Summary

  • Geoff Huston and two co-authors propose that a non-validating recursive resolver clear the DNSSEC OK (DO) bit when the incoming query does not ask for DNSSEC records.
  • APNIC Labs observed the DO bit in 60.2% of 36.3 billion measured queries during a week ending 3 November 2026. The proposed resolver would have to record which cached answers lack signatures and fetch them again for a later DO query.

A DNS resolver can order a cryptographic receipt it has no intention of checking. Geoff Huston wants that habit priced before post-quantum signatures make the receipt much larger. In his APNIC analysis, he reports that 60.2% of 36.3 billion queries measured by APNIC Labs in a week ending 3 November carried the DNSSEC OK, or DO, bit. The sample is APNIC’s measurement traffic, not a census of every DNS query.

APNIC lists Huston as its chief scientist. With Warren Kumari and Peter Thomassen he has written an individual Internet-Draft: if a recursive resolver does not validate DNSSEC and its incoming query has DO clear, it should clear DO on the query it sends upstream. An authoritative server could then omit DNSSEC records, saving response bytes and, for large future signatures, some TCP retries.

The trick moves work into the cache. The draft says the resolver must remember whether a cached response was obtained without DNSSEC material. A later client asking with DO set needs a fresh authoritative query. That is the bill for suppressing a signature request early. The authors call the proposal a working idea and describe possible extra queries and complexity. Existing RFC 4035 behavior tells security-aware resolvers to set DO; this draft is a proposed change, not current standard behavior.

Huston’s earlier TCP measurements asked whether resolvers follow a truncated answer. This proposal asks who requested the oversized answer in the first place. Its success would require evidence that bytes and TCP work saved exceed the additional cache misses and implementation risk.