[GH-ISSUE #2917] Recursive resolver: consider making QNAME minimization optional #1087

New issue

Open

opened 2026-03-16 01:34:45 +03:00 by kerem · 2 comments

kerem commented

2026-03-16 01:34:45 +03:00

Owner

Originally created by @divergentdave on GitHub (Apr 8, 2025).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2917

As discussed in https://github.com/hickory-dns/hickory-dns/issues/2788#issuecomment-2692909774, we may want to consider making QNAME minimization optional.

RFC 9156 cites research that shows certain forms of QNAME minimization are broadly compatible. (There's a newer measurement paper published a couple years ago as well, see https://link.springer.com/chapter/10.1007/978-3-031-28486-1_21.) However, our implementation of the recursion algorithm has known issues (#2788), we have not implemented some of the fallbacks described, and we use NS queries, which have more compatibility problems than A queries. We can adopt these various improvements, but separately, making QNAME minimization a configurable feature would give users a simple workaround if needed.

Originally created by @divergentdave on GitHub (Apr 8, 2025). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2917 As discussed in https://github.com/hickory-dns/hickory-dns/issues/2788#issuecomment-2692909774, we may want to consider making QNAME minimization optional. [RFC 9156](https://www.rfc-editor.org/rfc/rfc9156.html#name-experience-from-rfc-7816) cites research that shows certain forms of QNAME minimization are broadly compatible. (There's a newer measurement paper published a couple years ago as well, see https://link.springer.com/chapter/10.1007/978-3-031-28486-1_21.) However, our implementation of the recursion algorithm has known issues (#2788), we have not implemented some of the fallbacks described, and we use NS queries, which have more compatibility problems than A queries. We can adopt these various improvements, but separately, making QNAME minimization a configurable feature would give users a simple workaround if needed.

kerem commented

2026-03-16 01:34:51 +03:00

Author

Owner

@cpu commented on GitHub (Mar 11, 2026):

I think being able to disable qname minimization is likely important (or a blocker?) for https://github.com/hickory-dns/hickory-dns/issues/2725

If unboundtest.com is still roughly approximating the Let's Encrypt unbound config, then I think it would be necessary to match the current settings:

$ curl https://unboundtest.com/conf 2>/dev/null | grep qname
    qname-minimisation: no
    qname-minimisation-strict: no

@cpu commented on GitHub (Mar 11, 2026): I think being able to disable qname minimization is likely important (or a blocker?) for https://github.com/hickory-dns/hickory-dns/issues/2725 If [unboundtest.com](https://unboundtest.com) is still roughly approximating the Let's Encrypt unbound config, then I think it would be necessary to match the current settings: ``` $ curl https://unboundtest.com/conf 2>/dev/null | grep qname qname-minimisation: no qname-minimisation-strict: no ```

kerem commented

2026-03-16 01:34:56 +03:00

Author

Owner

@cpu commented on GitHub (Mar 11, 2026):

However, our implementation of the recursion algorithm has known issues (https://github.com/hickory-dns/hickory-dns/issues/2788), we have not implemented some of the fallbacks described, and we use NS queries, which have more compatibility problems than A queries

The unbound docs for qname-minimisation-strict are also fairly pessimistic about qname minimization without fallback to the full domain (what we've implemented AFAICT):

A lot of domains will not be resolvable when this option in enabled. Only use if you know what you are doing

@cpu commented on GitHub (Mar 11, 2026): > However, our implementation of the recursion algorithm has known issues (https://github.com/hickory-dns/hickory-dns/issues/2788), we have not implemented some of the fallbacks described, and we use NS queries, which have more compatibility problems than A queries The unbound docs for [`qname-minimisation-strict`](https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#unbound-conf-qname-minimisation-strict) are also fairly pessimistic about qname minimization without fallback to the full domain (what we've implemented AFAICT): > A lot of domains will not be resolvable when this option in enabled. Only use if you know what you are doing