[GH-ISSUE #2295] (perf) skip DNSSEC validation altogether on CD=1 queries #960

New issue

Open

opened 2026-03-16 01:05:56 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 01:05:56 +03:00

Owner

Originally created by @japaric on GitHub (Jul 8, 2024).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2295

previous discussion: https://github.com/hickory-dns/hickory-dns/pull/2286#discussion_r1666912699

RFC4035 is not super clear because it does not use MUST, MAY or SHOULD in the relevant sentence but it does section in section 3.2.2:

If the CD bit is set, it indicates that the originating resolver is willing to perform whatever authentication its local policy requires. Thus, the resolver side of the recursive name server need not perform authentication on the RRsets in the response.

One interpretation is that the resolver MAY skip DNSSEC validation altogether when CD is set in the query.

Doing so would reduce the number of network and crypto operations needed to answer uncached CD=1 queries.

Note that unbound does interpret that section like that and instead perform DNSSEC validation regardless of the state of the CD flag. I have not yet checked if BIND does the same as unbound

Originally created by @japaric on GitHub (Jul 8, 2024). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2295 previous discussion: https://github.com/hickory-dns/hickory-dns/pull/2286#discussion_r1666912699 RFC4035 is not super clear because it does not use MUST, MAY or SHOULD in the relevant sentence but it does section in [section 3.2.2](https://datatracker.ietf.org/doc/html/rfc4035#section-3.2.2): > If the CD bit is set, it indicates that the originating resolver is willing to perform whatever authentication its local policy requires. Thus, the resolver side of the recursive name server need not perform authentication on the RRsets in the response. One interpretation is that the resolver MAY skip DNSSEC validation altogether when CD is set in the query. Doing so would reduce the number of network and crypto operations needed to answer uncached CD=1 queries. Note that `unbound` does interpret that section like that and instead perform DNSSEC validation regardless of the state of the CD flag. I have not yet checked if BIND does the same as `unbound`