[DNSOP] Re: Either the worst or best idea ever - draft-wagope-dnsop-do-bit

[Petr Špaček <[e-mail]>]

On 02. 11. 26 11:13, Libor Peltan wrote:
> Hi Geoff,
> 
> On 01. 11. 26 20:09, Geoff Huston wrote:
>>
>>> On 31 Oct 2026, at 09:51, Joe Abley <[e-mail]> wrote:
>>>
>>> My opinion is that the DNS needs less UDP, not more of it. I am not 
>>> in favour of band-aids that prolong the tolerance of transport 
>>> protocols that constrain response sizes.
>>>
>>> I think we should be doing everything we can to move the mainstream 
>>> to (ideally encrypted) stream-based transport protocols which have no 
>>> response size constraints beyond those of the DNS message format, 
>>> transport protocols that have no need for protocol modifications of 
>>> the kind you describe above.
>>>
>>> The future of UDP transport should be best-effort support for legacy 
>>> devices.
>>>
>> Over in the world of paying for infrastructure "cheap" rules. I have 
>> listened to a number of presentations over the years that note that a 
>> DNS server's throughput drops by some 60% when the same query load is 
>> presented over TCP rather than UDP. My experience with DNS servers 
>> supports this quite radical drop in capacity (in my case throughput 
>> dropped by 90%!). So where does the money come from to upgrade DNS 
>> infrastructure to support a transition to TCP everywhere in the DNS?
> 
> Yes but also among DNS-over-UDP traffic, only a fraction of the volume 
> is _legitimate_ DNS queries. The rest is noise and attacks.
> 
> _Because_ of UDP, the infrastructure also has to be expensively 
> overprovisioned, in order to sustain those attacks, together with 
> mitigating amplification attacks on 3rd-parties.
> 
> Regarding TCP, I think that the existing DNS infrastructure is already 
> scaled enough to manage DNS-over-TCP for all legitimate traffic.
> 
> The remaining question is, if it is also ready for TCP-specific attacks. 
> And what is the price.
> 
>>
>> Maybe things would be different if we had started with DNS over TCP at 
>> the outset, but now we are in the UDP room there is a price to be paid 
>> to move to TCP and no clear view as to who and how we pay that price.

I totally agree with Joe and Libor (a rare event!)

Speaking of DNS over-provisioning, have a look at
https://stats.nic.cz/dashboard/en/Traffic.html
so we can discuss some data. Scroll to chart at the bottom.

Average QPS in 'steady state' is below 50 k/sec. Even _my laptop_ can 
handle whole CZ TLD on a _single CPU core_, even with venerable BIND! 
And still there will be capacity to spare!

All the over-provisioning (which, I believe, is over 400 GBps for a 
single CZ site...) is for attacks over UDP, which cannot be blocked 
easily because they lack source validation.

That's _ridiculous_ amount of money spent on running a ridiculously 
insecure protocol.

Let's finally get over it and fix the protocol / move to better one 
instead of adding layers of hacks upon layers of existing hacks. If we 
do that there will be plenty _excess_ money which does not need to be 
burned on over-provisioning anymore.

-- 
Petr Špaček