more detrimental to the continued utility and success of the DNS than allowing its usage is 🌈
4. Network and System Considerations 🌈
This section describes measures that systems and applications can take to optimize performance over TCP, and to protect themselves from TCP-based resource exhaustion and attacks 🛡️
4.1. Connection Establishment and Admission ✨
Okay so bestie, resolvers and other DNS clients need to know that some servers might not be reachable over TCP 🥺 That's why clients MAY track and limit the number of TCP connections and connection attempts to a single server 🧚 Reachability problems can come from network elements near the server, near the client, or anywhere along the path in between 🛣️ And mobile clients that cache connection failures MAY do that per network, or MAY clear that cache whenever the network changes 📱
Also, DNS clients MAY enforce a short timeout on connections that aren't established yet, instead of just relying on the host OS's TCP connection timeout 💅 That one is usually around 60-120 seconds, which is giving "why so long??" 😭 (It comes from an initial retransmission timeout of 1 second, the exponential back-off rules of [RFC6298], and a limit of six retries, which is the default in Linux.)
Now the SYN flooding attack 💀 It's a denial-of-service method that hits hosts running TCP server processes [RFC4987], and it can be super effective if you don't mitigate it. One of the most effective fixes is SYN cookies, described in Section 3.6 of [RFC4987] 🍓 They let the server avoid allocating any state until the three-way handshake finishes successfully. Iconic 👑
Services that aren't meant for the public Internet, like most recursive name servers, SHOULD be protected with access controls 🔒 Ideally these controls sit in the network, way before any unwanted TCP packets can reach the DNS server host or application. If that's not possible, the controls can go in the application itself. And in some situations (like attacks), you may need access controls on DNS services that should otherwise be globally reachable 🛡️ See also [RFC5358].
The FreeBSD and NetBSD operating systems have an "accept filter" feature ([accept_filter]) that holds off delivering TCP connections to applications until a complete, valid request has arrived 🦋 The dns_accf(9) filter makes sure a valid DNS message is received. If it isn't, the bogus connection never even reaches the application 🙈 Linux's TCP_DEFER_ACCEPT feature is more limited in scope, but it can give you some of the same benefits as the BSD accept filter ✨ These features are low-level socket options and are NOT activated automatically, so if applications want them, they need to make specific calls to set the right options, and administrators may also need to configure the applications to use them properly 🧑💻
Per [RFC7766], applications and administrators are reminded that TCP MAY be used before any UDP queries are sent 🌈 Networks and applications MUST NOT be configured to refuse TCP queries that weren't preceded by a UDP query. No cap, that's a hard rule 🚫
TCP Fast Open (TFO) [RFC7413] lets TCP clients shorten the handshake for later connections to the same server 🚀 TFO saves one round-trip time during connection setup. DNS servers SHOULD enable TFO when possible 💖 Also, DNS servers clustered behind a single service address (like anycast or load balancing) SHOULD either use the same TFO server key on all instances or disable TFO for every member of the cluster 🫶
DNS clients MAY also enable TFO. At the time of writing, it's not implemented or is disabled by default on some operating systems 🥹 [WIKIPEDIA_TFO] describes applications and operating systems that support TFO 📚
4.2. Connection Management 💜
Since host memory for TCP state is a finite resource, DNS clients and servers SHOULD actively manage their connections 🧠 Applications that don't actively manage their connections can run into resource exhaustion, which leads to denial of service 😬 For DNS, just like in other protocols, there's a trade-off between keeping connections open for possible future use and freeing up resources for new connections that are about to arrive ⚖️
Operators of DNS server software SHOULD be aware that operating system and application vendors MAY impose a limit on the total number of established connections 🎀 These limits may exist to protect against DDoS attacks or performance degradation. Operators SHOULD understand how to raise these limits if needed, and what the consequences of doing so are 🤓 Limits imposed by the application SHOULD be lower than the ones imposed by the operating system, so the application can apply its own connection management policy, like closing the oldest idle connections first 👑
DNS server software MAY provide a configurable limit on the number of established connections per source IP address or subnet 🌸 This can make sure a single user or a small group of users can't hog all the TCP resources and deny service to everyone else. Heads up though: if this limit is turned on, it might limit client performance while leaving some TCP resources unused 🙃 Operators SHOULD be aware of these trade-offs and make sure this limit, if configured, is set appropriately based on the number and diversity of their users, and whether users connect from unique IP addresses or through a shared Network Address Translator (NAT) [RFC3022] 🏠
DNS server software SHOULD provide a configurable timeout for idle TCP connections 💤 This frees up resources for new connections and makes sure idle connections eventually get closed. Again, it might limit client performance while leaving some TCP resources unused 😅 For very busy name servers, this might be set to a low value, like a few seconds. For less busy servers, it might be set to a higher value, like tens of seconds. DNS clients and servers SHOULD signal their timeout values using the edns-tcp-keepalive EDNS(0) option [RFC7828] 💌
DNS server software MAY provide a configurable limit on the number of transactions per TCP connection 🔁 This can help protect against unfair connection use (like not releasing connection slots to other clients) and network evasion attacks 🕵️
Similarly, DNS server software MAY provide a configurable limit on the total duration of a TCP connection ⏳ This can help protect against unfair connection use, slow read attacks, and network evasion attacks 🐢
Since clients may not be aware of server-imposed limits, clients using TCP for DNS need to always be prepared to re-establish connections or retry outstanding queries 🔄 Stay ready, bestie 💅
4.3. Connection Termination 🌙
The TCP peer that starts a connection close keeps the socket in the TIME_WAIT state for some amount of time, possibly a few minutes ⏰ It's generally better for clients to be the ones initiating the close, so busy servers don't pile up tons of sockets in TIME_WAIT, which can cause performance problems or even denial of service 🥴 The edns-tcp-keepalive EDNS(0) option [RFC7828] can be used to encourage clients to close connections 🫧
On systems where lots of sockets in TIME_WAIT are showing up (as either a client or a server) and they're hurting an application's performance, it might be tempting to tune local TCP parameters 🔧 For example, the Linux kernel has a "sysctl" parameter named net.ipv4.tcp_tw_reuse, which lets connections in TIME_WAIT be reused in specific circumstances. Note, however, that this only affects outgoing (client) connections and has no impact on servers 🙃 In most cases, it is NOT RECOMMENDED to change parameters related to the TIME_WAIT state 🚫 That should only be done by people with detailed knowledge of both TCP and the affected application 🧑🔬
4.4. DNS over TLS 🔐
DNS messages can be sent over TLS to give privacy between stubs and recursive resolvers 🕶️ [RFC7858] is a Standards Track document that describes how this works. Even though DNS over TLS uses TCP port 853 instead of port 53, this document applies equally well to DNS over TLS 🎀 Note, however, that DNS over TLS is only defined between stubs and recursives at the time of writing 📝
Using TLS adds even stronger operational burdens for DNS clients and servers 😩 Cryptographic functions for authentication and encryption need extra processing. Unoptimized connection setup with TLS 1.3 [RFC8446] takes one extra round trip compared to TCP. Connection setup times can be reduced with TCP Fast Open and TLS False Start [RFC7918] for TLS 1.2 ⚡ TLS 1.3 session resumption doesn't reduce round-trip latency, because no application profile for using TLS 0-RTT data with DNS has been published at the time of writing 🙅♀️ However, TLS session resumption can reduce the number of cryptographic operations, and in TLS 1.2, session resumption does reduce the number of extra round trips from two to one 🧮
4.5. Defaults and Recommended Limits 📊
A survey of features and defaults was done for popular open-source DNS server implementations at the time of writing 🔍 This section documents those defaults and makes recommendations for configurable limits that can be used when there's no other info. Any recommended values in this document are only meant as a starting point for admins who aren't sure what limits might be reasonable 🫶 Operators SHOULD use application-specific monitoring, system logs, and system monitoring tools to check whether their service is operating within or exceeding these limits, and adjust accordingly 📈
Most open-source DNS server implementations provide a configurable limit on the total number of established connections 🧁 Default values range from 20 to 150. In most cases, where the majority of queries happen over UDP, 150 is a reasonable limit. For services or environments where most queries happen over TCP or TLS, 5000 is a more appropriate limit 💪
Only some open-source implementations provide a way to limit the number of connections per source IP address or subnet, but the default is no limit 🌈 For environments or situations where it may be necessary to enable this limit, 25 connections per source IP address is a reasonable starting point. The limit should be increased when aggregated by subnet, or for services where most queries happen over TCP or TLS 🦋
Most open-source implementations provide a configurable idle timeout on connections 🕐 Default values range from 2 to 30 seconds. In most cases, 10 seconds is a reasonable default for this limit. Longer timeouts improve connection reuse, but busy servers may need a lower limit 🏃♀️
Only some open-source implementations provide a way to limit the number of transactions per connection, but the default is no limit. This document doesn't offer advice on particular values for such a limit 🤷♀️
Only some open-source implementations provide a way to limit the duration of a connection, but the default is no limit. This document doesn't offer advice on particular values for such a limit 🫠
5. DNS-over-TCP Filtering Risks ✨
Okay bestie, let's talk about what happens when networks block DNS over TCP. Networks that filter DNS over TCP risk losing access to big, important chunks of the DNS namespace 😭. A DNS answer can need a DNS-over-TCP query for a bunch of reasons: large message sizes, no EDNS(0) support, or DDoS mitigation stuff like Response Rate Limiting [RRL]. And honestly? Some future feature nobody has thought of yet might need TCP too 🔮.
For example, [RFC7901] describes a latency-avoiding technique that sends extra data in DNS responses. That makes responses bigger and can make DDoS reflection attacks more effective 💀. The specification mandates the use of TCP or DNS cookies [RFC7873].
Even if certain answers have always come back over UDP just fine, that can't be guaranteed when DNS messages are exchanged between autonomous systems. So filtering DNS over TCP is considered harmful and contrary to the safe and successful operation of the Internet 🚫. This section lists some of the known risks as of this writing when networks filter DNS over TCP.
5.1. Truncation, Retries, and Timeouts
Networks that filter DNS over TCP may accidentally cause problems for third-party resolvers, as [TOYAMA] experienced. Picture this: a resolver gets queries for a moderately popular domain and forwards them to the domain's authoritative name servers. Those servers respond with the TC bit set. The resolver retries over TCP, but the authoritative server blocks DNS over TCP. The pending connections eat up resources on the resolver until they time out 😩. If these truncated-and-then-blocked queries happen often enough, the resolver wastes valuable resources on queries that can never be answered. This condition is generally not easily or completely mitigated by the affected DNS resolver operator.
5.2. DNS Root Zone KSK Rollover
The plans for deploying DNSSEC KSK for the root zone highlighted a potential problem in retrieving the root zone key set [LEWIS]. During some phases of the KSK rollover process, root zone DNSKEY responses were larger than 1280 bytes, the IPv6 minimum MTU for links carrying IPv6 traffic [RFC8200]. There was some concern that any DNS server unable to receive large DNS messages over UDP, or any DNS message over TCP, would experience disruption while performing DNSSEC validation [KSK_ROLLOVER_ARCHIVES]. 😬
However, during the year-long postponement of the KSK rollover, there were no reported problems that could be attributed to the 1414 octet DNSKEY response when both the old and new keys were published in the zone. Additionally, there were no reported problems during the two-month period when the old key was published as revoked and the DNSKEY response was 1425 octets in size [ROLL_YOUR_ROOT]. 🎉
6. Logging and Monitoring 👀
Developers of apps that log or monitor DNS SHOULD NOT ignore TCP just because it's supposedly rarely used or hard to process 🙄. Operators SHOULD ensure that their monitoring and logging apps properly capture DNS messages over TCP. Otherwise, attacks, exfiltration attempts, and normal traffic may go undetected 🕵️.
DNS messages over TCP are in no way guaranteed to arrive in single segments. In fact, a clever attacker might try to hide certain messages by forcing them over very small TCP segments 🥷. Apps that capture network packets (e.g., with libpcap [libpcap]) SHOULD implement and perform full TCP stream reassembly, and analyze the reassembled stream instead of the individual packets. Otherwise, they're vulnerable to network evasion attacks [phrack]. Those apps also need to protect themselves from resource exhaustion attacks by limiting the amount of memory allocated to tracking unacknowledged connection state data. dnscap [dnscap] is an open-source example of a DNS logging program that implements TCP stream reassembly 💖.
Developers SHOULD also keep in mind connection reuse, query pipelining, and out-of-order responses when building and testing DNS monitoring applications 🧠.
As an alternative to packet capture, some DNS server software supports dnstap [dnstap] as an integrated monitoring protocol intended to facilitate wide-scale DNS monitoring 🦋.
7. IANA Considerations 📭
This document has no IANA actions.
8. Security Considerations 💀
This document, providing operational requirements, is the companion to the implementation requirements of DNS over TCP provided in [RFC7766]. The security considerations from [RFC7766] still apply.
Ironically, returning truncated DNS-over-UDP answers in order to induce a client query to switch to DNS over TCP has become a common response to source-address-spoofed, DNS denial-of-service attacks [RRL]. Historically, operators have been wary of TCP-based attacks, but in recent years, UDP-based flooding attacks have proven to be the most common protocol attack on the DNS. Nevertheless, a high rate of short-lived DNS transactions over TCP may pose challenges. In fact, [DAI21] details a class of IP fragmentation attacks on DNS transactions if the IP Identifier field (16 bits in IPv4 and 32 bits in IPv6) can be predicted and a system is coerced to fragment rather than retransmit messages. While many operators have provided DNS-over-TCP service for many years without duress, past experience is no guarantee of future success. 😰
DNS over TCP is similar to many other Internet TCP services. TCP threats and many mitigation strategies have been well documented in a series of documents such as [RFC4953], [RFC4987], [RFC5927], and [RFC5961].
As mentioned in Section 6, applications that implement TCP stream reassembly need to limit the amount of memory allocated to connection tracking. A failure to do so could lead to a total failure of the logging or monitoring application. Imposing resource limits creates a trade-off between allowing some stream reassembly to continue and allowing some evasion attacks to succeed. ⚠️
This document recommends that DNS servers enable TFO when possible. [RFC7413] recommends that a pool of servers behind a load balancer with a shared server IP address also share the key used to generate Fast Open cookies, to prevent inordinate fallback to the three-way handshake (3WHS). This guidance remains accurate but comes with a caveat: compromise of one server would reveal this group-shared key and allow for attacks involving the other servers in the pool by forging invalid Fast Open cookies. 🔑
9. Privacy Considerations 🙈
Since DNS over both UDP and TCP uses the same underlying message format, the use of one transport instead of the other does not change the privacy characteristics of the message content (i.e., the name being queried). A number of protocols have recently been developed to provide DNS privacy, including DNS over TLS [RFC7858], DNS over DTLS [RFC8094], DNS over HTTPS [RFC8484], with even more on the way 🔐.
Because TCP is somewhat more complex than UDP, some characteristics of a TCP conversation may enable DNS client fingerprinting and tracking that is not possible with UDP. For example, the choice of initial sequence numbers, window size, and options might be able to identify a particular TCP implementation or even individual hosts behind shared resources such as NATs 🕵️.
10. References 📚
10.1. Normative References
[RFC1035] Mockapetris, P., "Domain names - implementation and
specification", STD 13, RFC 1035, DOI 10.17487/RFC1035,
November 1987, <https://www.rfc-editor.org/info/rfc1035>.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
[RFC2181] Elz, R. and R. Bush, "Clarifications to the DNS
Specification", RFC 2181, DOI 10.17487/RFC2181, July 1997,
<https://www.rfc-editor.org/info/rfc2181>.
[RFC6891] Damas, J., Graff, M., and P. Vixie, "Extension Mechanisms
for DNS (EDNS(0))", STD 75, RFC 6891,
DOI 10.17487/RFC6891, April 2013,
<https://www.rfc-editor.org/info/rfc6891>.
[RFC7766] Dickinson, J., Dickinson, S., Bellis, R., Mankin, A., and
D. Wessels, "DNS Transport over TCP - Implementation
Requirements", RFC 7766, DOI 10.17487/RFC7766, March 2016,
<https://www.rfc-editor.org/info/rfc7766>.
[RFC7828] Wouters, P., Abley, J., Dickinson, S., and R. Bellis, "The
edns-tcp-keepalive EDNS0 Option", RFC 7828,
DOI 10.17487/RFC7828, April 2016,
<https://www.rfc-editor.org/info/rfc7828>.
[RFC7873] Eastlake 3rd, D. and M. Andrews, "Domain Name System (DNS)
Cookies", RFC 7873, DOI 10.17487/RFC7873, May 2016,
<https://www.rfc-editor.org/info/rfc7873>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>.10.2. Informative References
[accept_filter]
FreeBSD, "FreeBSD accept_filter(9)", June 2000,
<https://www.freebsd.org/cgi/man.cgi?query=accept_filter>.
[APNIC] Huston, G., "DNS XL", October 2020,
<https://labs.apnic.net/?p=1380>.
[AVOID_FRAGS]
Fujiwara, K. and P. Vixie, "Fragmentation Avoidance in
DNS", Work in Progress, Internet-Draft, draft-ietf-dnsop-
avoid-fragmentation-06, 23 December 2021,
<https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-
avoid-fragmentation-06>.
[BIND] Internet Systems Consortium, "BIND 9",
<https://www.isc.org/bind/>.
[CASTRO2010]
Castro, S., Zhang, M., John, W., Wessels, D., and K.
claffy, "Understanding and Preparing for DNS Evolution",
DOI 10.1007/978-3-642-12365-8_1, April 2010,
<https://doi.org/10.1007/978-3-642-12365-8_1>.
[CHES94] Cheswick, W. and S. Bellovin, "Firewalls and Internet
Security: Repelling the Wily Hacker", First Edition, 1994.
[CLOUDFLARE]
Grant, D., "Economical With The Truth: Making DNSSEC
Answers Cheap", June 2016,
<https://blog.cloudflare.com/black-lies/>.
[DAI21] Dai, T., Shulman, H., and M. Waidner, "DNS-over-TCP
Considered Vulnerable", DOI 10.1145/3472305.3472884, July
2021, <https://doi.org/10.1145/3472305.3472884>.
[DESIGNTEAM]
ICANN, "Root Zone KSK Rollover Plan", March 2016,
<https://www.iana.org/reports/2016/root-ksk-rollover-
design-20160307.pdf>.
[DJBDNS] Bernstein, D., "When are TCP queries sent?", November
2002, <https://cr.yp.to/djbdns/tcp.html#why>.
[dnscap] DNS-OARC, "DNSCAP", February 2014,
<https://www.dns-oarc.net/tools/dnscap>.
[dnstap] "dnstap", <https://dnstap.info>.
[ECDSA] van Rijswijk-Deij, R., Sperotto, A., and A. Pras, "Making
the Case for Elliptic Curves in DNSSEC",
DOI 10.1145/2831347.2831350, October 2015,
<https://dl.acm.org/doi/10.1145/2831347.2831350>.
[FLAGDAY2020]
DNS Software and Service Providers, "DNS Flag Day 2020",
October 2020, <https://dnsflagday.net/2020/>.Continuing the references 💖 Here's the rest of the reference list, bestie! 🦋
content: the references below are the citations the document leans on, and each one keeps its exact details.
[FRAG_POISON] Herzberg, A. and H. Shulman, "Fragmentation Considered Poisonous", May 2012, <https://arxiv.org/pdf/1205.4011.pdf>.
[HUSTON] Huston, G., "Dealing with IPv6 fragmentation in the DNS", August 2017, <https://blog.apnic.net/2017/08/22/dealing- ipv6-fragmentation-dns/>.
[KSK_ROLLOVER_ARCHIVES] ICANN, "KSK Rollover List Archives", January 2019, <https://mm.icann.org/pipermail/ksk-rollover/2019-January/ date.html>.
[LEWIS] Lewis, E., "2017 DNSSEC KSK Rollover", RIPE 74, May 2017, <https://ripe74.ripe.net/presentations/25-RIPE74-lewis- submission.pdf>.
[libpcap] The Tcpdump Group, "Tcpdump and Libpcap", <https://www.tcpdump.org>.
[NETALYZR] Kreibich, C., Weaver, N., Nechaev, B., and V. Paxson, "Netalyzr: Illuminating The Edge Network", DOI 10.1145/1879141.1879173, November 2010, <https://doi.org/10.1145/1879141.1879173>.
[phrack] horizon, "Defeating Sniffers and Intrusion Detection Systems", Phrack Magazine, December 1998, <http://phrack.org/issues/54/10.html>.
[RFC0768] Postel, J., "User Datagram Protocol", STD 6, RFC 768, DOI 10.17487/RFC0768, August 1980, <https://www.rfc-editor.org/info/rfc768>.
[RFC0793] Postel, J., "Transmission Control Protocol", STD 7, RFC 793, DOI 10.17487/RFC0793, September 1981, <https://www.rfc-editor.org/info/rfc793>.
[RFC0883] Mockapetris, P., "Domain names: Implementation specification", RFC 883, DOI 10.17487/RFC0883, November 1983, <https://www.rfc-editor.org/info/rfc883>.
[RFC1034] Mockapetris, P., "Domain names - concepts and facilities", STD 13, RFC 1034, DOI 10.17487/RFC1034, November 1987, <https://www.rfc-editor.org/info/rfc1034>.
[RFC1123] Braden, R., Ed., "Requirements for Internet Hosts - Application and Support", STD 3, RFC 1123, DOI 10.17487/RFC1123, October 1989, <https://www.rfc-editor.org/info/rfc1123>.
[RFC1536] Kumar, A., Postel, J., Neuman, C., Danzig, P., and S. Miller, "Common DNS Implementation Errors and Suggested Fixes", RFC 1536, DOI 10.17487/RFC1536, October 1993, <https://www.rfc-editor.org/info/rfc1536>.
[RFC1995] Ohta, M., "Incremental Zone Transfer in DNS", RFC 1995, DOI 10.17487/RFC1995, August 1996, <https://www.rfc-editor.org/info/rfc1995>.
[RFC1996] Vixie, P., "A Mechanism for Prompt Notification of Zone Changes (DNS NOTIFY)", RFC 1996, DOI 10.17487/RFC1996, August 1996, <https://www.rfc-editor.org/info/rfc1996>.
[RFC2136] Vixie, P., Ed., Thomson, S., Rekhter, Y., and J. Bound, "Dynamic Updates in the Domain Name System (DNS UPDATE)", RFC 2136, DOI 10.17487/RFC2136, April 1997, <https://www.rfc-editor.org/info/rfc2136>.
[RFC2541] Eastlake 3rd, D., "DNS Security Operational Considerations", RFC 2541, DOI 10.17487/RFC2541, March 1999, <https://www.rfc-editor.org/info/rfc2541>.
[RFC2671] Vixie, P., "Extension Mechanisms for DNS (EDNS0)", RFC 2671, DOI 10.17487/RFC2671, August 1999, <https://www.rfc-editor.org/info/rfc2671>.
[RFC2694] Srisuresh, P., Tsirtsis, G., Akkiraju, P., and A. Heffernan, "DNS extensions to Network Address Translators (DNS_ALG)", RFC 2694, DOI 10.17487/RFC2694, September 1999, <https://www.rfc-editor.org/info/rfc2694>.
[RFC3022] Srisuresh, P. and K. Egevang, "Traditional IP Network Address Translator (Traditional NAT)", RFC 3022, DOI 10.17487/RFC3022, January 2001, <https://www.rfc-editor.org/info/rfc3022>.
[RFC3225] Conrad, D., "Indicating Resolver Support of DNSSEC", RFC 3225, DOI 10.17487/RFC3225, December 2001, <https://www.rfc-editor.org/info/rfc3225>.
[RFC3226] Gudmundsson, O., "DNSSEC and IPv6 A6 aware server/resolver message size requirements", RFC 3226, DOI 10.17487/RFC3226, December 2001, <https://www.rfc-editor.org/info/rfc3226>.
[RFC4472] Durand, A., Ihren, J., and P. Savola, "Operational Considerations and Issues with IPv6 DNS", RFC 4472, DOI 10.17487/RFC4472, April 2006, <https://www.rfc-editor.org/info/rfc4472>.
[RFC4953] Touch, J., "Defending TCP Against Spoofing Attacks", RFC 4953, DOI 10.17487/RFC4953, July 2007, <https://www.rfc-editor.org/info/rfc4953>.
[RFC4987] Eddy, W., "TCP SYN Flooding Attacks and Common Mitigations", RFC 4987, DOI 10.17487/RFC4987, August 2007, <https://www.rfc-editor.org/info/rfc4987>.
[RFC5358] Damas, J. and F. Neves, "Preventing Use of Recursive Nameservers in Reflector Attacks", BCP 140, RFC 5358, DOI 10.17487/RFC5358, October 2008, <https://www.rfc-editor.org/info/rfc5358>.
[RFC5452] Hubert, A. and R. van Mook, "Measures for Making DNS More Resilient against Forged Answers", RFC 5452, DOI 10.17487/RFC5452, January 2009, <https://www.rfc-editor.org/info/rfc5452>.
[RFC5507] IAB, Faltstrom, P., Ed., Austein, R., Ed., and P. Koch, Ed., "Design Choices When Expanding the DNS", RFC 5507, DOI 10.17487/RFC5507, April 2009, <https://www.rfc-editor.org/info/rfc5507>.
[RFC5625] Bellis, R., "DNS Proxy Implementation Guidelines", BCP 152, RFC 5625, DOI 10.17487/RFC5625, August 2009, <https://www.rfc-editor.org/info/rfc5625>.
[RFC5927] Gont, F., "ICMP Attacks against TCP", RFC 5927, DOI 10.17487/RFC5927, July 2010, <https://www.rfc-editor.org/info/rfc5927>.
[RFC5936] Lewis, E. and A. Hoenes, Ed., "DNS Zone Transfer Protocol (AXFR)", RFC 5936, DOI 10.17487/RFC5936, June 2010, <https://www.rfc-editor.org/info/rfc5936>.
[RFC5961] Ramaiah, A., Stewart, R., and M. Dalal, "Improving TCP's Robustness to Blind In-Window Attacks", RFC 5961, DOI 10.17487/RFC5961, August 2010, <https://www.rfc-editor.org/info/rfc5961>.
[RFC5966] Bellis, R., "DNS Transport over TCP - Implementation Requirements", RFC 5966, DOI 10.17487/RFC5966, August 2010, <https://www.rfc-editor.org/info/rfc5966>.
[RFC6298] Paxson, V., Allman, M., Chu, J., and M. Sargent, "Computing TCP's Retransmission Timer", RFC 6298, DOI 10.17487/RFC6298, June 2011, <https://www.rfc-editor.org/info/rfc6298>.
[RFC6762] Cheshire, S. and M. Krochmal, "Multicast DNS", RFC 6762, DOI 10.17487/RFC6762, February 2013, <https://www.rfc-editor.org/info/rfc6762>.
[RFC6781] Kolkman, O., Mekking, W., and R. Gieben, "DNSSEC Operational Practices, Version 2", RFC 6781, DOI 10.17487/RFC6781, December 2012, <https://www.rfc-editor.org/info/rfc6781>.
[RFC6950] Peterson, J., Kolkman, O., Tschofenig, H., and B. Aboba, "Architectural Considerations on Application Features in the DNS", RFC 6950, DOI 10.17487/RFC6950, October 2013, <https://www.rfc-editor.org/info/rfc6950>.
[RFC7413] Cheng, Y., Chu, J., Radhakrishnan, S., and A. Jain, "TCP Fast Open", RFC 7413, DOI 10.17487/RFC7413, December 2014, <https://www.rfc-editor.org/info/rfc7413>.
[RFC7477] Hardaker, W., "Child-to-Parent Synchronization in DNS", RFC 7477, DOI 10.17487/RFC7477, March 2015, <https://www.rfc-editor.org/info/rfc7477>.
[RFC7534] Abley, J. and W. Sotomayor, "AS112 Nameserver Operations", RFC 7534, DOI 10.17487/RFC7534, May 2015, <https://www.rfc-editor.org/info/rfc7534>.
[RFC7720] Blanchet, M. and L-J. Liman, "DNS Root Name Service Protocol and Deployment Requirements", BCP 40, RFC 7720, DOI 10.17487/RFC7720, December 2015, <https://www.rfc-editor.org/info/rfc7720>.
[RFC7858] Hu, Z., Zhu, L., Heidemann, J., Mankin, A., Wessels, D., and P. Hoffman, "Specification for DNS over Transport Layer Security (TLS)", RFC 7858, DOI 10.17487/RFC7858, May 2016, <https://www.rfc-editor.org/info/rfc7858>.
[RFC7901] Wouters, P., "CHAIN Query Requests in DNS", RFC 7901, DOI 10.17487/RFC7901, June 2016, <https://www.rfc-editor.org/info/rfc7901>.
[RFC7918] Langley, A., Modadugu, N., and B. Moeller, "Transport Layer Security (TLS) False Start", RFC 7918, DOI 10.17487/RFC7918, August 2016, <https://www.rfc-editor.org/info/rfc7918>.
[RFC8027] Hardaker, W., Gudmundsson, O., and S. Krishnaswamy, "DNSSEC Roadblock Avoidance", BCP 207, RFC 8027, DOI 10.17487/RFC8027, November 2016, <https://www.rfc-editor.org/info/rfc8027>.
[RFC8094] Reddy, T., Wing, D., and P. Patil, "DNS over Datagram Transport Layer Security (DTLS)", RFC 8094, DOI 10.17487/RFC8094, February 2017, <https://www.rfc-editor.org/info/rfc8094>.
[RFC8162] Hoffman, P. and J. Schlyter, "Using Secure DNS to Associate Certificates with Domain Names for S/MIME", RFC 8162, DOI 10.17487/RFC8162, May 2017, <https://www.rfc-editor.org/info/rfc8162>.
[RFC8200] Deering, S. and R. Hinden, "Internet Protocol, Version 6 (IPv6) Specification", STD 86, RFC 8200, DOI 10.17487/RFC8200, July 2017, <https://www.rfc-editor.org/info/rfc8200>.
[RFC8324] Klensin, J., "DNS Privacy, Authorization, Special Uses, Encoding, Characters, Matching, and Root Structure: Time for Another Look?", RFC 8324, DOI 10.17487/RFC8324, February 2018, <https://www.rfc-editor.org/info/rfc8324>.
[RFC8446] Rescorla, E., "The Transport Layer Security (TLS) Protocol Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018, <https://www.rfc-editor.org/info/rfc8446>.
[RFC8467] Mayrhofer, A., "Padding Policies for Extension Mechanisms for DNS (EDNS(0))", RFC 8467, DOI 10.17487/RFC8467, October 2018, <https://www.rfc-editor.org/info/rfc8467>.
[RFC8482] Abley, J., Gudmundsson, O., Majkowski, M., and E. Hunt, "Providing Minimal-Sized Responses to DNS Queries That Have QTYPE=ANY", RFC 8482, DOI 10.17487/RFC8482, January 2019, <https://www.rfc-editor.org/info/rfc8482>.
[RFC8483] Song, L., Ed., Liu, D., Vixie, P., Kato, A., and S. Kerr, "Yeti DNS Testbed", RFC 8483, DOI 10.17487/RFC8483, October 2018, <https://www.rfc-editor.org/info/rfc8483>.
[RFC8484] Hoffman, P. and P. McManus, "DNS Queries over HTTPS (DoH)", RFC 8484, DOI 10.17487/RFC8484, October 2018, <https://www.rfc-editor.org/info/rfc8484>.
[RFC8490] Bellis, R., Cheshire, S., Dickinson, J., Dickinson, S., Lemon, T., and T. Pusateri, "DNS Stateful Operations", RFC 8490, DOI 10.17487/RFC8490, March 2019, <https://www.rfc-editor.org/info/rfc8490>.
[RFC8501] Howard, L., "Reverse DNS in IPv6 for Internet Service Providers", RFC 8501, DOI 10.17487/RFC8501, November 2018, <https://www.rfc-editor.org/info/rfc8501>.
[RFC8806] Kumari, W. and P. Hoffman, "Running a Root Server Local to
a Resolver", RFC 8806, DOI 10.17487/RFC8806, June 2020,
<https://www.rfc-editor.org/info/rfc8806>.
[RFC8906] Andrews, M. and R. Bellis, "A Common Operational Problem
in DNS Servers: Failure to Communicate", BCP 231,
RFC 8906, DOI 10.17487/RFC8906, September 2020,
<https://www.rfc-editor.org/info/rfc8906>.
[RFC8932] Dickinson, S., Overeinder, B., van Rijswijk-Deij, R., and
A. Mankin, "Recommendations for DNS Privacy Service
Operators", BCP 232, RFC 8932, DOI 10.17487/RFC8932,
October 2020, <https://www.rfc-editor.org/info/rfc8932>.
[RFC8945] Dupont, F., Morris, S., Vixie, P., Eastlake 3rd, D.,
Gudmundsson, O., and B. Wellington, "Secret Key
Transaction Authentication for DNS (TSIG)", STD 93,
RFC 8945, DOI 10.17487/RFC8945, November 2020,
<https://www.rfc-editor.org/info/rfc8945>.
[ROLL_YOUR_ROOT]
Müller, M., Thomas, M., Wessels, D., Hardaker, W., Chung,
T., Toorop, W., and R. van Rijswijk-Deij, "Roll, Roll,
Roll Your Root: A Comprehensive Analysis of the First Ever
DNSSEC Root KSK Rollover", DOI 10.1145/3355369.3355570,
October 2019,
<https://dl.acm.org/doi/10.1145/3355369.3355570>.
[RRL] Vixie, P. and V. Schryver, "DNS Response Rate Limiting
(DNS RRL)", ISC-TN-2012-1-Draft1, April 2012.
[TDNS] Zhu, L., Heidemann, J., Wessels, D., Mankin, A., and N.
Somaiya, "Connection-Oriented DNS to Improve Privacy and
Security", DOI 10.1109/SP.2015.18, May 2015,
<https://doi.org/10.1109/SP.2015.18>.
[TOYAMA] Toyama, K., Ishibashi, K., Toyono, T., Ishino, M.,
Yoshimura, C., and K. Fujiwara, "DNS Anomalies and Their
Impacts on DNS Cache Servers", NANOG 32, October 2004.
[VERISIGN] Thomas, M. and D. Wessels, "An Analysis of TCP Traffic in
Root Server DITL Data", DNS-OARC 2014 Fall Workshop,
October 2014.
[WIKIPEDIA_TFO]
Wikipedia, "TCP Fast Open", February 2022,
<https://en.wikipedia.org/w/
index.php?title=TCP_Fast_Open&oldid=1071397204>.Appendix A. RFCs Related to DNS Transport over TCP ✨
okay so this appendix is basically the ultimate receipts list 🧾 It rounds up every RFC we could find with a status of Internet Standard, Proposed Standard, Informational, Best Current Practice, or Experimental that says something about TCP as a transport for DNS, whether it's spelled out or just kind of implied. Lowkey iconic research, bestie 🦋
A.1. RFC 1035 - DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION 🌸
The Internet Standard [RFC1035] is literally the base DNS spec, and it explicitly defines support for DNS over TCP. The OG, no cap 👑
A.2. RFC 1536 - Common DNS Implementation Errors and Suggested Fixes 🍓
The Informational document [RFC1536] says UDP is "the chosen protocol for communication though TCP is used for zone transfers." Honestly that was a valid vibe back then, but it's giving historical context now. It doesn't match modern expectations anymore 💀
A.3. RFC 1995 - Incremental Zone Transfer in DNS 🦋
The Proposed Standard [RFC1995] covers using TCP as the fallback transport when Incremental Zone Transfer (IXFR) responses won't fit into a single UDP response. Same as with Authoritative Transfer (AXFR), IXFR messages usually go over TCP by default in real life 🌈
A.4. RFC 1996 - A Mechanism for Prompt Notification of Zone Changes (DNS NOTIFY) 💜
The Proposed Standard [RFC1996] suggests a primary server might decide to send NOTIFY messages over TCP. In practice NOTIFY is mostly sent over UDP, but the spec leaves room for the primary server to pick the transport protocol. So a secondary server ought to be able to work over both UDP and TCP ✨
A.5. RFC 2181 - Clarifications to the DNS Specification 🎀
The Proposed Standard [RFC2181] has clarifying text about how a client should react when the TC bit is set on a response. The advice is to throw that response away and resend the query using TCP 🫶
A.6. RFC 2694 - DNS extensions to Network Address Translators (DNS_ALG) 🧚
The Informational document [RFC2694] lists the things NAT devices should think about to handle DNS traffic properly. It's noteworthy because it says "[t]ypically, TCP is used for AXFR requests," which is more proof of why DNS over TCP has often been treated very differently from DNS over UDP in operational networks 👀
A.7. RFC 3225 - Indicating Resolver Support of DNSSEC 💅
The Proposed Standard [RFC3225] says DNS over TCP is "detrimental" because of more traffic, latency, and server load. This doc is a companion to the next one in the RFC Series, which describes the requirement for EDNS(0) support for DNSSEC 🔥
A.8. RFC 3226 - DNSSEC and IPv6 A6 aware server/resolver message size requirements 🌸
Even though later DNSSEC RFCs updated it, the Proposed Standard [RFC3226] strongly argues for UDP messages instead of TCP, mostly for performance reasons. It declares EDNS(0) a requirement for DNSSEC servers and says packet fragmentation may be preferable to TCP in some situations 🙈
A.9. RFC 4472 - Operational Considerations and Issues with IPv6 DNS 🌈
The Informational document [RFC4472] notes that IPv6 data can make DNS responses bigger than what fits in a UDP message. The really juicy bit, which is less common today than when it was written, is that it mentions implementations that truncate data without setting the TC bit to nudge the client into resending the query over TCP 😭
A.10. RFC 5452 - Measures for Making DNS More Resilient against Forged Answers 💖
The Proposed Standard [RFC5452] came about when public DNS systems started getting seriously abused by spoofed queries, which led to amplification and reflection attacks on unwitting victims. One of the top reasons for supporting DNS over TCP to stop these attacks is briefly covered in Section 9.3 of [RFC5452] ("Spoof Detection and Countermeasure") 🔐
A.11. RFC 5507 - Design Choices When Expanding the DNS 🍓
The Informational document [RFC5507] was mainly trying to talk new DNS data types out of overloading the TXT resource record type. It sums up the conventional wisdom of DNS design and implementation practices. The authors say TCP overhead and stateful properties are challenges compared to UDP, and they imply UDP is generally preferred for performance and robustness 🧠
A.12. RFC 5625 - DNS Proxy Implementation Guidelines 💜
The Best Current Practice document [RFC5625] gives DNS proxy implementation guidance, including the mandate that a proxy "MUST [...] be prepared to receive and forward queries over TCP." Even so, it admits that historically TCP hasn't been strictly mandatory in stub resolvers or recursive servers 🤷♀️
A.13. RFC 5936 - DNS Zone Transfer Protocol (AXFR) 🎀
The Proposed Standard [RFC5936] gives a detailed spec for the zone transfer protocol, based on what the early DNS standards outlined. AXFR is limited to TCP and isn't specified for UDP, and this doc talks about TCP usage at length 📜
A.14. RFC 7534 - AS112 Nameserver Operations 🌊
The Informational document [RFC7534] lists the requirements for operating AS112 project DNS servers. New AS112 nodes get tested for service on both UDP and TCP, which implies TCP service is an expected part of normal operations 🛟
A.15. RFC 6762 - Multicast DNS 🦋
In the Proposed Standard [RFC6762], the TC bit means basically the same thing it does in the original DNS specs. If a response with the TC bit set comes in, "[...] the querier SHOULD reissue its query using TCP in order to receive the larger response." 🫶
A.16. RFC 6891 - Extension Mechanisms for DNS (EDNS(0)) 💅
The Internet Standard [RFC6891] helped slow down the use of, and the need for, DNS-over-TCP messages. This doc also calls out concerns about server load and scalability when DNS over TCP is used widely 📉
A.17. IAB RFC 6950 - Architectural Considerations on Application Features in the DNS 🧚
The Informational document [RFC6950] points out large data in the DNS. TCP shows up in that context as a common fallback mechanism and as a counter to some spoofing attacks 🛡️
A.18. RFC 7477 - Child-to-Parent Synchronization in DNS 💜
The Proposed Standard [RFC7477] defines an RRType and a protocol for signaling and syncing NS, A, and AAAA resource record changes from a child zone to its parent. Since this protocol might need multiple requests and responses, it recommends DNS over TCP so the conversation happens between a consistent pair of end nodes 🤝
A.19. RFC 7720 - DNS Root Name Service Protocol and Deployment Requirements 👑
The Best Current Practice document [RFC7720] says the root name service "MUST support UDP [RFC0768] and TCP [RFC0793] transport of DNS queries and responses." Main character requirement, fr fr 🌟
A.20. RFC 7766 - DNS Transport over TCP - Implementation Requirements 🌸
The Proposed Standard [RFC7766] tells DNS implementors to support carrying DNS-over-TCP messages in their software. It's probably the direct ancestor of this operational requirements document. The implementation requirements doc makes DNS-over-TCP support mandatory in compliant DNS software, but it doesn't make recommendations to operators, which is the gap this document wants to fill 🎀
A.21. RFC 7828 - The edns-tcp-keepalive EDNS(0) Option ⏰
The Proposed Standard [RFC7828] defines an EDNS(0) option for negotiating an idle timeout value on long-lived DNS-over-TCP connections. So this doc only applies to DNS-over-TCP sessions, and only between implementations that support this option 💖
A.22. RFC 7858 - Specification for DNS over Transport Layer Security (TLS) 🔒
The Proposed Standard [RFC7858] defines a way to put DNS messages into a TCP-based encrypted channel using TLS. It's noteworthy because it explicitly targets stub-to-recursive traffic, but it doesn't rule out using it for recursive-to-authoritative traffic too ✨
A.23. RFC 7873 - Domain Name System (DNS) Cookies 🍪
The Proposed Standard [RFC7873] describes an EDNS(0) option that adds extra protection against query and answer forgery. It mentions DNS over TCP as an alternative when DNS cookies aren't available. It also covers DNS-over-TCP processing in two specific situations. First, when a server gets only a client cookie in a request, the server should consider whether the request arrived over TCP. If it did, the server should consider accepting TCP as enough to authenticate the request and respond accordingly. Second, when a client gets a BADCOOKIE reply that uses a fresh server cookie, the client should retry using TCP as the transport 🧁
A.24. RFC 7901 - CHAIN Query Requests in DNS
The Experimental specification [RFC7901] describes an EDNS(0) option that can be used by a security-aware validating resolver to request and obtain a complete DNSSEC validation path for any single query. This document requires the use of DNS over TCP or a transport mechanism verified by a source IP address such as EDNS-COOKIE [RFC7873].
A.25. RFC 8027 - DNSSEC Roadblock Avoidance
The Best Current Practice document [RFC8027] details observed problems with DNSSEC deployment and mitigation techniques. Network traffic blocking and restrictions, including DNS-over-TCP messages, are highlighted as one reason for DNSSEC deployment issues. While this document suggests these sorts of problems are due to "non- compliant infrastructure", the scope of the document is limited to detection and mitigation techniques to avoid so-called DNSSEC roadblocks.
A.26. RFC 8094 - DNS over Datagram Transport Layer Security (DTLS)
The Experimental specification [RFC8094] details a protocol that uses a datagram transport (UDP) but stipulates that "DNS clients and servers that implement DNS over DTLS MUST also implement DNS over TLS in order to provide privacy for clients that desire Strict Privacy [...]." This requirement implies DNS over TCP must be supported in case the message size is larger than the path MTU.
A.27. RFC 8162 - Using Secure DNS to Associate Certificates with Domain Names for S/MIME
The Experimental specification [RFC8162] describes a technique to authenticate user X.509 certificates in an S/MIME system via the DNS. The document points out that the new experimental resource record types are expected to carry large payloads, resulting in the suggestion that "applications SHOULD use TCP -- not UDP -- to perform queries for the SMIMEA resource record."
A.28. RFC 8324 - DNS Privacy, Authorization, Special Uses, Encoding, Characters, Matching, and Root Structure: Time for Another Look?
The Informational document [RFC8324] briefly discusses the common role and challenges of DNS over TCP throughout the history of DNS.
A.29. RFC 8467 - Padding Policies for Extension Mechanisms for DNS (EDNS(0))
The Experimental document [RFC8467] reminds implementors to consider the underlying transport protocol (e.g., TCP) when calculating the padding length when artificially increasing the DNS message size with an EDNS(0) padding option.
A.30. RFC 8482 - Providing Minimal-Sized Responses to DNS Queries That Have QTYPE=ANY
The Proposed Standard [RFC8482] describes alternative ways that DNS servers can respond to queries of type ANY, which are sometimes used to provide amplification in DDoS attacks. The specification notes that responders may behave differently, depending on the transport. For example, minimal-sized responses may be used over UDP transport, while full responses may be given over TCP.
A.31. RFC 8483 - Yeti DNS Testbed
The Informational document [RFC8483] describes a testbed environment that highlights some DNS-over-TCP behaviors, including issues involving packet fragmentation and operational requirements for TCP stream assembly in order to conduct DNS measurement and analysis.
A.32. RFC 8484 - DNS Queries over HTTPS (DoH)
The Proposed Standard [RFC8484] defines a protocol for sending DNS queries and responses over HTTPS. This specification assumes TLS and TCP for the underlying security and transport layers, respectively. Self-described as a technique that more closely resembles a tunneling mechanism, DoH nevertheless likely implies DNS over TCP in some sense, if not directly.
A.33. RFC 8490 - DNS Stateful Operations
The Proposed Standard [RFC8490] updates the base protocol specification with a new OPCODE to help manage stateful operations in persistent sessions, such as those that might be used by DNS over TCP.
A.34. RFC 8501 - Reverse DNS in IPv6 for Internet Service Providers
The Informational document [RFC8501] identifies potential operational challenges with dynamic DNS, including denial-of-service threats. The document suggests TCP may provide some advantages but that updating hosts would need to be explicitly configured to use TCP instead of UDP.
A.35. RFC 8806 - Running a Root Server Local to a Resolver
The Informational document [RFC8806] describes how to obtain and operate a local copy of the root zone with examples showing how to pull from authoritative sources using a DNS-over-TCP zone transfer.
A.36. RFC 8906 - A Common Operational Problem in DNS Servers: Failure to Communicate
The Best Current Practice document [RFC8906] discusses a number of DNS operational failure scenarios and how to avoid them. This includes discussions involving DNS-over-TCP queries, EDNS over TCP, and a testing methodology that includes a section on verifying DNS- over-TCP functionality.
A.37. RFC 8932 - Recommendations for DNS Privacy Service Operators
The Best Current Practice document [RFC8932] presents privacy considerations to DNS privacy service operators. These mechanisms sometimes include the use of TCP and are therefore susceptible to information leakage such as TCP-based fingerprinting. This document also references an earlier draft version of this document.
A.38. RFC 8945 - Secret Key Transaction Authentication for DNS (TSIG)
The Internet Standard [RFC8945] recommends that a client use TCP if truncated TSIG messages are received.
Acknowledgments
This document was initially motivated by feedback from students who pointed out that they were hearing contradictory information about filtering DNS-over-TCP messages. Thanks in particular to a teaching colleague, JPL, who perhaps unknowingly encouraged the initial research into the differences between what the community has historically said and did. Thanks to all the NANOG 63 attendees who provided feedback for an early talk on this subject.
The following individuals provided an array of feedback to help improve this document: Joe Abley, Piet Barber, Sara Dickinson, Tony Finch, Bob Harold, Paul Hoffman, Geoff Huston, Tatuya Jinmei, Puneet Sood, and Richard Wilhelm. The authors are also indebted to the contributions stemming from discussion in the TCPM Working Group meeting at IETF 104. Any remaining errors or imperfections are the sole responsibility of the document authors.
Authors' Addresses
John Kristoff Dataplane.org Chicago, IL 60605 United States of America Phone: +1 312 493 0305 Email: jtk@dataplane.org URI: https://dataplane.org/jtk/
Duane Wessels Verisign 12061 Bluemont Way Reston, VA 20190 United States of America Phone: +1 703 948 3200 Email: dwessels@verisign.com URI: https://verisign.com
📦 where this page comes from
- ietf: rfc9210 2022-03
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms