Subject: Re: [dns-privacy] Root Server Operators Statement on DNS Encryption

From: Christian Huitema <[email-masked]>
Date: Thu, 1 Apr 2021 09:07:53 -0700

> On Mar 31, 2021, at 10:51 PM, Rob Sayre <[email-masked]> wrote:
> 
> 
> On Wed, Mar 31, 2021 at 10:43 PM Christian Huitema <[email-masked]> wrote:
>> I think that's the big motivation behind DoQ. Because QUIC runs over UDP, it makes some things easier than TCP. In particular, I have seen (and done) demos of supporting 50,000 QUIC connections over a single UDP socket, which is definitely easier on the system than trying to support parallel wait on 50,000 TCP sockets. But this is a motivation to do work on the subject, not a recommendation to change the way root servers operate. I personally agree with the statement that root servers should not rush to implement, but rather wait and see until the technology matures.
>> 
> 
> I don't know... shouldn't they start work now?
> 
> I wonder if root server capex costs have gone down 41% since this post: https://blog.verisign.com/domain-names/chromiums-reduction-of-root-dns-traffic/

I am aware of that. In fact, I jokingly tried to attract attention on this Chrome issue in the pechakucha session during IETF meeting in Singapore in 2019. 

This issue is one of many faced by the root. I am happy to see it solved, but there are many more like that. For example, if resolvers did adopt aggressive NSEC caching, their traffic would drop by an order of magnitude. But then, even if they did that, there would still be lot of demand on the root from other sources, such as resolvers running old software or operations that generate traffic as part of a variety of scans or spider processes. So yes, the root is special.

-- Christian Huitema