IETF Logo Mail Archive

[DNSOP] Re: PQ DNSSEC?

Tommy Jensen <tojens.ietf@gmail.com> Mon, 20 July 2026 14:43 UTC

Return-Path: <tojens.ietf@gmail.com>
X-Original-To: dnsop@mail2.ietf.org
Delivered-To: dnsop@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id E92DB11A807CD for <dnsop@mail2.ietf.org>; Mon, 20 Jul 2026 07:43:11 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1784558591; bh=ScFiHw3pk2dUS4OEgReETP2mgb87a+lOCHMTk7fQths=; h=References:In-Reply-To:From:Date:Subject:To:Cc; b=Ln1ZNOxAGra8jtBi1PtYTVSz0Le7MjDaaPtgepEcGEYpgacBuAzOZ11HLuep+g7W4 U6+fMF62yaoY6ssBg111hEVY4S1//n5VKiAmDZUPsd4vdsEIGOu29nt/Lq2uanRAaW 0HCC9RVnpus2fHynqek2oWzomy4wy/aQaNgr2gKY=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v_b3FDwsXmAg for <dnsop@mail2.ietf.org>; Mon, 20 Jul 2026 07:43:11 -0700 (PDT)
Received: from mail-pf1-x430.google.com (mail-pf1-x430.google.com [IPv6:2607:f8b0:4864:20::430]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 7DAF511A807C6 for <dnsop@ietf.org>; Mon, 20 Jul 2026 07:43:11 -0700 (PDT)
Received: by mail-pf1-x430.google.com with SMTP id d2e1a72fcca58-84862b0d5aeso11083711b3a.2 for <dnsop@ietf.org>; Mon, 20 Jul 2026 07:43:11 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1784558585; cv=none; d=google.com; s=arc-20260327; b=mUWBSEgHsyl2odLj0g5fyG4P1e3EBHZaQKcnmCo5oqcjyWPzc3KEUnSNLvcEqe38hM XBejhRKIsvS2kY+zOjPU5kxJGd5waCrfNx5p4tZ2wVQLhTpI/pceOjdTnX3g3fic1f/O WkLDwy1HNHwktbouQqoza4EcvqF74rZAwNTjBH2Anv52DVrZjJHINk3q94OIW6G1Z2bK BXe1n0icI6qj1d5UqWYZqzI+B7rFLYarQiaXfX6O4wff7IHS96owQO2ebv+cPq8GNRY5 OopV3+Q6iX6nnQ0JuBOFDCTgENUrk0Skq2ujaICspCSSCjhAO1CTu7yHEJZQKYurcokg XyTQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:dkim-signature; bh=QxqGNY+zlkxUusYdmtKIrKJfs0WBPXMon2bWljZC0RY=; fh=/zqpSW48rCbQCLvzt94YR3R54mdFQ2c6c1fRRTwbIdo=; b=pGM+cP78pnt+roz0qGlgmpg+3A5tDZFSDQ3KONQHHBmrH4w2zkhLdkttbQbzvU0kIK 02bpnyYTvIyUy15NiEx6hPPL/rJKuFPFCV/CvMd0k9lQR7VC2idNmHasrb6qavqPIucx lWjPK01P0KZElV84dy6YzNtxngZ7sA4ep2qdGpSuaJVNMlhmpHLVOX9NCRCd4OqdN6Xr 9vrKl/6+nPELmOt7shvLE7EPciOLIzDL7uj+UvjEbIXaX6ULpjJQO97jomI5mM5RNfpR XBApfjg6JASFcBaQvSccBkS8NjTabSO6j8jfq2zieM5bZGIhJSsCKB2Xk8xautq8+h78 xNfQ==; darn=ietf.org
ARC-Authentication-Results: i=1; mx.google.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784558585; x=1785163385; darn=ietf.org; h=content-type:cc:to:subject:message-id:date:from:in-reply-to :references:mime-version:from:to:cc:subject:date:message-id:reply-to :content-type; bh=QxqGNY+zlkxUusYdmtKIrKJfs0WBPXMon2bWljZC0RY=; b=cSurAIL6Zg04vBINXE4mdCzEPitga8FDjCC4ESNnLay04yUeXcvPxlOdy9C0c1vlnk XetFQmMPVa9gIg0a6uEP+h7ddzIL5K5W2NLCBJ29nCeXXlEgqLhk5WTJPWBpm7Vww0l1 zaNOCUFz1BNmVXj0zcxESvNdJTP0Wjdtvl7oo46CvPV0Oe/8smzi+tHT/Jpl7pBQeONP jVHUm06xJ0WLReMWWuhIJVDSp9thAshjHK+v/ZEKKOfmyquX4cHRENU4j3ormtWIRdXv Ky0BPHwFhEue8VTSGme5J4rn2vc+qaaKCmShWhaKEfFcfpM5DB55RrPZnRqW9HDyCURR el5w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784558585; x=1785163385; h=content-type:cc:to:subject:message-id:date:from:in-reply-to :references:mime-version:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to:content-type; bh=QxqGNY+zlkxUusYdmtKIrKJfs0WBPXMon2bWljZC0RY=; b=c1cbTL9Vw5vScPU70cDX0k8L8JX3FqLBinLnf5VXKMlZCMMhfL+KNHfL1Ua8kKZao9 C85Dp48fDPkZpL0Mp3XVrbx7YT9/8vuiHWqkuRVQMU6SsL+tWMUMwnp4hDgl6smAyK9V oL/HwOrwYiJ2OnA/FyHS7bI3D5NrlPLkyXhgj6EOJMeIAgS/VsKHWWisq8diHVybPJOu n2fd4LGZySJLKyCaQKrdkYng7PMU1lcuL+HxFWrWBVlCN3rj9/nJaDBaqZu5Khy7O8Nz 3oiW3BoqLsFm7Y8QT4tOLXRzsz60OJO3aeEaoTZqtJRObACvshPXFSht9D3672HYI6Da qGZw==
X-Forwarded-Encrypted: i=1; AHgh+Rq55DxxH45mSVOaP8fX5OoW7ZOpOpXW9Co+VSWhNYk10nRgic0SNW0yFz83Ep+UYJwS4K7IYA==@ietf.org
X-Gm-Message-State: AOJu0YweZFPqDLIh4e3Cj18Hk43YM0vkOLl1DuWySRguQHfzsO+Uf8Mr e6XF4ZfxKRx9F8v7IKZ+cr799gjK6/E6edWNUpWB2C94DaeIywrsA11Xt5kGapQp0yRbBWR0Y1m qJW/3EKOnFrdWm0JQOqlq97AJqyeyuAA=
X-Gm-Gg: AfdE7ck7fPwv7H+AkhoUul820sxGT80/+5MB7HSCG85310jS0HReJoigQ9JhSYs1ZVc 9/9e+kHKa94i1cgDoYjwmN9RLXUOOH86XpTM4m3U+0lROZOf+MKJBXh8INj+Hokxmxacaim+GlH Paa3+n+wKtHGai7/kONYgs6e5YEBw3pPOTPOm+ZiSSwY5DYah0rZj+WvlCrwNa7QGM3ev/dhKFH SmUaraxYeh5rfqAmf1gfqzr8pRxDIThEynAflcdZTfn8Pc/Jqbp2ICo3zMX5tWuhY0PhqasNGRt SqKU+Bnbi5/TirQpiRNrZsIBaHhs1KiC2x30k3dujLbG1TSrL/vEXfSNSw==
X-Received: by 2002:a05:6a00:94e8:b0:845:4928:8655 with SMTP id d2e1a72fcca58-84c294d0b5amr14446039b3a.39.1784558584385; Mon, 20 Jul 2026 07:43:04 -0700 (PDT)
MIME-Version: 1.0
References: <CAMjbhoWSTwExS1+gJkijLQxD+9koO7dtO=Cdf6DCem=MqKhK6g@mail.gmail.com> <CAHPuVdXFfagALrdDf+i9J+FuFQKtij0C46qkMnkow62ghZM7sg@mail.gmail.com> <CAHw9_iJ1HM_59jiTv7qSuMmWXFhqz7JX+rkLTB_zcm5xoJdexQ@mail.gmail.com> <E8D0CA62-8E8E-4EEA-AA09-F2ED09B50CD9@verisign.com>
In-Reply-To: <E8D0CA62-8E8E-4EEA-AA09-F2ED09B50CD9@verisign.com>
From: Tommy Jensen <tojens.ietf@gmail.com>
Date: Mon, 20 Jul 2026 16:42:53 +0200
X-Gm-Features: AUfX_my7Gefl8sQBilL3LXGOiAiFBq-iEkBS44gddUH4MWThm0g5NmClgLpQ_Ew
Message-ID: <CABDV=UO=Jr9fPQ36-MShKw97AmP5AqTJxEwnPt89bPDR7iHmZw@mail.gmail.com>
To: "Wessels, Duane" <dwessels=40verisign.com@dmarc.ietf.org>
Content-Type: multipart/alternative; boundary="00000000000080d44d06570bec2c"
Message-ID-Hash: XD22V6AQXG5MWC5CHP5D6U3WQX3OOHTN
X-Message-ID-Hash: XD22V6AQXG5MWC5CHP5D6U3WQX3OOHTN
X-MailFrom: tojens.ietf@gmail.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-dnsop.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: "dnsop@ietf.org" <dnsop@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [DNSOP] Re: PQ DNSSEC?
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/MIrixXYByiVTC4kuEDuQInMyTfA>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Owner: <mailto:dnsop-owner@ietf.org>
List-Post: <mailto:dnsop@ietf.org>
List-Subscribe: <mailto:dnsop-join@ietf.org>
List-Unsubscribe: <mailto:dnsop-leave@ietf.org>

(no hats)

FYI there was previous discussion on the topic of not using UDP 53 after
someone wrote an controversial draft about saying future documents need not
accommodate its use. Similar points were raised there as well.

Draft:
https://datatracker.ietf.org/doc/draft-tojens-dnsop-do-not-accommodate-udp53/

Mailing list discussion:
https://mailarchive.ietf.org/arch/search/?q=%22draft-tojens-dnsop-do-not-accommodate-udp53%22

On Mon, Jul 20, 2026 at 4:36 PM Wessels, Duane <dwessels=
40verisign.com@dmarc.ietf.org> wrote:

>
>
> > On Jul 20, 2026, at 3:47 PM, Warren Kumari <warren@kumari.net> wrote:
> >
> > I don't really think it is so much "clients that can't fall back to
> > TCP..." (although they do exist), it is more "concerns around scale of
> > clients falling back to TCP". There is some belief that some / many
> > TLDs and auths will become overloaded if all recursive resolvers fall
> > back to TCP[0]. TCP is also noticeably slower, even if you do
> > pipelineing, presistance, etc., etc.
>
> When Verisign transitioned from RSA to ECDSA using double-signing,
> the size of signed NXDOMAIN responses exceeded 1500 bytes.  We observed
> quite
> a few resolver clients that were unable to fall fall back to TCP.  We know
> this because they very aggressively retried over UDP.
>
> Slide 10 of
> https://indico.dns-oarc.net/event/48/contributions/1036/attachments/1004/1920/challenges-truncation-tcp-combined%20v2.pdf
> shows some data on an “experiment” we did prior to the algorithm
> transition.
>
> So its not just about more TCP load, but also about more UDP load
> due to futile retries.
>
> Slide 20 of
> https://indico.dns-oarc.net/event/48/contributions/1043/attachments/1003/1927/wessels-verisign-algrolls.pdf
> shows that truncation rates were about 3x of TCP rates during the algorithm
> transition.
>
> DW
>
>
> _______________________________________________
> DNSOP mailing list -- dnsop@ietf.org
> To unsubscribe send an email to dnsop-leave@ietf.org
>

v2.46.0 | Report a Bug | By Email | System Status