IP Fragmentation Avoidance in DNS over UDP

Metadata

Publisher: IETF
Doc Type: Informational
Pages: 13
Abstract: The widely deployed Extension Mechanisms for DNS (EDNS(0)) feature in the DNS enables a DNS receiver to indicate its received UDP message size capacity, which supports the sending of large UDP responses by a DNS server. Large DNS/UDP messages are more likely to be fragmented, and IP fragmentation has exposed weaknesses in application protocols. It is possible to avoid IP fragmentation in DNS by limiting the response size where possible and signaling the need to upgrade from UDP to TCP transport where necessary. This document describes techniques to avoid IP fragmentation in DNS.
Publication Date: 2025-01-01
Status Note: Informational
DOI: 10.17487/RFC9715
Link: https://doi.org/10.17487/RFC9715
Author(s): Kazunori Fujiwara
Paul A. Vixie
Keyword(s): DNS, IP Fragmentation

Latest version of IETF RFC 9715

Document Versions — IETF RFC 9715

▶ IETF RFC 9715 (2025-01-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

IETF RFC 1035 [Active, Amended*]
IETF RFC 1191 [Active*]
IETF RFC 2119 [Active*]
IETF RFC 2931 [Active*]
IETF RFC 6891 [Active*]
IETF RFC 7739 [Active*]
IETF RFC 7766 [Active*]
IETF RFC 8085 [Active*]
IETF RFC 8174 [Active*]
IETF RFC 8200 [Active*]
IETF RFC 8201 [Active*]
IETF RFC 8899 [Active*]
IETF RFC 8945 [Active*]
IETF RFC 9499 [Active*]

Bibliographic Reference(s)

10.1109-CNS.2013.6682711 — Herzberg2013 EXTERNAL
10.1145-3243734.3243790 — Brandt2018 EXTERNAL
Huston, G. and J. Damas, "Measuring DNS Flag Day 2020", OARC 34 Workshop, February 2021, <https://indico.dns-oarc.net/event/37/contributions/806/attachments/782/1366/2021-02-04-dns-flag.pdf>. EXTERNAL
"DNS flag day 2020", <https://dnsflagday.net/2020/>. EXTERNAL
Fujiwara, K., "Measures against DNS cache poisoning attacks using IP fragmentation", OARC 30 Workshop, 2019, <https://indico.dns-oarc.net/event/31/contributions/692/attachments/660/1115/fujiwara-5.pdf>. EXTERNAL
Hlavacek, T., "IP fragmentation attack on DNS", RIPE 67 Meeting, 2013, <https://ripe67.ripe.net/presentations/240-ipfragattack.pdf>. EXTERNAL
IETF RFC 791 [Active*]
IETF RFC 2308 [Active*]
IETF RFC 2671 [Superseded*]
IETF RFC 2782 [Active*]
IETF RFC 4035 [Active*]
IETF RFC 5155 [Active*]
IETF RFC 8900 [Active*]
IETF RFC 9460 [Active*]
IETF RFC 9471 [Active*]

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC9715.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 9715, IP Fragmentation Avoidance in DNS over UDP. Available at https://doi.org/10.17487/RFC9715

Snippet:

IETF RFC 9715, IP Fragmentation Avoidance in DNS over UDP. Available at https://doi.org/10.17487/RFC9715

HTML (ISO 690 compliant)

Preview:

IETF RFC 9715, IP Fragmentation Avoidance in DNS over UDP. Available at https://doi.org/10.17487/RFC9715

Snippet:

<span class="citation"><cite>IETF RFC 9715</cite>, IP Fragmentation Avoidance in DNS over UDP. Available at <a href="https://doi.org/10.17487/RFC9715" target="_blank" rel="noopener">https://doi.org/10.17487/RFC9715</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 9715, IP Fragmentation Avoidance in DNS over UDP
doi: 10.17487/RFC9715
url: https://doi.org/10.17487/RFC9715

Snippet:

<li>
<cite id="bib-rfc9715">IETF RFC 9715</cite>, IP Fragmentation Avoidance in DNS over UDP
<span class="doi">10.17487/RFC9715</span>
</li>

Referenced By

IETF RFC 10001 [Active*]