[DNSOP] Re: Is DELEXT too restrictive?

[Philip Homburg <[e-mail]>]

> As a rough estimate, a single NS record adds about 22 octets,
> depending on the target name and the available compression pointers.
> An A record adds 16 octets, and an AAAA record adds 28 octets. This
> gives approximately: 38 octets for an NS/A combination and 66 octets
> for an NS/A/AAAA combination.
> 
> A quick histogram of todays .com zone (roughly 165 million delegations)
> gives the following distribution of name server counts per delegation:
> NS count.    Delegation 1                  34939 2
> 128486053 3                  10046108 4                  22644556
> 5                  1702108 6                  539256 7
> 203418 8                  1433091 9                  3591 10
> 7488 11                838 12                14183 13
> 595
> 
> The largest group is therefore roughly 128 million delegations, or
> 78%, with two name servers. For those delegations, retaining NS
> records and any required IPv4 glue would add about 76 octets, or
> about 132 octets where both IPv4 and IPv6 glue are present for each
> name server.
> 
> The next-largest group is roughly 22 million delegations, or 13%,
> with four name servers. The corresponding increase would be about
> 152 octets with IPv4 glue, or about 264 octets with both IPv4 and
> IPv6 glue.
> 
> Im not convinced that omitting NS and glue when DE=1 is a worthwhile
> optimisation. It does not appear to provide a clear benefit to the
> resolver, the operator, or the domain holder, while it introduces
> different referral behaviour depending on whether DE is set.

We have look at this in the context of ADoX. How big are multiple DELEG
records if they also include TLSA and other TLS related params? Plus NSEC(3)
and RRSIGs.

This is an issue for TLDs and the root. If we push too many delegations over
the edge then a lot of requests will be retried over TCP.

Software doesn't care. So I'll leave it to operators to speak up.