In this episode of PING, we speak with Willem Toorop from NLnet Labs and Ilyas Rahimi, who recently completed a Master’s in Security and Network Engineering at the University of Amsterdam (UvA). They discuss their research into the effects of local root serving.
Ilyas recently completed the OS3 Master’s program at UvA, named for its focus on Open Standards, Open Software, and Open Security. NLnet Labs is based on the UvA campus, and Willem has worked closely with the program for many years, supervising student research into DNS and DNSSEC during the Master’s thesis component. As part of the program, students undertake two month-long original research projects, with the second forming the basis of their Master’s thesis.
Locally served root is a DNS resolver model that pre-fetches and stores the root zone, which sits at the apex of the DNS hierarchy. Having a local copy allows resolvers to quickly terminate queries for non-existent top-level domains and can provide some privacy benefits by reducing the need to query the root servers for resolvable names. There is a current proposal in the IETF to make this a Best Current Practice (BCP).
Ilyas examined three public resolver codebases, BIND, Unbound, and Knot Resolver, across four different configurations. His research explored both in-band retrieval of the root zone and fetching it over HTTPS.
As well as identifying a bug in Unbound that accounted for a spike in traffic, Ilyas found that the root zone update cycle can generate a surprisingly large amount of network traffic when fetching the zone. In some cases, this exceeded the traffic associated with the far more frequent, but much smaller, queries sent to root servers for uncached data.
There is still more work to be done in this area. With the OS3 Master’s thesis component now allocated more time within the degree program, Willem hopes to continue collaborating with UvA students and extend the measurement work. He has also been exploring how the system behaves when using incremental zone updates (IXFR) rather than fetching the entire root zone each time.
Read more about locally served root zones, Willem and Ilyas’s work, and the results:
- Local root serving by default: Quantifying the traffic trade-off (Ilyas Rahimi, Masters Thesis)
- A presentation Ilyas made on his thesis (NLNet Labs web)
- Populating resolvers with the root zone (Warren Kumari, IETF draft BCP proposal)
- An example of incrementally signed (IXFR suitable) root states (Git repo, Willem Toorop at codeberg)
- RSSAC 02 Measurements of the Root Server System (ICANN RSSAC web)
Subscribe and share your story
You can stream and subscribe to PING via the following channels:
If you’re interested in sharing your insights or research, please get in touch — we’re always looking for great stories from the community. Please let us know what you think of the podcast and the APNIC Blog so we can keep improving.
The views expressed by the authors of this blog are their own and do not necessarily reflect the views of APNIC. Please note a Code of Conduct applies to this blog.