On Mon, 20 Jul 2026 14:35:41 +0000 "Wessels, Duane" <[email protected]> wrote:
> > On Jul 20, 2026, at 3:47 PM, Warren Kumari <[email protected]> > > wrote: > > > > I don't really think it is so much "clients that can't fall back to > > TCP..." (although they do exist), it is more "concerns around scale > > of clients falling back to TCP". There is some belief that some / > > many TLDs and auths will become overloaded if all recursive > > resolvers fall back to TCP[0]. TCP is also noticeably slower, even > > if you do pipelineing, presistance, etc., etc. > > When Verisign transitioned from RSA to ECDSA using double-signing, > the size of signed NXDOMAIN responses exceeded 1500 bytes. We > observed quite a few resolver clients that were unable to fall fall > back to TCP. We know this because they very aggressively retried > over UDP. > > Slide 10 of > https://indico.dns-oarc.net/event/48/contributions/1036/attachments/1004/1920/challenges-truncation-tcp-combined%20v2.pdf > shows some data on an “experiment” we did prior to the algorithm > transition. > > So its not just about more TCP load, but also about more UDP load > due to futile retries. > > Slide 20 of > https://indico.dns-oarc.net/event/48/contributions/1043/attachments/1003/1927/wessels-verisign-algrolls.pdf > shows that truncation rates were about 3x of TCP rates during the > algorithm transition. When SIDN did the rollover to ECDSA, we saw something similar, which SIDN Labs wrote about in https://www.sidnlabs.nl/en/news-and-blogs/algorithm-rollover-the-effects-on-our-network-traffic-and-resolvers There seem to be some measurements being done with only UDP and no fallback to TCP, so it is hard to know if there are any real clients which would have issues with doing TCP. -- Stefan Ubbink DNS & Systems Engineer Present: Mon, Tue, Wed, Fri SIDN | Meander 501 | 6825 MD | Arnhem | The Netherlands T +31 (0)26 352 55 00 https://www.sidn.nl
pgpxTuDHrJYxX.pgp
Description: OpenPGP digital signature
_______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
