[DNSOP] Re: PQ DNSSEC?

Stefan Ubbink <[email protected]> Tue, 21 Jul 2026 07:26:34 +0200
Newsgroups	gmane.ietf.dnsop
Organization	SIDN
Message-ID	<[email protected]>
On Mon, 20 Jul 2026 14:35:41 +0000
"Wessels, Duane" <[email protected]> wrote:

> > On Jul 20, 2026, at 3:47 PM, Warren Kumari <[email protected]>
> > wrote:
> > 
> > I don't really think it is so much "clients that can't fall back to
> > TCP..." (although they do exist), it is more "concerns around scale
> > of clients falling back to TCP". There is some belief that some /
> > many TLDs and auths will become overloaded if all recursive
> > resolvers fall back to TCP[0]. TCP is also noticeably slower, even
> > if you do pipelineing, presistance, etc., etc.  
> 
> When Verisign transitioned from RSA to ECDSA using double-signing,
> the size of signed NXDOMAIN responses exceeded 1500 bytes.  We
> observed quite a few resolver clients that were unable to fall fall
> back to TCP.  We know this because they very aggressively retried
> over UDP.  
> 
> Slide 10 of
> https://indico.dns-oarc.net/event/48/contributions/1036/attachments/1004/1920/challenges-truncation-tcp-combined%20v2.pdf
> shows some data on an “experiment” we did prior to the algorithm
> transition.
> 
> So its not just about more TCP load, but also about more UDP load
> due to futile retries.
> 
> Slide 20 of
> https://indico.dns-oarc.net/event/48/contributions/1043/attachments/1003/1927/wessels-verisign-algrolls.pdf
> shows that truncation rates were about 3x of TCP rates during the
> algorithm transition.

When SIDN did the rollover to ECDSA, we saw something similar, which
SIDN Labs wrote about in
https://www.sidnlabs.nl/en/news-and-blogs/algorithm-rollover-the-effects-on-our-network-traffic-and-resolvers

There seem to be some measurements being done with only UDP and no
fallback to TCP, so it is hard to know if there are any real clients
which would have issues with doing TCP.


-- 
Stefan Ubbink
DNS & Systems Engineer
Present: Mon, Tue, Wed, Fri
SIDN | Meander 501 | 6825 MD | Arnhem | The Netherlands
T +31 (0)26 352 55 00
https://www.sidn.nl

_______________________________________________
DNSOP mailing list -- [email protected]
To unsubscribe send an email to [email protected]
signature.asc (application/pgp-signature, 833 B)