Re: [v6ops] New draft at dnsop a bis for DNS IPv6 Transport Operational Guidelines

[Geoff Huston <[e-mail]>]

On 24 Nov 2023, at 5:37 am, Havard Eidnes <[e-mail]> wrote:

Go read https://www.potaroo.net/ispcol/2023-11/dns-ipv6.html to
get a clearer explanation of the issues here about the DNS, UDP
and IPv6.

OK, I've done that, and I'm not entirely certain that I fully
agree.

...

Thanks for the thoughtful response Havard.As a minor point of correction the data
in that article is not a census of individual resolvers, but a census of users. i.e. if a resolver
is used by 100 users and another is used by just a single user the data will be weighted in
favour of the heavily used resolver.

So the current data shows that some 69% of users pass their queries to a recursive
resolver over IPv6 use an EDNS buffer size that is greater than 1232 bytes,
and 49% use a buffer size that is greater than 1500. In these cases the
odds of encountering a timeout rather than a response for large responses
is considerably higher. What this means is that it takes more time to resolve the name
(1 second is the most commonly observed timeout).

So why should the IETF be proposing in a normative SHOULD the adoption of
an operational configuration that results in cases of slower response and an elevated
set of retransmissions?  To quote RFC2119:

"[SHOULD] MUST only be used where it is actually required for interoperation
or to limit behaviour which has potential for causing harm (e.g., limiting
retransmissions)"

As I said in the article (https://www.potaroo.net/ispcol/2023-11/dns-ipv6.html) I offerred an
alternative wording for this 3901bis draft along the lines of:

In using IPv6 as the platform for DNS queries, DNS implementations SHOULD
use an EDNS Buffer Size value of 1,232 bytes. An operator MAY use a greater
value for this parameter, but only if the DNS operator is confident that this
local setting will not result in IP packet fragmentation being required to pass
a DNS message to its intended recipient.

If the reduced EDNS Buffer Size parameter is used by a DNS resolver, then such
DNS resolvers MAY order the list of servers that could be queried to prefer to
use an IPv6 query as the initial query.

That would prevent the client performing a timeout and in the case of a large response
would allow the client to commence a TCP re-query within a single RTT.


regards,

   Geoff