Switching to TCP is quicker
I think this is a very short term view.
From the packet trace I posted, you just have to look at the sheer
number of packets, that running the same query over TCP causes, to have
an idea of extra load this is going to put on TLD Name Servers if all
resolvers start falling back to TCP at the drop of a hat.
Not to mention the fact that it means EVERY query is issued twice to the
same name server. Even if the resolver ignores the answer, the workload
on the name server is the same.
Most referrals even when signed will still fit in 512 bytes.
For most TLDs, for most referrals, this is *not* the case.
Most TLDs use NSEC3+OptOut and most registered zones within them don't
sign, so an unsigned-referral proof is required.
I'm seeing in the region of ~600 bytes (580 to 620), 583 was the
smallest I could find (without trying /too/ hard)
$ dig +norec +dnssec @a-dns.pl. far.pl
There is also the very high level of NXDOMAINs that TLDs often see to be
considered.
_______________________________________________
dns-operations mailing list
[email protected]
https://lists.dns-oarc.net/mailman/listinfo/dns-operations
dns-jobs mailing list
https://lists.dns-oarc.net/mailman/listinfo/dns-jobs
