Re: So... is it time to do IPv6 day monthy yet?

[Owen DeLong <owen () delong com>]

On Jun 18, 2011, at 8:00 AM, Jimmy Hess wrote:

> On Sat, Jun 18, 2011 at 4:31 AM, Mark Andrews <marka () isc org> wrote:
> > Not really.  A AAAA record adds 28 octets (a A record takes 16).  Unless
> > you have a lot of name servers most referrals still fall within 512 octets
> > additionally most answers also still fall withing 512 octets.
>
> I agree.. not that it should be assumed there is no v6 DNS issue.
> With IPv6, the main issue may
> be 'firewalls' and  'boxes in the middle'  silently munging, eating,
> or destroying AAAA responses.
>
> DNSSEC  and not AAAA is really the reason to have need for EDNS0 or TRUNC
> on validating resolvers.  AAAA records should be fine for sane domains.
>
> consider a referral for   example.com -> subdomain.example.com  with
> 8 nameservers.
> mydomainname.example.com;   and assume you get both AAAA and A
> additional responses.
>
> Total = 402 octets   -- still safe;  your domain name could be ~100
> characters longer and it would still be fine.
>
> Header <   2 (id)  + 2 (qr,opcode,aa,tc,rd,ra,z,rcode,qdcount)  + 2
> (ancount)  + 2 (nscount)  + 2 (arcount)
>   = 10 octets
> Authority Section
> ns1.subdomain.example.com.  IN  NS  ns1.subdomain.example.com.   <
> 26name + 2 + 2 + 4 + 2 +   2(pointer) =  36 octets
> ns2.subdomain.example.com.  IN NS  ns2.subdomain.example.com.   <  4
> name + 2(pointer)  + 2 + 2 + 4 + 2 +2(pointer) = 18 octets
> ns3.subdomain.example.com.  IN NS  ns3.subdomain.example.com.   <  4
> name + 2 + 2 + 2 + 4 + 2 + 2 =  18 octets
> ns4.subdomain.example.com.  IN NS  ns4.subdomain.example.com.   <  18 octets
> ns5.subdomain.example.com.  IN NS  ns5.subdomain.example.com.   <  18 octets
> ns6.subdomain.example.com.  IN NS  ns6.subdomain.example.com.   <  18 octets
> ns7.subdomain.example.com.  IN NS  ns7.subdomain.example.com.   <  18 octets
> ns8.subdomain.example.com.  IN NS  ns8.subdomain.example.com.   <  18 octets
>
> Additional Section
> ns1.subdomain.example.com.  IN AAAA  2001:DB8::0    <  2(pointer)
> +4TTL+2RDLENGTH+16RDATA =  24 octets
> ns2.subdomain.example.com.  IN AAAA  2001:DB8::1    < 24 octets
> ns3.subdomain.example.com.  IN AAAA  2001:DB8::2    < 24 octets
> ns4.subdomain.example.com.  IN AAAA  2001:DB8::3    < 24 octets
> ns5.subdomain.example.com.  IN AAAA  2001:DB8::4    < 24 octets
> ns6.subdomain.example.com.  IN AAAA  2001:DB8::5    < 24 octets
> ns7.subdomain.example.com.  IN AAAA  2001:DB8::6    < 24 octets
> ns8.subdomain.example.com.  IN AAAA  2001:DB8::7    < 24 octets
> ns1.subdomain.example.com.  IN A         192.0.0.0.1   <  2(pointer)
> +4TTL+2RDLENGTH+4RDATA =  12 octets
> ns2.subdomain.example.com.  IN A         192.0.0.0.1   <  12 octets
> ns3subdomain.example.com.  IN A         192.0.0.0.1   <  12 octets
> ns4.subdomain.example.com.  IN A         192.0.0.0.1   <  12 octets
>
>
> Total = 402 octets   -- still safe;  your domain name could be  ~100
> characters longer and it would still be fine.
This ignores the extra baggage that tends to come along in a DNS payload.

Just the root:

; <<>> DiG 9.6.0-APPLE-P2 <<>> +trace -t any www.delong.com
;; global options: +cmd
.                       379756  IN      NS      e.root-servers.net.
.                       379756  IN      NS      i.root-servers.net.
.                       379756  IN      NS      l.root-servers.net.
.                       379756  IN      NS      f.root-servers.net.
.                       379756  IN      NS      k.root-servers.net.
.                       379756  IN      NS      b.root-servers.net.
.                       379756  IN      NS      j.root-servers.net.
.                       379756  IN      NS      d.root-servers.net.
.                       379756  IN      NS      c.root-servers.net.
.                       379756  IN      NS      g.root-servers.net.
.                       379756  IN      NS      m.root-servers.net.
.                       379756  IN      NS      h.root-servers.net.
.                       379756  IN      NS      a.root-servers.net.
;; Received 512 bytes from 192.159.10.2#53(192.159.10.2) in 7 ms


Or the GTLD servers list:

com.                    172800  IN      NS      a.gtld-servers.net.
com.                    172800  IN      NS      b.gtld-servers.net.
com.                    172800  IN      NS      c.gtld-servers.net.
com.                    172800  IN      NS      d.gtld-servers.net.
com.                    172800  IN      NS      e.gtld-servers.net.
com.                    172800  IN      NS      f.gtld-servers.net.
com.                    172800  IN      NS      g.gtld-servers.net.
com.                    172800  IN      NS      h.gtld-servers.net.
com.                    172800  IN      NS      i.gtld-servers.net.
com.                    172800  IN      NS      j.gtld-servers.net.
com.                    172800  IN      NS      k.gtld-servers.net.
com.                    172800  IN      NS      l.gtld-servers.net.
com.                    172800  IN      NS      m.gtld-servers.net.
;; Received 495 bytes from 2001:500:3::42#53(l.root-servers.net) in 37 ms

(not quite 512, but, close)

Note, none of these came with glue. They ONLY included the name data.
Had they come with glue, we would easily have been over 512 in both
cases just for IPv4, let alone a v4/v6 combination.

I know of at least one prominent MMORPG that has enough A records for their login
servers that they triggered TRUNC DNS results which I discovered when they
broke at some hotels I have stayed at. I've also encountered other sites.

Owen