DNS Query Name Minimisation to Improve Privacy
obsoletes
- rfc-7816 — DNS Query Name Minimisation to Improve Privacy
Extracted elements (21)
An optional optimisation treats labels beginning with underscore (_) as not representing privacy-relevant administrative boundaries. For example, when resolving '_25._tcp.mail.example.org' after querying 'mail.example.org', the resolver can jump directly to '_25._tcp.mail.example.org' rather than stepping through each underscore label.
QNAME minimisation can counterintuitively reduce total upstream queries in some cases. For example, if three QNAMEs share a non-existent TLD, traditional resolution sends three queries to the root, whereas minimisation sends one NXDOMAIN-returning query for the TLD and caches it, avoiding the subsequent two queries entirely.
QNAME minimisation reduces privacy exposure by sending only enough of the QNAME to an upstream name server to obtain a delegation, rather than the full original QNAME and QTYPE. The full QNAME and original QTYPE are only needed at the authoritative name server responsible for the record; all intermediate servers need only enough labels to return a delegation.
RFC 9156 relaxes the RFC 7816 recommendation to use NS QTYPE for hiding the original QTYPE. Using NS QTYPE provides no added value over other QTYPEs because the parent side of a delegation will respond with a referral regardless of the QTYPE.
Sending the full QNAME to all authoritative servers was a tradition rather than a protocol requirement, originating from a desire to optimise request counts when the same name server was authoritative for many zones or was both recursive and authoritative — conditions far less common in modern DNS.
The QTYPE used in minimised queries can be any type for which the authority always lies below the zone cut, excluding DS, NSEC, NSEC3, OPT, TSIG, TKEY, ANY, MAILA, MAILB, AXFR, and IXFR. A or AAAA are recommended because they are least likely to raise issues in DNS software and middleboxes, and blend into normal traffic.
Academic research (de Vries et al.) shows QNAME minimisation in relaxed mode causes almost no problems, increases DNS lookups by up to 26%, and leads to up to 5% more failed lookups, with cache warming substantially reducing the overhead.
If a cached response for a minimised CHILD query is NXDOMAIN and the resolver supports RFC 8020, the NXDOMAIN can be used to answer the original query and stop. If RFC 8020 is not supported, resolution continues from step 3.
QNAME minimisation is compatible with the existing DNS system and does not change the DNS protocol itself; it is only a change to resolver operation, permitted by RFC 1034 Section 5.3.3 and RFC 1035 Section 7.2.
When a DNAME response is received during minimised resolution, the resolver should proceed as if a DNAME was received for the original query and restart from step 0 to resolve the new name based on the DNAME target.
A maximum number of QNAME minimisation iterations MUST be selected (MAX_MINIMISE_COUNT); the RECOMMENDED value is 10.
Optionally, a value for the number of queries that should only have one label appended MAY be selected (MINIMISE_ONE_LAB); a good value is 4.
Resolvers supporting QNAME minimisation MUST implement a mechanism to limit the number of outgoing queries per user request, to prevent abuse via QNAMEs with large numbers of labels.
Stub and forwarding resolvers MAY implement QNAME minimisation, though doing so without a mechanism to find and cache zone cuts will drastically increase the number of outgoing queries.
A minimised query contains: (1) a QTYPE selected by the resolver to possibly obscure the original QTYPE, and (2) the QNAME stripped to just one label more than the longest matching domain name for which the name server is known to be authoritative.
For all other QTYPE queries, the ANCESTOR is the NS RRset whose owner matches the most labels with QNAME, and QNAME is equal to or a subdomain of this NS RRset.
For DS QTYPE queries (where authority lies at the parent side), the ANCESTOR is the NS RRset whose owner matches the most labels with QNAME stripped by one label, and QNAME is a subdomain of (but not equal to) this NS RRset.
When multiple labels remain unexposed and MAX_MINIMISE_COUNT is reached, labels are divided proportionally over remaining iterations; any remainder is added to the last iterations. For example, 18 labels with MAX_MINIMISE_COUNT=10 and MINIMISE_ONE_LAB=4 yields label additions of: 1,1,1,1,2,2,2,2,3,3.
A resolver using QNAME minimisation can be exploited to generate query storms by sending QNAMEs with large numbers of labels answered via wildcard records, bypassing the cache with random labels. Resolvers MUST limit queries per request (MAX_MINIMISE_COUNT) to dampen this attack.
QNAME minimisation reduces exposure of the queried name to authoritative name servers and partially addresses wire-sniffer privacy threats, but offers no protection against the recursive resolver itself, which still sees the full request from the stub resolver.
The QNAME minimisation algorithm iterates: (0) answer from cache or iterate; (1) find closest delegation point (ANCESTOR); (2) initialise CHILD=ANCESTOR; (3) if CHILD==QNAME resolve normally; (4) otherwise add next label(s) to CHILD; (5) check cache; (6) query with responses handled as referral, DNAME, NOERROR, NXDOMAIN, or timeout, looping back appropriately.