Subject: [DNSOP] I-D Action: draft-ietf-dnsop-nsec3-guidance-01.txt

From: [email-masked]
Date: Fri, 15 Oct 2021 16:30:37 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Domain Name System Operations WG of the IETF.

        Title           : Guidance for NSEC3 parameter settings
        Authors         : Wes Hardaker
                          Viktor Dukhovni
	Filename        : draft-ietf-dnsop-nsec3-guidance-01.txt
	Pages           : 9
	Date            : 2021-10-15

Abstract:
   NSEC3 is a DNSSEC mechanism providing proof of non-existence by
   promising there are no names that exist between two domainnames
   within a zone.  Unlike its counterpart NSEC, NSEC3 avoids directly
   disclosing the bounding domainname pairs.  This document provides
   guidance on setting NSEC3 parameters based on recent operational
   deployment experience.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-dnsop-nsec3-guidance/

There is also an htmlized version available at:
https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-nsec3-guidance-01

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-dnsop-nsec3-guidance-01

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Viktor Dukhovni <[email-masked]>
Date: Mon, 18 Oct 2021 00:43:51 -0400

>    guidance on setting NSEC3 parameters based on recent operational

We were waiting for TransIP to complete the migration of their managed
DNS domains from 100 iterations to 0, before collecting fresh NSEC3
iteration count deployment statistics.

That has now been done, and the results are below:

  Zones successfully probed: 16,302,535
  Zones using NSEC3:         12,460,057   76.4% (of signed zones)
  Zones using opt-out:        1,162,869    9.3% (of NSEC3 zones)

Percentile cumulative distribution:

    iterations    cumulative%
             0      7.934956%
             5     71.117973%
            10     92.455026%
            15     94.808563%
            20     99.183358%
            25     99.256617%
            30     99.256745%
            35     99.266753%
            40     99.676831%
            50     99.783324%
            55     99.783508%
            60     99.783532%
            75     99.784263%
            80     99.784295%
            85     99.784664%
            90     99.784913%
            99     99.785017%
           100     99.946999%
           120     99.947151%
           150     99.998403%
           160     99.998411%
           200     99.998571%
           250     99.998628%
           300     99.998652%
           330     99.998756%
           400     99.998828%
           500     99.999655%
          1600     99.999960%
          2000     99.999976%
          2500    100.000000%

Absolute zone number per iteration count:

    iterations    zone count
             0     988700
             1     6455550
             2     3875
             3     31803
             4     188
             5     1381224
             6     95
             7     30601
             8     1461259
             9     80
            10     1166574
            11     123
            12     288651
            13     81
            14     8
            15     4389
            16     13934
            17     8
            18     9
            19     5
            20     531146
            21     9002
            22     6
            23     19
            24     88
            25     13
            27     1
            29     1
            30     14
            31     4
            32     79
            33     1131
            35     33
            40     51096
            42     35
            50     13234
            51     1
            52     19
            53     1
            54     1
            55     1
            56     2
            60     1
            64     13
            67     1
            69     2
            75     75
            77     2
            80     2
            81     8
            84     5
            85     33
            90     31
            93     1
            96     1
            99     11
           100     20183
           101     1
           107     17
           120     1
           128     6
           132     1
           139     1
           149     27
           150     6351
           160     1
           177     17
           200     3
           234     1
           250     6
           256     1
           300     2
           330     13
           333     1
           400     8
           423     1
           487     1
           500     101
          1024     2
          1337     1
          1600     35
          2000     2
          2500     3

-- 
    Viktor.

---

From: Viktor Dukhovni <[email-masked]>
Date: Mon, 18 Oct 2021 01:02:50 -0400

>   Zones using opt-out:        1,162,869    9.3% (of NSEC3 zones)

Based on the stats it looks plausibly realistic to set the bar as low as
50 iterations, if there's a desire to urge the community to make a final
round of downward adjustments.  Or, else we could declare victory, the
recent encouragement to use 150 or less shows very good "compliance".
A middle ground might be to set the bar at 100.

The number of zones in the 21 to 50 range is 74,756 and there are
531,146 zones at 20.  So a maximally aggressive goal could be 20
or less, but would take more time and effort.

Bikeshed away!

There's a fairly small number of operators to persuade to reduce
iterations to 50 or less.  A comparatively small number of operators
revising their settings to 50 or less would reduce an already rather low
rate of domains with 51 or more iterations to essentially insignificant
levels:

  #zones  #iters     SOA mname
  ------------------------------------------------
    7979     100     root-dns.netcup.net
    2289     100     ns.nlhosting.net
    2162     100     ns1.core-networks.de
    1790     100     ns0-auth.businessconnect.nl
     748     100     ns0.transip.net
     689     100     ns1.nextpertise.nl
     575     100     ns1.acmeweb.nl
     459     100     nsa.perf1.fr
     449     100     a.dns-i.net
     434     100     ns10.kibernet.hu
     406     100     ns1.absolight.net
     256     100     ns1.isaac.nl
     202     100     ns1.codeforce.nl
     181     100     ns1.worldstream.nl
     124     100     ns1.metaname.net
      99     100     ns1.vshosting.cz
  ------------------------------------------------
   18842     100     out of 20,183 in all

  #zones  #iters     SOA mname
  ------------------------------------------------
    5810     150     ns1.mijnhostingpartner.nl
     234     150     ns1.inmoves.nl
     102     150     ns1-eu.123ns.eu
  ------------------------------------------------
    6146     150     out of 6351

  #zones  #iters     SOA mname
  ------------------------------------------------
      85     500     dfw-infma1.ext.ray.com
  ------------------------------------------------
      85     500     out of 101

-- 
    Viktor.