Local root: the traffic trade-off between root queries and root zone distribution

Populating resolvers with the root zone improves operational robustness of the resolver and the privacy of its users. There is currently an Internet Draft proposal to make it a best current practice (see https://datatracker.ietf.org/doc/draft-wkumari-dnsop-localroot-bcp/07/ ). What is less clear in practice is how this impacts traffic. Moving from query-driven interaction with the root to an update-driven model replaces many small queries with fewer, larger transfers of zone data, and the net effect depends on how often the root zone changes and how resolvers obtain updates. Ilyas Rahimi quantified that trade-off using a measurement-based approach for his master thesis Security and Network Engineering at the University of Amsterdam (see https://nlnetlabs.nl/downloads/publications/DNS_Local_ROOT_ResearchProject2.pdf ).

We will present Ilyas’ research showing that traffic increases under the current root zone’s signing and updating scheme. We will show how incrementally signing the root zone would change that to less traffic. Finally we present a wild speculation how some protocol extensions could reduce traffic to almost negligible amounts while retaining all the resilience, privacy and security benefits.