The edns-tcp-keepalive EDNS0 Option
Extracted elements (25)
The option uses an initial idle-timeout signal rather than a default-persistent model with a close signal (as HTTP/1.1 uses) because RFC 6891 prohibits including an OPT RR in a response when the request lacks one, preventing servers from signalling timeout changes if the client stops sending OPT RRs.
The overhead of the TCP handshake relative to total session cost follows the formula (1+N)/N, where N is the number of DNS message pairs sharing the session; as N increases the overhead approaches unity, making long-lived TCP sessions efficient and motivating the keepalive mechanism.
UDP transport can be exploited for reflection attacks and, with DNSSEC and EDNS0 large responses, causes fragmentation which is known to increase cache poisoning risk; TCP eliminates both problems at the cost of connection setup overhead that keepalive amortises.
Anycast DNS servers using edns-tcp-keepalive may experience more frequent TCP session disruption due to topology changes, since sessions are longer-lived; TCP multipath (RFC 6824) anchored to a unicast address may mitigate this.
The edns-tcp-keepalive option is compatible with and complementary to other EDNS0 extensions such as CHAIN-QUERY and DNS-over-TLS; combined, these extensions enable efficient DNSSEC validation with encryption on high-latency mobile networks.
A DNS client receiving an edns-tcp-keepalive option over TCP SHOULD honour the timeout received, overriding any previous timeout, and initiate close of the connection before the timeout expires.
A DNS client that receives a response over UDP that includes the edns-tcp-keepalive option MUST ignore the option.
A DNS client that receives a response with an edns-tcp-keepalive TIMEOUT value of 0 SHOULD send no more queries on that connection and initiate closing the connection as soon as all outstanding responses are received.
A DNS client that sent the edns-tcp-keepalive option but receives a response without it SHOULD assume the server does not support keepalive and follow RFC 7766 guidance, even if a previous option exchange occurred on the same connection.
A DNS server sending a response that includes the edns-tcp-keepalive option MUST specify the TIMEOUT value currently associated with the TCP session; this value may change according to local resource constraints.
A DNS server SHOULD send an edns-tcp-keepalive option with a TIMEOUT of 0 if local resources are too low to service more TCP keepalive sessions or if it wants clients to close currently open connections.
A DNS server that receives a query over UDP that includes the edns-tcp-keepalive option MUST ignore the option.
A fallback strategy similar to RFC 6891 Section 6.2.2 SHOULD be employed to avoid persistent interference from non-clean paths that limit flow of DNS messages with particular EDNS0 options or large messages.
DNS clients and servers MAY close a TCP session at any time to manage local resource constraints; the ranking algorithm for determining which sessions to close is not specified.
DNS clients MUST NOT include the edns-tcp-keepalive option in queries sent using UDP transport.
DNS clients sending the edns-tcp-keepalive option MUST specify an OPTION-LENGTH of 0 and omit the TIMEOUT value; the timeout direction is server-to-client only.
If a client includes the edns-tcp-keepalive option in the first query, it SHOULD include an EDNS0 OPT RR periodically in further messages during the TCP session to increase the chance of receiving updated timeout values from the server.
It is RECOMMENDED that DNS intermediaries that terminate TCP connections implement edns-tcp-keepalive; an intermediary that does not may close idle connections unnecessarily between clients and servers that both support the option.
Servers may signal TIMEOUT=0 to request immediate connection closure, which shifts TCP TIME_WAIT state to well-behaved clients and is useful during resource exhaustion or detection of a denial-of-service attack.
The idle timeout begins when the idle condition is met per RFC 7766's definition of an idle DNS-over-TCP session and must be reset when that condition is lifted, i.e., when a client sends a message or a server receives a message on an idle connection.
The TIMEOUT field is encoded in network byte order and specifies the idle timeout in units of 100 milliseconds. When absent (OPTION-LENGTH=0), no timeout is signalled by the client. The idle period begins per RFC 7766's definition of an idle DNS-over-TCP session.
IANA assigned EDNS0 option code 11 with name 'edns-tcp-keepalive' and status 'Standard' in the 'DNS EDNS0 Option Codes (OPT)' registry, referencing RFC 7828.
Servers may monitor client behaviour with respect to the edns-tcp-keepalive option to build profiles of clients that do not honour the specified timeout, enabling enforcement or rate-limiting decisions.
The edns-tcp-keepalive option can be abused to request large numbers of long-lived sessions in a quick burst; when a DNS server detects abusive behaviour, it SHOULD immediately close the TCP connection and free the associated resources.
The edns-tcp-keepalive option encodes three fields: OPTION-CODE (2 octets, value 11), OPTION-LENGTH (2 octets, value 0 if TIMEOUT omitted or 2 if present), and an optional TIMEOUT field (2 octets, network byte order) specifying the idle timeout in units of 100 milliseconds.