IETF Logo Mail Archive

[DNSOP] Re: PQ DNSSEC?

Stefan Ubbink <stefan.ubbink@sidn.nl> Tue, 21 July 2026 05:26 UTC

Return-Path: <stefan.ubbink@sidn.nl>
X-Original-To: dnsop@mail2.ietf.org
Delivered-To: dnsop@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 3B96F11B00255 for <dnsop@mail2.ietf.org>; Mon, 20 Jul 2026 22:26:49 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1784611609; bh=zIjKHKT8Wd8kMixOdFFzWZsEZenwjacgPDCrEoYkOIg=; h=Date:From:To:Cc:Subject:In-Reply-To:References; b=gAJJN5rw8R1mPr3hpDWsnW+wejB+6lmWMygknB+2FKsRLku98BnIDgSdbPMx0RziY 0Ewk5itQVs89ub/vzWyrNd6hCbZQ0xz087uan/y8jC4cQefh1yET00OqgdShpQWoe7 8fPyrk26ssgTTQ/uZEjfxlu4+QzQcYq2jRJ6WAvA=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (1024-bit key) header.d=sidn.nl
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v-BprXHSENDV for <dnsop@mail2.ietf.org>; Mon, 20 Jul 2026 22:26:48 -0700 (PDT)
Received: from PA4PR04CU001.outbound.protection.outlook.com (mail-francecentralazon11023077.outbound.protection.outlook.com [40.107.162.77]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 96F5A11B00246 for <dnsop@ietf.org>; Mon, 20 Jul 2026 22:26:47 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=uWZGBnSOw9Og+WgqbDDyYishKYyhp8A70UnxjOuOOkZ+M6Ndu2GoqBoJiaoD6S/4bmLm9pCto2XmKhN/HHhlWAaPAE+qd0791HOp5imN6U6Bx5eUAaBM/e59UNO2VFP53xQWsYE1EDhq3fQSlnir0o31aNbVyEiRqI/lv8Mv1PjRj3y2U/DUNobyhDxXibCRwged4OEqEDPwoHbdZkDVLmXDCxh2mKpBKnW5UaxWLBV95BcBOqpfGIHcQT5p/usPUEMqoe2ewuLD/hS1P3P2uS7PwOAv1V2iS4EpeWGZAnxUaSqnOCwDxmwGaRJVmX8ZkzDQLW1qzMUuF/dNQH0YZg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=q3j4tnb/j0//jFcIXMGL55q6Fm/WBxVR4lrWe2Tx4dY=; b=vWpIm26E+K/UzxNSG50/tj8NA54NbxFdB/m+cR+7gyrSXKsbqYWjXDO19yXj0Xx+i92NCgDPdjiJkdfsdAGPf5WYYCTQd7A6yd5vSSr/WfxyFFYU7tiG7DeVTSfbWW8ivaTxun8w7CJ4CrAmb+h3n9AjA9MUnPvCBCV/FPr87ttWTeRffGo8Lh9UqJOt1YNwhrqi2XSDLoJJ9mjUuKStIMLQRYFVgvQB493ChmtpZWEQ5obZ/mLEv4FYlycZEQGBHo2f3PvCp7flwx4heWXyyFTbXSUKmELu6BvVGeVR4+u2t0HCp855Ig85dPWnbf5qxW5BOob0OxLeaNfZT8lvyg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=sidn.nl; dmarc=pass action=none header.from=sidn.nl; dkim=pass header.d=sidn.nl; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sidn.nl; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=q3j4tnb/j0//jFcIXMGL55q6Fm/WBxVR4lrWe2Tx4dY=; b=DfiJcel4l+9r29nLhBLA1SBMeXjA7HIZ0r4OaXPi9GmUAnjwKT/OzF7uRAy9RpOReVb+eAvTSb2KFsXy0wqwIccnrEVOWpYWrGU/xL/GbyjiN2jn6zETr1TRwVs41C1ZVlmjTpKDwwkagOtV9JL//R5Duv9DsQ304UL18ovlqec=
Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=sidn.nl;
Received: from DB9P194MB1242.EURP194.PROD.OUTLOOK.COM (2603:10a6:10:291::10) by PAVP194MB2086.EURP194.PROD.OUTLOOK.COM (2603:10a6:102:2fe::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.18; Tue, 21 Jul 2026 05:26:38 +0000
Received: from DB9P194MB1242.EURP194.PROD.OUTLOOK.COM ([fe80::8631:e850:a438:5775]) by DB9P194MB1242.EURP194.PROD.OUTLOOK.COM ([fe80::8631:e850:a438:5775%6]) with mapi id 15.21.0245.009; Tue, 21 Jul 2026 05:26:38 +0000
Date: Tue, 21 Jul 2026 07:26:34 +0200
From: Stefan Ubbink <stefan.ubbink@sidn.nl>
To: "Wessels, Duane" <dwessels=40verisign.com@dmarc.ietf.org>
Message-ID: <20260721072634.7a3b8cab@860-09-011.sidn.nl>
In-Reply-To: <E8D0CA62-8E8E-4EEA-AA09-F2ED09B50CD9@verisign.com>
References: <CAMjbhoWSTwExS1+gJkijLQxD+9koO7dtO=Cdf6DCem=MqKhK6g@mail.gmail.com> <CAHPuVdXFfagALrdDf+i9J+FuFQKtij0C46qkMnkow62ghZM7sg@mail.gmail.com> <CAHw9_iJ1HM_59jiTv7qSuMmWXFhqz7JX+rkLTB_zcm5xoJdexQ@mail.gmail.com> <E8D0CA62-8E8E-4EEA-AA09-F2ED09B50CD9@verisign.com>
Organization: SIDN
X-Mailer: Claws Mail 4.4.0git3 (GTK 3.24.41; x86_64-pc-linux-gnu)
X-ms-reactions: disallow
Content-Type: multipart/signed; boundary="Sig_/73jTmIy=_rzKZ/Fzx3rYzRd"; protocol="application/pgp-signature"; micalg="pgp-sha256"
X-ClientProxiedBy: AM9P195CA0016.EURP195.PROD.OUTLOOK.COM (2603:10a6:20b:21f::21) To DB9P194MB1242.EURP194.PROD.OUTLOOK.COM (2603:10a6:10:291::10)
MIME-Version: 1.0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: DB9P194MB1242:EE_|PAVP194MB2086:EE_
X-MS-Office365-Filtering-Correlation-Id: 235fe82d-91f5-45b6-1b0f-08dee6e8a332
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;ARA:13230040|19092799006|1800799024|23010399003|376014|366016|10070799003|22082099003|18002099003|56012099006|11063799006|10067099003|4143699003;
X-Microsoft-Antispam-Message-Info: xLMJYpag4ML/x2eXB3JQVRvLWC/C0lZS0uTHllNqDasBknjfn7FMiIKX2LCzj6Vw/xI4BXmRDFy8Z8IlYV6zeQVHisMjDi9uJtwzUhnEg0bqRASzisHoXlrovl0GFEEq9V15uxWP2NtkMzmCKmgyoVg8BAxT2XP+Uv2XDr+32PjHiPEBYKta3Psk7xlvaCfjUhP709wF4nVBnCpiMW2rL6+Z/yBdRy5orO6oHorH3Z/wUGxO2DQRWSPDOnIgwRJBtcFBbXuEKTsoufWhoq53KjCrl2ElmGLNoKlhMqj+VR3+SAjiU11IMUMxABF67OYlfKUbFw7p08CU+gN2Yx5QPpredI+jVS7n4WvsdsM5tEtMw0in7zDufIKN+mMR5o0xLXTMWpXRptyOBAzgdVVLuLf2jIK9iIEqNVkYSjsGP390sCmF9cTdS6b2Y8Sqv+X9J6qJ5bQwSYhQYBtJAb3NWn2kwqs4fx31HCce+PP3tD7E3MnlivgBPOWecQmNgmqQyYH5k1h45mz31xnzUwRVyExG4EUuQ1f0GMp9NhC5zCegfqnas8dnVl6oXBKX0+kYRwthc98m+XU8JDSmrn3CpaIXccCxd0OwZnKYPUIfe3uTER0Xt0a3vZmHLmoC8G0D
X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DB9P194MB1242.EURP194.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(19092799006)(1800799024)(23010399003)(376014)(366016)(10070799003)(22082099003)(18002099003)(56012099006)(11063799006)(10067099003)(4143699003);DIR:OUT;SFP:1102;
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2
X-MS-Exchange-AntiSpam-MessageData-0: 1pM5E/8ArDalWwQPjaZSWuOGuByU77UmEJZny7bKrbLLCPBQEtx64Xov0SEKgb6v0WCGOlD3RGpu+YpX7XPXZt9MP1+Op/i2vQWH/lsog5RcPHSSVX5FmSS2KhTRU++LK9HScXQ1spc8mC7ltr4cOLHQRiErXj+mfMH7aFOY5jCy4GT9K/Xgd6kx+Bc7/fP2K1ZgI5vPcl3kN2QGP5wG+3Vzq3DnedMXEjG/WDZU8nZRNRimF0Etdq4c/G1XHGzOqc7F5xD5FzIyJD/W8RFylVDH12iwBvtqeyRUSGORH/99lWSGnz964RGWb6yCAQr7gckJAwkGUA9I5Fd0o48NDWt0BGoiP2Q65gKMsNy0TJrrmO3J9eMTFp7gZMCVjRwxmcU5gnfPDW6tt58Kb9KezY2E7mtt/rR93RdNMf3HIQxAhiy6OYFtWkHoj36XoZnfoz1rtk2WsGbD/tqkEUcYKLMmQPEb8LrgHKrO7EEv4KqIQGxtyolvMkRQiKsr68khLJWckcG21EHo1lvnddDoCwfqGCWG7C8VWmb9y6Av4vH2T1SdYoNcW4k9WwSR5t/PiH19qT4uO3Fs1uEPZ7KzcgT3ohPIlmUvxzoowK+D0aB273l71Tm43tkP8rzKAlPfpqjX3dBRNgpueEANe6K/ygfypIderST2D+dCfoIC/E4QYWcCyocW1C2K+H7wRi92YXTfQ8I+5k2DFraOHBs+1IqAtnWmDhaUkiFYN5NprbWyf9DXixliS3TzKh4uMcJLiiPrK20jA71YAJL+zQ/ZIlA5TDtgMQwAN5qKaY/qpyh5wtWOBuiTlaKkn/3CLPMqiN8Lj4/EXvnCyu1wS07tLRKEUaFNG+UIdOgt+wGwx8lLyVMs+dDrXcfOgvuQ8aDeiqPASGXNz0mZjd9zVWf47ZPMuBCH0ImZf3hPBeOIIk1zC5BRNkwFTKcTYKvMRWgo44PhvIqo56uSPh5fZrcehnEYBVwdIr1ECPHxsqTkXrv+Qd8v1KaJsLIU2GDebqKv1USiPZZHJNynWwCqEaWBFyBuqEjq0WmOgO0O0HfupfPYPjfpH3/S4GzlO8qeeBH9IgXmS+Nivgj8Owvp4yfUM5H+xJe9thcVDPydZM39PLmwxV9WgtWz7JrXDhl1c5HWwkcJu5oFo8glyRuI3kR7SouUWioJLJpKQdi77dsfkwtMQzaYNIvhY5w0oQR0k02OJPy7qBlPAgHqT1S1LSSV9uDTkTlRpCBPzWyBeN6eYytnzeGBctCN0w3IgFXrsLJSrZXIOaK0SKwEQZQnW8UttYZ3slWgM6O/xn7zsVM2PqkTXheSDOlZF1At2ddFGnywOL9kTtUCjzuuc+s8JPnEVCdBrrJNfWv+5QghX0DS3UqV8dR4TnkGesAmZiCL5xABM3wzeTAMeuv3sQn3aumKayFBGuTQA5IL1pT5M4qhGqKdMQ2NNnYrPxYwiBU0AxqRzvTJaYMp/KwO8d35QRo7W1k1LkNwNDNTj0qhh8g/ARbfRc3qvQOE0wqHDhhCQn158nJOjlznW02rJrxLFuUfssrM4YxqCicfV/q3REUsuXPmXuQfW+InTVHnOLbiKCYAairqgKS2pLd03XNrHeDjltjdd/kNObmznW0VNyGkdLZeshNvZ+VWIocJRNKzRRtR7YRCWYK6GONr9AyaMutE6JdbwabFSMt4ufwQIsalTegdWmBLGI/CmbKhKS3lAYS8qkS7SWIFa6OgTO8PJjglJzrupmdRcGJ+nXDw/P0vP1A9J6E2SYHolTy2QoaM14KBOiHQBWl3
X-MS-Exchange-AntiSpam-MessageData-1: bX+d3NwpkoFjaA==
X-OriginatorOrg: sidn.nl
X-MS-Exchange-CrossTenant-Network-Message-Id: 235fe82d-91f5-45b6-1b0f-08dee6e8a332
X-MS-Exchange-CrossTenant-AuthSource: DB9P194MB1242.EURP194.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Jul 2026 05:26:38.2988 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: ab4d3626-c1c5-4a75-ab85-427f1a644a7d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 0eH6POomXTkrZewA2Ub0FN3otgTm2h0eGGp5JJmwvY3QO5sJIRCpffu9dkraFGDg8O1BRx+02nunR9LvM0rBhA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAVP194MB2086
Message-ID-Hash: QSIDWBLTNKU3VJLTJXG6PRQOQKFQR2Q4
X-Message-ID-Hash: QSIDWBLTNKU3VJLTJXG6PRQOQKFQR2Q4
X-MailFrom: stefan.ubbink@sidn.nl
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-dnsop.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: "dnsop@ietf.org" <dnsop@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [DNSOP] Re: PQ DNSSEC?
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/kZ-lRsmp5sAW3XiNm7AlSJHtUd4>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Owner: <mailto:dnsop-owner@ietf.org>
List-Post: <mailto:dnsop@ietf.org>
List-Subscribe: <mailto:dnsop-join@ietf.org>
List-Unsubscribe: <mailto:dnsop-leave@ietf.org>

On Mon, 20 Jul 2026 14:35:41 +0000
"Wessels, Duane" <dwessels=40verisign.com@dmarc.ietf.org> wrote:

> > On Jul 20, 2026, at 3:47 PM, Warren Kumari <warren@kumari.net>
> > wrote:
> > 
> > I don't really think it is so much "clients that can't fall back to
> > TCP..." (although they do exist), it is more "concerns around scale
> > of clients falling back to TCP". There is some belief that some /
> > many TLDs and auths will become overloaded if all recursive
> > resolvers fall back to TCP[0]. TCP is also noticeably slower, even
> > if you do pipelineing, presistance, etc., etc.  
> 
> When Verisign transitioned from RSA to ECDSA using double-signing,
> the size of signed NXDOMAIN responses exceeded 1500 bytes.  We
> observed quite a few resolver clients that were unable to fall fall
> back to TCP.  We know this because they very aggressively retried
> over UDP.  
> 
> Slide 10 of
> https://indico.dns-oarc.net/event/48/contributions/1036/attachments/1004/1920/challenges-truncation-tcp-combined%20v2.pdf
> shows some data on an “experiment” we did prior to the algorithm
> transition.
> 
> So its not just about more TCP load, but also about more UDP load
> due to futile retries.
> 
> Slide 20 of
> https://indico.dns-oarc.net/event/48/contributions/1043/attachments/1003/1927/wessels-verisign-algrolls.pdf
> shows that truncation rates were about 3x of TCP rates during the
> algorithm transition.

When SIDN did the rollover to ECDSA, we saw something similar, which
SIDN Labs wrote about in
https://www.sidnlabs.nl/en/news-and-blogs/algorithm-rollover-the-effects-on-our-network-traffic-and-resolvers

There seem to be some measurements being done with only UDP and no
fallback to TCP, so it is hard to know if there are any real clients
which would have issues with doing TCP.


-- 
Stefan Ubbink
DNS & Systems Engineer
Present: Mon, Tue, Wed, Fri
SIDN | Meander 501 | 6825 MD | Arnhem | The Netherlands
T +31 (0)26 352 55 00
https://www.sidn.nl

v2.46.0 | Report a Bug | By Email | System Status