Subject: Re: [DNSOP] draft-ietf-dnsop-nsec3-guidance: fresh iteration count stats

From: Viktor Dukhovni <[email-masked]>
Date: Thu, 4 Nov 2021 16:46:55 -0400

> On 18 Oct 2021, at 12:43 am, Viktor Dukhovni <[email-masked]> wrote:
> 
> We were waiting for TransIP to complete the migration of their managed
> DNS domains from 100 iterations to 0, before collecting fresh NSEC3
> iteration count deployment statistics.
> 
> That has now been done, and the results are below:
> 
>  Zones successfully probed: 16,302,535
>  Zones using NSEC3:         12,460,057   76.4% (of signed zones)
>  Zones using opt-out:        1,162,869    9.3% (of NSEC3 zones)
> 
> Percentile cumulative distribution:
> 
>    iterations    cumulative%
>             0      7.934956%
>             5     71.117973%
>            10     92.455026%
>            15     94.808563%
>            20     99.183358%
>            25     99.256617%
>            30     99.256745%
>            35     99.266753%
>            40     99.676831%
>            50     99.783324%
>            55     99.783508%
>            60     99.783532%
>            75     99.784263%
>            80     99.784295%
>            85     99.784664%
>            90     99.784913%
>            99     99.785017%
>           100     99.946999%
>           120     99.947151%
>           150     99.998403%
>           160     99.998411%
>           200     99.998571%
>           250     99.998628%
>           300     99.998652%
>           330     99.998756%
>           400     99.998828%
>           500     99.999655%
>          1600     99.999960%
>          2000     99.999976%
>          2500    100.000000%

Just in case further reductions occurred since mid-October, I did a quick
rescan of zones which had >= 51 iterations, and the absolute frequencies
are below.  Still mostly negligible, except for 100, 150, and a small
Raytheon bump at 500.  So the question boils down to whether we want to
nudge the 150s and perhaps also the 100s down to either 100 or 50, setting
the recommended resolver limit there (and of course still strongly recommend
the auth zone signers to use 0).

      1 51
     19 52
      1 53
      1 54
      1 55
      2 56
      1 60
      1 61
     12 64
      1 67
      2 69
     75 75
      1 80
      8 81
      5 84
     33 85
     20 90
      1 96
     11 99
  20038 100
      1 101
     17 107
      1 120
      6 128
      1 132
      1 139
     27 149
   6304 150
      1 160
     17 177
      3 200
      1 234
      6 250
      1 256
      2 300
     13 330
      8 400
      1 423
      1 487
    101 500
      2 1024
      1 1337
     35 1600
      2 2000
      3 2500

-- 
	Viktor.

---

From: Viktor Dukhovni <[email-masked]>
Date: Thu, 4 Nov 2021 17:58:28 -0400

If there's appetite to go even lower than 50, the relevant counts are:

   8898 21
      6 22
     19 23
     87 24
     13 25
      1 27
      1 29
     14 30
      4 31
     39 32
   1112 33
     33 35
      1 39
  43384 40
     35 42
  12281 50

Since the zone count for 20 in mid October was 531,146, that seems to be
the lowest realistic limit we can impose, if we're willing to apply enough
pressure to also get the ~66k zones between 21 and 50 to make changes.

> On 4 Nov 2021, at 4:46 pm, Viktor Dukhovni <[email-masked]> wrote:
> 

-- 
	Viktor.