RFC 3226 (rfc3226) - Page 2 of 6
DNSSEC and IPv6 A6 aware server/resolver message size requirements
Alternative Format: Original Text Document
RFC 3226 DNSSEC and IPv6 A6 requirements December 2001 server also needs to keep a state of the connection during this transaction. Many DNS servers answer thousands of queries per second, requiring them to use TCP will cause significant overhead and delays. 1.1. Requirements The key words "MUST", "REQUIRED", "SHOULD", "RECOMMENDED", and "MAY" in this document are to be interpreted as described in RFC 2119. 2. Motivating factors 2.1. DNSSEC motivations DNSSEC [RFC 2535] secures DNS by adding a Public Key signature on each RR set. These signatures range in size from about 80 octets to 800 octets, most are going to be in the range of 80 to 200 octets. The addition of signatures on each or most RR sets in an answer significantly increases the size of DNS answers from secure zones. For performance reasons and to reduce load on DNS servers, it is important that security aware servers and resolvers get all the data in Answer and Authority section in one query without truncation. Sending Additional Data in the same query is helpful when the server is authoritative for the data, and this reduces round trips. DNSSEC OK[OK] specifies how a client can, using EDNS0, indicate that it is interested in receiving DNSSEC records. The OK bit does not eliminate the need for large answers for DNSSEC capable clients. 2.1.1. Message authentication or TSIG motivation TSIG [RFC 2845] allows for the light weight authentication of DNS messages, but increases the size of the messages by at least 70 octets. DNSSEC specifies for computationally expensive message authentication SIG(0) using a standard public key signature. As only one TSIG or SIG(0) can be attached to each DNS answer the size increase of message authentication is not significant, but may still lead to a truncation. 2.2. IPv6 Motivations IPv6 addresses [RFC 2874] are 128 bits and can be represented in the DNS by multiple A6 records, each consisting of a domain name and a bit field. The domain name refers to an address prefix that may require additional A6 RRs to be included in the answer. Answers where the queried name has multiple A6 addresses may overflow a 512- octet UDP packet size. Gudmundsson Standards Track
