Summary

  • QNAME minimisation reduces what a non-terminal authoritative server learns; it does not hide the full request from the recursive resolver.
  • A cold resolver may need several progressively longer questions to discover zone cuts, while a warm cache can shorten or eliminate that work.
  • Operational proof must preserve the upstream sequence, its cache context and its stopping reason.

The revealing failure begins with a green privacy flag. A resolver reports minimisation enabled, yet one cold-cache lookup emits several label probes before failing at an unusual delegation. A later retry succeeds with one upstream exchange because the cache is warm. The flag did not change. The observable privacy and reliability contract did.

RFC 9156 replaces the traditional habit of sending the full original QNAME and QTYPE throughout iterative resolution. A minimising resolver asks a known authority only for the next name needed to discover a delegation, and it can use a query type unrelated to the client’s original type. The final authoritative server still receives the name needed to answer; earlier servers receive less.

That sounds like a packet rewrite, but it is really a sequence algorithm. A resolver knows some zone cuts from cache and must discover others. If it knows the servers for example but not whether bar.example is delegated, it asks progressively. Deep names can therefore create more upstream questions on a cold cache. RFC 9156 requires a limit on outgoing queries per client request and discusses a recommended MAX_MINIMISE_COUNT of ten. That is a protocol recommendation, not a universal service threshold.

Cache state can reverse the apparent cost. Delegations learned earlier shorten the walk. An authoritative NXDOMAIN can stop it even sooner. RFC 8020 describes the NXDOMAIN cut: cached nonexistence at a node can make names below it unreachable without another upstream query. With minimisation, one negative answer near the top of a nonexistent branch can prevent repeated disclosure and traffic beneath it. That wider effect also amplifies a false NXDOMAIN; DNSSEC validation is the stated protection against cache-poisoning risk at this boundary.

Negative evidence has its own trust boundary. RFC 8198 permits a validating resolver to use cached NSEC or NSEC3 records aggressively and synthesize negative answers for names it never queried. That can protect authoritative capacity, but it also means an upstream trace alone does not explain the client response. The receipt must say whether the answer came from a direct response, an NXDOMAIN cut or a DNSSEC-validated cache proof, and which TTL bounded its use.

Minimisation also has a precise privacy limit. RFC 9076 treats DNS privacy as a problem with several observers. The recursive resolver still receives the client’s full question. An on-path observer may still see traffic unless transport is protected. QNAME minimisation reduces disclosure to authorities that do not need the complete name; it does not substitute for encrypted stub-to-recursive transport or trustworthy resolver operation.

Compatibility fallback deserves explicit evidence. An operator may relax behaviour for a broken authority to preserve resolution. That can be a bounded availability decision, but a silent fallback converts a measurable privacy exception into an invisible permanent policy. Record the authority, failure class, relaxed step, expiry and successful retest.

The useful unit is therefore one client request plus its derived work: closest-known delegation, queries sent, labels exposed, QTYPE chosen, cache proofs used, fallback taken and final result. Aggregates can retain those fields without retaining a permanent dossier of full user names.