In this episode of PING, APNIC’s Chief Scientist, Geoff Huston, discusses the root zone of the DNS, and some emerging concerns about how much it costs to service query load at the root.
Under normal conditions, most DNS queries don’t reach the root thanks to caching. Without it, every query, except those for zones the resolver is already authoritative for, would need to start at the root. Caching mitigates this, but even so, root servers still receive an enormous volume of queries. Two aspects of this are particularly notable:
- Firstly, query volume at the root is growing much faster than overall Internet growth, even after discounting some sources of anomalous traffic.
- Secondly, the vast majority of queries to the root result in a ‘No, that doesn’t exist’ (NXDOMAIN) response. These answers should be capable of being replayed from cache, and can even (with DNSSEC) cover other non-existent requests efficiently. This load suggests that negative caching in the DNS and DNSSEC negative answer caching isn’t effectively reducing the load — most of this traffic is still reaching the root, even when the answer is simply ‘no’.
Geoff suggests that we might be overlooking recent developments in proving the contents of a zone — the ZONEMD record, which provides a DNSSEC-signed check on the entire zone. Paired with mechanisms to locally mirror the root zone, this could allow resolvers to answer many queries locally, dramatically reducing the burden on root infrastructure.
Can we do better? Geoff believes the answer is likely yes.
Read more about the economics of the root zone and ZONEMD on the APNIC Blog and around the web:
- The root of the DNS (Geoff Huston, APNIC Blog, March 2025)
- ZoneMD: Message digest for DNS Zones RFC 8976 (IETF RFC)
Subscribe and share your story
You can stream and subscribe to PING via the following channels:
If you’re interested in sharing your insights or research, please get in touch — we’re always looking for great stories from the community. Please let us know what you think of the podcast and the APNIC Blog so we can keep improving.
The views expressed by the authors of this blog are their own and do not necessarily reflect the views of APNIC. Please note a Code of Conduct applies to this blog.