The latest episode of PING features Willem Toorop, a researcher at NLnet Labs, and Ilyas Rahimi, who recently earned a Master's degree in Security and Network Engineering from the University of Amsterdam (UvA). The two discuss findings from Rahimi's thesis work on the operational impact of serving the DNS root zone locally.

Rahimi completed his studies through the OS3 Master's program at UvA, which emphasizes Open Standards, Open Software, and Open Security. NLnet Labs maintains offices on the UvA campus, and Toorop has spent years mentoring students in DNS and DNSSEC research as part of their thesis work. The program requires students to conduct two extended research projects, with the second serving as the foundation for their final thesis.

What is locally served root?

Locally served root is an approach where DNS resolvers maintain a pre-fetched copy of the root zone, which occupies the top level of the DNS hierarchy. By keeping a local copy on hand, resolvers can respond immediately to queries for non-existent top-level domains without contacting root servers. The technique also offers privacy advantages by reducing the frequency of queries sent to root infrastructure for names that can be resolved locally. The IETF is currently considering a proposal to establish this as a Best Current Practice (BCP).

Research methodology and findings

Rahimi's investigation analyzed three widely used resolver implementations—BIND, Unbound, and Knot Resolver—under four distinct operational scenarios. The research examined both in-band retrieval of the root zone and retrieval via HTTPS.

The work uncovered a software defect in Unbound that caused an unusual spike in traffic volume. More significantly, Rahimi discovered that the process of updating the root zone can create unexpectedly heavy network traffic. In certain configurations, the bandwidth consumed by zone updates actually surpassed the traffic generated by the much more frequent but individually smaller queries normally sent to root servers for data not held in cache.

Future directions

Additional investigation remains necessary to fully understand locally served root deployment. With the OS3 program now dedicating expanded time to thesis research within its curriculum, Toorop intends to maintain partnerships with UvA students and broaden the scope of measurement studies. He is currently investigating how incremental zone updates (IXFR) perform as an alternative to downloading the entire root zone on each refresh cycle.

Related resources

  • Local root serving by default: Quantifying the traffic trade-off (Ilyas Rahimi, Masters Thesis)
  • A presentation Ilyas made on his thesis (NLNet Labs web)
  • Populating resolvers with the root zone (Warren Kumari, IETF draft BCP proposal)
  • An example of incrementally signed (IXFR suitable) root states (Git repo, Willem Toorop at codeberg)
  • RSSAC 02 Measurements of the Root Server System (ICANN RSSAC web)