[GH-ISSUE #2938] Recursor optimization: fetch one more NS record before sending original query #1095

New issue

Closed

opened 2026-03-16 01:35:53 +03:00 by kerem · 1 comment

kerem commented

2026-03-16 01:35:53 +03:00

Owner

Originally created by @divergentdave on GitHub (Apr 17, 2025).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2938

Since #2919, the first lookup that uses the original recursive query, plus ns_pool_for_referral(), plus the second lookup, act as an unrolling of the last loop of the QNAME minimization resolver algorithm, but with a tweak. We send the original query to the name server for the parent of the QNAME first, and then, if that returns a referral, we send the original query to the name server for QNAME itself. This results in suboptimal privacy, because we have not fully minimized queries to authoritative name servers, and whenever we query for names that are not at the apex of a zone, we make an extra query that does not cache well. If we instead queried for NS records all the way up to QNAME (or its parent, in the case of DS records), then those NS queries would be more cacheable, and we would only need to send one lookup with the original query.

Originally created by @divergentdave on GitHub (Apr 17, 2025). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2938 Since #2919, the first lookup that uses the original recursive query, plus `ns_pool_for_referral()`, plus the second lookup, act as an unrolling of the last loop of the QNAME minimization resolver algorithm, but with a tweak. We send the original query to the name server for the parent of the QNAME first, and then, if that returns a referral, we send the original query to the name server for QNAME itself. This results in suboptimal privacy, because we have not fully minimized queries to authoritative name servers, and whenever we query for names that are not at the apex of a zone, we make an extra query that does not cache well. If we instead queried for NS records all the way up to QNAME (or its parent, in the case of DS records), then those NS queries would be more cacheable, and we would only need to send one lookup with the original query.