IETF Logo Mail Archive

[DNSOP] Re: PQ DNSSEC?

"Wessels, Duane" <dwessels@verisign.com> Mon, 20 July 2026 14:35 UTC

Return-Path: <dwessels@verisign.com>
X-Original-To: dnsop@mail2.ietf.org
Delivered-To: dnsop@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 747B311A7E858 for <dnsop@mail2.ietf.org>; Mon, 20 Jul 2026 07:35:52 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1784558152; bh=g0xaYKDz0yMwIDpGAWkVxsZmvxW1jFIy0rj/yoIu70A=; h=Subject:From:To:Date:References:In-Reply-To; b=jsHlgHxWYpJUNlLg4TkqRVq83ble+AHC55VJpU0Xtn2HxxOoHIXFLWoSBG/ONioBg OR6I5CZdWoq3kn7DeolkGrSNCUTvhdxg3R4trQo6EdShEO0nggWhOWiqR39u4WJaGh 62PdoJvqMtfQt32frAvBWW3Xfi9vK8NnMYx9sy3E=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -4.396
X-Spam-Level:
X-Spam-Status: No, score=-4.396 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=verisign.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ct8EdsSwjmMi for <dnsop@mail2.ietf.org>; Mon, 20 Jul 2026 07:35:52 -0700 (PDT)
Received: from mail4.verisign.com (mail4.verisign.com [69.58.187.30]) by mail2.ietf.org (Postfix) with ESMTP id A394E11A7E7DA for <dnsop@ietf.org>; Mon, 20 Jul 2026 07:35:48 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=verisign.com; l=7246; q=dns/txt; s=VRSN; t=1784558148; h=from:to:date:message-id:references:in-reply-to: mime-version:subject; bh=g0xaYKDz0yMwIDpGAWkVxsZmvxW1jFIy0rj/yoIu70A=; b=ZOpDIMymJKSsulUaEig+62XnLIHKKpJgM47+ke4jk/vO1YB8izlijAYp woJbZ28WO9qnJmtcbKxXWCCdZo/HcrFZScateefmsVGrKhC35D9B4v744 OCXCGzc3S++7D7FqADU7aI15WFzXcV6T5ppUDAxgCLSjGknQEMwxnwdow gsOJSVQkIyETN5/sPzzSt/YXF/JFT+NafdIVK8bfr8AZX8Kkovy+dB5mw +bSVzKel8d0KyW3HG7+nmYmsklcc0NtQe9V05gzXZi2RNA/fFpVrSbEmJ GQWGCUC5xtTfbyWVDEGpjRYkz5Z4GGloDia3P3x+zrE724T+KxcxXFl0Q w==;
X-CSE-ConnectionGUID: 22sElLBMThORkinjMv6z6g==
X-CSE-MsgGUID: 8iovxz1rSlakXpk4zrEYYA==
X-URL-LookUp-ScanningError: 1
X-ThreatScanner-Verdict: Negative
IronPort-Data: A9a23:nAHOlaAWvuUqkhVW/9Xjw5YqxClBgxIJ4kV8jC+edVH5lGZ7hGRDl z1BRindabyNfyGsLIcnLMj0oHqyi+aWk48+HRwsqmoFoxli8MDJXo3GdhqpNH+fIJPIFBo+t 55GMdSYcc5lFC+M/kvyaLW98igsjfDTTbf2V+WZYS59HVA0Eyl+2Rkyw+Aw0+aE7fCwGxuJu Nj7v8zYPhi92DVvbScP6q2FoQ9ypvmaVBYw5zTSMtgX5AaB/5VsMLofOb2pfTy/RYJPBqi2R unCx7yj4iXS+BJ1IZD9GF4zLU0WXqaAegOHgXdMR7PkjhlNpyc/yLp9P/0ZLmtWhDSikspt4 c5WqIa9RSYFBKrLhMtHFRJCD3lTAMV6FMT8zQSCjOST01HeITyrxP51FAc6PIIZ8ettHSdF8 vlAFnNV5PhLpeKq3KrpDeJljck5MNKtMIIQu3pt1y2fBvEjBrzCTKTh6MVE9Swrm9pDEdmEX O84TBdVVz2cO0wRAXc+U8Jixr/y2lLWKntTsk7NzZbbmFM/sDFM7YXQ3Prplv2iSM4FxxuWq DnKoj6pWEoUOIbAkWLfrC+m2+WUl3OiVotOTe3p/fNU21DCnWZ75D/697eYiaLg1hPhAYI3x 2g8oHdGQX0arRTzJjXFd0Tm5ibC4lhEAoQ4/9QSsGml0rDT7xuSGl8KRztAbM1OnMItTFTG7 HfQ9z/SLWIp6uD9pU61rO/O82vtY3BNcAfuWAdfJec7y4i7yG0Mpk+XJjpTOPbdpsH4Hzj23 weLoEAW750PjdQG3rmM5lvOhTShvPDhFmbZMS2OAwpJRisgDGKUT9TABWrztJ6sH67AJrW1h 0XoruDFhAw4JcrUyHHSGrVl8IaBvJ5pOBWE6bJmN8d5q2T1oxZPd6gIiN11DB8B3srp5VYFy aIc0O9czMY7AZekUUN4S9jrEOku6YLFKdTCbPPVaNhrfMZjKgDSqUmCZWbIt4zsuG0NtY5mB rG2QZ72S2gRDr5/ijO6AfkHyrltzSc7rY/RbcmjiU77j/zHOSTTE+xt3FimN4jV6IuIvwjO6 NtbLOOUxg9eS+zxZG/c9ot7wVUicSdgWsyq+pw/muircgthBnEzUuXqxboiS5Rmw7ZPu9b51 yToMqNf4B+l7ZHdEi2VY2p5ZbXHXot6pGg6eyohIT6A1344Zp6H7aoDed0wZ7ZPyQB45ft1S /ZcZMONEqwVDy/Z4W1baJjm6YZlMhWvilvIITC+Zn40eJsIqxH1x+IItzDHrEEmZhdbf+Nny 1F8/ms3maY+ejk=
IronPort-HdrOrdr: A9a23:zuHtK6OWsgAMMsBcThyjsMiBIKoaSvp037BN7TEVdfU1SL37qy nAppQmPHPP5gr5O0tOpTnoAsDpfZq2z+8X3WB+B9afdTijlmeuIJpr8IfuhxbxcheTysdtkY NtabJ3BtG1L1Rr5PyR3CCIV/It2sOO/qztv/rZ1HsFd2xXQrtt9Bh0ETyWFUBKRA1LbKBTKK ah
X-Talos-CUID: 9a23:QOz+dmoWBs21q1TbeS/vCHjmUZp/aVDZ6F31H0+fM2VoTr+wVwGCpqwxxg==
X-Talos-MUID: 9a23:WFSB5wvBkKyAE6RLAM2n1DBlKtd6ur6VDEkOoY0F59ueGB1BEmLI
X-IronPort-AV: E=Sophos;i="6.25,174,1779148800"; d="p7s'346?scan'346,208,346";a="47374498"
Received: from MILG1WNEX01.vcorp.ad.vrsn.com (10.246.152.21) by MILG1WNEX02.vcorp.ad.vrsn.com (10.246.152.23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.43; Mon, 20 Jul 2026 10:35:41 -0400
Received: from MILG1WNEX01.vcorp.ad.vrsn.com ([10.246.152.21]) by MILG1WNEX01.vcorp.ad.vrsn.com ([10.246.152.21]) with mapi id 15.02.2562.043; Mon, 20 Jul 2026 10:35:41 -0400
From: "Wessels, Duane" <dwessels@verisign.com>
To: Warren Kumari <warren@kumari.net>, "dnsop@ietf.org" <dnsop@ietf.org>
Thread-Topic: [EXTERNAL] [DNSOP] Re: PQ DNSSEC?
Thread-Index: AQHdGEE2uzbTIXRCEkWYfgEeddz6pLZ2rzwAgAANV4A=
Date: Mon, 20 Jul 2026 14:35:41 +0000
Message-ID: <E8D0CA62-8E8E-4EEA-AA09-F2ED09B50CD9@verisign.com>
References: <CAMjbhoWSTwExS1+gJkijLQxD+9koO7dtO=Cdf6DCem=MqKhK6g@mail.gmail.com> <CAHPuVdXFfagALrdDf+i9J+FuFQKtij0C46qkMnkow62ghZM7sg@mail.gmail.com> <CAHw9_iJ1HM_59jiTv7qSuMmWXFhqz7JX+rkLTB_zcm5xoJdexQ@mail.gmail.com>
In-Reply-To: <CAHw9_iJ1HM_59jiTv7qSuMmWXFhqz7JX+rkLTB_zcm5xoJdexQ@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
x-mailer: Apple Mail (2.3864.600.51.1.1)
x-originating-ip: [10.170.148.18]
Content-Type: multipart/signed; boundary="Apple-Mail=_1C737D2F-A4C8-43A4-89D4-81AB8C5EEE9B"; protocol="application/pkcs7-signature"; micalg="sha-256"
MIME-Version: 1.0
Message-ID-Hash: 5IEPV6KBRMKFVQV2DWXEWASVB7P3N7OB
X-Message-ID-Hash: 5IEPV6KBRMKFVQV2DWXEWASVB7P3N7OB
X-MailFrom: dwessels@verisign.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-dnsop.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [DNSOP] Re: PQ DNSSEC?
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/_GayxgYJ3uCI16bBurS931PaInQ>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Owner: <mailto:dnsop-owner@ietf.org>
List-Post: <mailto:dnsop@ietf.org>
List-Subscribe: <mailto:dnsop-join@ietf.org>
List-Unsubscribe: <mailto:dnsop-leave@ietf.org>


> On Jul 20, 2026, at 3:47 PM, Warren Kumari <warren@kumari.net> wrote:
> 
> I don't really think it is so much "clients that can't fall back to
> TCP..." (although they do exist), it is more "concerns around scale of
> clients falling back to TCP". There is some belief that some / many
> TLDs and auths will become overloaded if all recursive resolvers fall
> back to TCP[0]. TCP is also noticeably slower, even if you do
> pipelineing, presistance, etc., etc.

When Verisign transitioned from RSA to ECDSA using double-signing,
the size of signed NXDOMAIN responses exceeded 1500 bytes.  We observed quite
a few resolver clients that were unable to fall fall back to TCP.  We know
this because they very aggressively retried over UDP.  

Slide 10 of https://indico.dns-oarc.net/event/48/contributions/1036/attachments/1004/1920/challenges-truncation-tcp-combined%20v2.pdf
shows some data on an “experiment” we did prior to the algorithm transition.

So its not just about more TCP load, but also about more UDP load
due to futile retries.

Slide 20 of https://indico.dns-oarc.net/event/48/contributions/1043/attachments/1003/1927/wessels-verisign-algrolls.pdf
shows that truncation rates were about 3x of TCP rates during the algorithm
transition.

DW

v2.46.0 | Report a Bug | By Email | System Status