Network Working Group O. Gudmundsson
Request for Comments: 3226 December 2001
Updates: 2874, 2535
Category: Standards Track
Network Working Group O. Gudmundsson
Request for Comments: 3226 December 2001
Updates: 2874, 2535
Category: Standards Track
DNSSEC and IPv6 A6 aware server/resolver message size requirements
DNSSEC和IPv6 A6感知服务器/解析器消息大小要求
Status of this Memo
本备忘录的状况
This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited.
本文件规定了互联网社区的互联网标准跟踪协议，并要求进行讨论和提出改进建议。有关本协议的标准化状态和状态，请参考当前版本的“互联网官方协议标准”（STD 1）。本备忘录的分发不受限制。
Copyright Notice
版权公告
Copyright (C) The Internet Society (2001). All Rights Reserved.
版权所有（C）互联网协会（2001年）。版权所有。
Abstract
摘要
This document mandates support for EDNS0 (Extension Mechanisms for DNS) in DNS entities claiming to support either DNS Security Extensions or A6 records. This requirement is necessary because these new features increase the size of DNS messages. If EDNS0 is not supported fall back to TCP will happen, having a detrimental impact on query latency and DNS server load. This document updates RFC 2535 and RFC 2874, by adding new requirements.
本文档要求在声称支持DNS安全扩展或A6记录的DNS实体中支持EDNS0（DNS扩展机制）。这一要求是必要的，因为这些新功能增加了DNS消息的大小。如果不支持EDNS0，则会发生退回TCP的情况，对查询延迟和DNS服务器负载产生不利影响。本文件通过添加新要求更新了RFC 2535和RFC 2874。
Familiarity with the DNS [RFC1034, RFC1035], DNS Security Extensions [RFC2535], EDNS0 [RFC2671] and A6 [RFC2874] is helpful.
熟悉DNS[RFC1034，RFC1035]、DNS安全扩展[RFC2535]、EDNS0[RFC2671]和A6[RFC2874]会有所帮助。
STD 13, RFC 1035 Section 2.3.4 requires that DNS messages over UDP have a data payload of 512 octets or less. Most DNS software today will not accept larger UDP datagrams. Any answer that requires more than 512 octets, results in a partial and sometimes useless reply with the Truncation Bit set; in most cases the requester will then retry using TCP. Furthermore, server delivery of truncated responses varies widely and resolver handling of these responses also varies, leading to additional inefficiencies in handling truncation.
STD 13，RFC 1035第2.3.4节要求UDP上的DNS消息具有512个八位字节或更少的数据有效负载。目前大多数DNS软件不接受较大的UDP数据报。任何需要超过512个八位字节的答案，都会导致使用截断位集的部分回复，有时甚至是无用的回复；在大多数情况下，请求者将使用TCP重试。此外，截断响应的服务器交付差异很大，解析程序对这些响应的处理也各不相同，导致处理截断的效率进一步降低。
Compared to UDP, TCP is an expensive protocol to use for a simple transaction like DNS: a TCP connection requires 5 packets for setup and tear down, excluding data packets, thus requiring at least 3 round trips on top of the one for the original UDP query. The DNS
与UDP相比，TCP对于DNS这样的简单事务来说是一种昂贵的协议：TCP连接需要5个数据包进行设置和拆卸，不包括数据包，因此在原始UDP查询的基础上至少需要3个往返。DNS
server also needs to keep a state of the connection during this transaction. Many DNS servers answer thousands of queries per second, requiring them to use TCP will cause significant overhead and delays.
服务器还需要在此事务期间保持连接状态。许多DNS服务器每秒回答数千个查询，要求它们使用TCP将导致巨大的开销和延迟。
The key words "MUST", "REQUIRED", "SHOULD", "RECOMMENDED", and "MAY" in this document are to be interpreted as described in RFC 2119.
本文件中的关键词“必须”、“要求”、“应该”、“建议”和“可能”应按照RFC 2119中的说明进行解释。
DNSSEC [RFC2535] secures DNS by adding a Public Key signature on each RR set. These signatures range in size from about 80 octets to 800 octets, most are going to be in the range of 80 to 200 octets. The addition of signatures on each or most RR sets in an answer significantly increases the size of DNS answers from secure zones.
DNSSEC[RFC2535]通过在每个RR集上添加公钥签名来保护DNS。这些特征码的大小从大约80个八位字节到800个八位字节不等，大多数将在80到200个八位字节之间。在应答中的每个或大多数RR集上添加签名会显著增加来自安全区域的DNS应答的大小。
For performance reasons and to reduce load on DNS servers, it is important that security aware servers and resolvers get all the data in Answer and Authority section in one query without truncation. Sending Additional Data in the same query is helpful when the server is authoritative for the data, and this reduces round trips.
出于性能原因和减少DNS服务器上的负载，具有安全意识的服务器和解析程序在一个查询中获得应答和授权部分中的所有数据而不进行截断是很重要的。当服务器对数据具有权威性时，在同一查询中发送附加数据会很有帮助，这样可以减少往返。
DNSSEC OK[OK] specifies how a client can, using EDNS0, indicate that it is interested in receiving DNSSEC records. The OK bit does not eliminate the need for large answers for DNSSEC capable clients.
DNSSEC OK[确定]指定客户端如何使用EDNS0指示其有兴趣接收DNSSEC记录。OK位并不能消除支持DNSSEC的客户端对大型答案的需求。
TSIG [RFC2845] allows for the light weight authentication of DNS messages, but increases the size of the messages by at least 70 octets. DNSSEC specifies for computationally expensive message authentication SIG(0) using a standard public key signature. As only one TSIG or SIG(0) can be attached to each DNS answer the size increase of message authentication is not significant, but may still lead to a truncation.
TSIG[RFC2845]允许对DNS消息进行轻量级身份验证，但会将消息的大小至少增加70个八位字节。DNSSEC使用标准公钥签名指定计算代价高昂的消息身份验证SIG（0）。由于每个DNS应答只能连接一个TSIG或SIG（0），因此消息身份验证的大小增加并不显著，但仍可能导致截断。
IPv6 addresses [RFC2874] are 128 bits and can be represented in the DNS by multiple A6 records, each consisting of a domain name and a bit field. The domain name refers to an address prefix that may require additional A6 RRs to be included in the answer. Answers where the queried name has multiple A6 addresses may overflow a 512- octet UDP packet size.
IPv6地址[RFC2874]为128位，可在DNS中由多个A6记录表示，每个记录由一个域名和一个位字段组成。域名指的是地址前缀，可能需要在答案中包含额外的A6 RRs。如果查询的名称有多个A6地址，则答案可能会溢出512个八位组的UDP数据包大小。
The current number of root servers is limited to 13 as that is the maximum number of name servers and their address records that fit in one 512-octet answer for a SOA record. If root servers start advertising A6 or KEY records then the answer for the root NS records will not fit in a single 512-octet DNS message, resulting in a large number of TCP query connections to the root servers. Even if all client resolver query their local name server for information, there are millions of these servers. Each name server must periodically update its information about the high level servers.
当前根服务器的数量限制为13，因为这是SOA记录的一个512八位字节答案中所包含的名称服务器及其地址记录的最大数量。如果根服务器开始公布A6或密钥记录，则根NS记录的答案将不适合单个512八位字节DNS消息，从而导致根服务器的大量TCP查询连接。即使所有客户机解析器都查询其本地名称服务器以获取信息，也有数百万台这样的服务器。每个名称服务器必须定期更新其有关高级服务器的信息。
For redundancy, latency and load balancing reasons, large numbers of DNS servers are required for some zones. Since the root zone is used by the entire net, it is important to have as many servers as possible. Large TLDs (and many high-visibility SLDs) often have enough servers that either A6 or KEY records would cause the NS response to overflow the 512 byte limit. Note that these zones with large numbers of servers are often exactly those zones that are critical to network operation and that already sustain fairly high loads.
出于冗余、延迟和负载平衡的原因，某些区域需要大量DNS服务器。由于根区域由整个网络使用，因此拥有尽可能多的服务器非常重要。大型TLD（和许多高可见性SLD）通常有足够的服务器，A6或KEY记录都会导致NS响应溢出512字节的限制。请注意，这些具有大量服务器的区域通常正是那些对网络运行至关重要并且已经承受相当高负载的区域。
Given all these factors, it is essential that any implementation that supports DNSSEC and or A6 be able to use larger DNS messages than 512 octets.
考虑到所有这些因素，任何支持DNSSEC和/或A6的实现都必须能够使用大于512个八位字节的DNS消息。
The original 512 restriction was put in place to reduce the probability of fragmentation of DNS responses. A fragmented UDP message that suffers a loss of one of the fragments renders the answer useless and the query must be retried. A TCP connection requires a larger number of round trips for establishment, data transfer and tear down, but only the lost data segments are retransmitted.
最初的512限制是为了降低DNS响应的碎片化概率。丢失其中一个片段的片段UDP消息将导致答案无效，必须重试查询。TCP连接的建立、数据传输和中断需要大量的往返，但只有丢失的数据段才能重新传输。
In the early days a number of IP implementations did not handle fragmentation well, but all modern operating systems have overcome that issue thus sending fragmented messages is fine from that standpoint. The open issue is the effect of losses on fragmented messages. If connection has high loss ratio only TCP will allow reliable transfer of DNS data, most links have low loss ratios thus sending fragmented UDP packet in one round trip is better than establishing a TCP connection to transfer a few thousand octets.
在早期，许多IP实现没有很好地处理碎片，但是所有现代操作系统都已经克服了这个问题，因此从这个角度来看，发送碎片化消息是很好的。公开的问题是丢失对碎片化消息的影响。如果连接具有高丢失率，则只有TCP将允许DNS数据的可靠传输，大多数链路具有低丢失率，因此在一次往返中发送片段UDP数据包比建立TCP连接以传输几千个八位字节要好。
EDNS0 [RFC2671] allows clients to declare the maximum size of UDP message they are willing to handle. Thus, if the expected answer is between 512 octets and the maximum size that the client can accept, the additional overhead of a TCP connection can be avoided.
EDNS0[RFC2671]允许客户端声明他们愿意处理的UDP消息的最大大小。因此，如果预期答案介于512个八位字节和客户端可以接受的最大大小之间，则可以避免TCP连接的额外开销。
3. Protocol changes:
3. 协议更改：
This document updates RFC 2535 and RFC 2874, by adding new requirements.
本文件通过添加新要求更新了RFC 2535和RFC 2874。
All RFC 2535 compliant servers and resolvers MUST support EDNS0 and advertise message size of at least 1220 octets, but SHOULD advertise message size of 4000. This value might be too low to get full answers for high level servers and successor of this document may require a larger value.
所有符合RFC 2535的服务器和解析程序都必须支持EDNS0，并公布消息大小至少为1220个八位字节，但应公布消息大小为4000。此值可能太低，无法获得高级服务器的完整答案，此文档的后续版本可能需要更大的值。
All RFC 2874 compliant servers and resolver MUST support EDNS0 and advertise message size of at least 1024 octets, but SHOULD advertise message size of 2048. The IPv6 datagrams should be 1024 octets, unless the MTU of the path is known. (Note that this is smaller than the minimum IPv6 MTU to allow for some extension headers and/or encapsulation without exceeding the minimum MTU.)
所有符合RFC 2874的服务器和解析器都必须支持EDNS0，并且播发消息大小至少为1024个八位字节，但播发消息大小应为2048。IPv6数据报应为1024个八位字节，除非路径的MTU已知。（请注意，这小于最小IPv6 MTU，以允许在不超过最小MTU的情况下进行某些扩展头和/或封装。）
All RFC 2535 and RFC 2874 compliant entities MUST be able to handle fragmented IPv4 and IPv6 UDP packets.
所有符合RFC 2535和RFC 2874的实体必须能够处理分段的IPv4和IPv6 UDP数据包。
All hosts supporting both RFC 2535 and RFC 2874 MUST use the larger required value in EDNS0 advertisements.
所有同时支持RFC 2535和RFC 2874的主机必须在EDNS0播发中使用较大的所需值。
Harald Alvestrand, Rob Austein, Randy Bush, David Conrad, Andreas Gustafsson, Jun-ichiro itojun Hagino, Bob Halley, Edward Lewis Michael Patton and Kazu Yamamoto were instrumental in motivating and shaping this document.
Harald Alvestrand、Rob Austein、Randy Bush、David Conrad、Andreas Gustafsson、Jun ichiro itojun Hagino、Bob Halley、Edward Lewis Michael Patton和Kazu Yamamoto在激励和塑造本文件方面发挥了重要作用。
5. Security Considerations:
5. 安全考虑：
There are no additional security considerations other than those in RFC 2671.
除了RFC 2671中的安全注意事项外，没有其他安全注意事项。
6. IANA Considerations:
6. IANA注意事项：
None
没有一个
[RFC1034] Mockapetris, P., "Domain Names - Concepts and Facilities", STD 13, RFC 1034, November 1987.
[RFC1034]Mockapetris，P.，“域名-概念和设施”，STD 13，RFC 1034，1987年11月。
[RFC1035] Mockapetris, P., "Domain Names - Implementation and Specification", STD 13, RFC 1035, November 1987.
[RFC1035]Mockapetris，P.，“域名-实现和规范”，STD 13，RFC 1035，1987年11月。
[RFC2535] Eastlake, D. "Domain Name System Security Extensions", RFC 2535, March 1999.
[RFC2535]Eastlake，D.“域名系统安全扩展”，RFC25351999年3月。
[RFC2671] Vixie, P., "Extension Mechanisms for DNS (EDNS0)", RFC 2671, August 1999.
[RFC2671]Vixie，P.，“DNS的扩展机制（EDNS0）”，RFC 26711999年8月。
[RFC2845] Vixie, P., Gudmundsson, O., Eastlake, D. and B. Wellington, "Secret Key Transaction Authentication for DNS (TSIG)", RFC 2845, May 2000.
[RFC2845]Vixie，P.，Gudmundsson，O.，Eastlake，D.和B.Wellington，“DNS秘密密钥交易认证（TSIG）”，RFC 28452000年5月。
[RFC2874] Crawford, M. and C. Huitema, "DNS Extensions to Support IPv6 Address Aggregation and Renumbering", RFC 2874, July 2000.
[RFC2874]Crawford，M.和C.Huitema，“支持IPv6地址聚合和重新编号的DNS扩展”，RFC 28742000年7月。
[RFC3225] Conrad, D., "Indicating Resolver Support of DNSSEC", RFC 3225, December 2001.
[RFC3225]Conrad，D.“指示DNSSEC的分解器支持”，RFC 3225，2001年12月。
Olafur Gudmundsson 3826 Legation Street, NW Washington, DC 20015 USA
美国华盛顿特区西北部公使街3826号奥拉弗尔·古德蒙松，邮编：20015
EMail: ogud@ogud.com
EMail: ogud@ogud.com
Copyright (C) The Internet Society (2001). All Rights Reserved.
版权所有（C）互联网协会（2001年）。版权所有。
This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.
本文件及其译本可复制并提供给他人，对其进行评论或解释或协助其实施的衍生作品可全部或部分编制、复制、出版和分发，不受任何限制，前提是上述版权声明和本段包含在所有此类副本和衍生作品中。但是，不得以任何方式修改本文件本身，例如删除版权通知或对互联网协会或其他互联网组织的引用，除非出于制定互联网标准的需要，在这种情况下，必须遵循互联网标准过程中定义的版权程序，或根据需要将其翻译成英语以外的其他语言。
The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.
上述授予的有限许可是永久性的，互联网协会或其继承人或受让人不会撤销。
This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
本文件和其中包含的信息是按“原样”提供的，互联网协会和互联网工程任务组否认所有明示或暗示的保证，包括但不限于任何保证，即使用本文中的信息不会侵犯任何权利，或对适销性或特定用途适用性的任何默示保证。
Acknowledgement
确认
Funding for the RFC Editor function is currently provided by the Internet Society.
RFC编辑功能的资金目前由互联网协会提供。