Upper limit value for DNS

Introduction There are parameters in the DNS protocol that do not have clear upper limits. For example, the number of alias levels using CNAME Resource records, the number of name servers, the number of Resource Records in an RRSet, the number of delegation levels using unrelated name server names, and the number of DNSKEYs for each domain name. I a protocol is implemented without considering the upper limit, it may become vulnerable to DoS attacks, and several attack methods have been proposed. This draft proposes reasonable upper limits for DNS protocols.

Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP14 when, and only when, they appear in all capitals, as shown here. Many of the specialized terms used in this document are defined in DNS Terminology .

Possible upper limits

Number of A, AAAA, NS RRs in a RRSet Since there are 13 root name servers and 13 name servers for com and net TLDs, the maximum number of NS RR in an NS RRSet should be 13.

Number of alias levels using CNAME/DNAME Many resolver implementations can resolve over 10 CNAME aliases. However, a stub resolver that receives a response containing multiple CNAME aliases must find the final A, AAAA Resource record that corresponds to the CNAME in each application. In order to avoid this complexity, we recommend using up to one level of CNAME/DNAME, and CNAME/DNAME aliases with more than three levels MAY be treated as a name resolution error.

Number of RRSIGs/DNSKEYs/DSs in a RRSet KeyTrap is a vulnerability caused by the fact that there is no upper limit on the number of DNSKEY RRs, DSs, or RRSIGs. If there were upper limits on these, the damage could be mitigated. Therefore, considering the DNSKEY rollover and the multi-signer model, the maximum number of DNSKEYs for both KSK and ZSK may be 6. The maximum number of DS RRs in a DS RRSet may be 3. If that limit is exceeded, the validating resolvers may result in a name resolution error. The number of RRSIG RRs for each owner name and type pair may be 6.

Number of delegation levels using unrelated name server names states that all in-domain glue records are attached to the delegation response. Therefore, using in-domain name server names for DNS delegation minimizes name resolution costs. Unrelated (or, rarely sibling) name server names are used/required for DNS hosting services. However, using unrelated name server names increases the name resolution costs and may increase the likelihood of name resolution errors. This section proposes to use in-domain name servers as much as possible for name resolution of unrelated name server names to reduce the name resolution costs. Unrelated(out-of-bailiwick) name server names are required for DNS hosting services. However, using unrelated name server names increases the name resolution costs. For some domain names, there are multiple layers of dependence on unrelated name server names when resolving the name. Furthermore, there are cases where cyclic dependencies in delegation occur, settings that depend on sibling glue, and cases where the sibling glue disappears or some name servers stop responding, making it impossible to resolve names. pointed out attacks and countermeasures that use increased load due to cyclic dependencies. Many cyclic delegations are likely due to misconfigurations. To avoid complex name resolution and misconfigurations, it is better to avoid using unrelated name server names as much as possible. Then, unrelated name server names SHOULD be hosted by a domain name with at least one in-domain name server name. In other words, DNS providers SHOULD have at least one in-domain nameserver for their domain names.

Possible upper limit values Name Upper limit value Number of CNAME chains 1 ? 3 ? 9 ? 16 ? Number of DS 3 Number of DNSKEY 6 Number of RRSIG RRs for each name and type 6 Number of levels of unrelated only 1 Number of RRs in one RRSet 13 Number of glue RRs in a delegation 26 Recursive resolvers MAY return a name resolution error (Server Failure) if it receives a response from an authoritative server that exceeds these limits.

IANA Considerations This document requests no IANA actions.

Security Considerations