NDLI: DNSSEC meets real world: dealing with unreachability caused by fragmentation

Content Provider	IEEE Xplore Digital Library
Author	van den Broek, G. van Rijswijk-Deij, R. Sperotto, A. Pras, A.
Copyright Year	1979
Abstract	The Domain Name System (DNS) provides a critical service on the Internet: translating host names into IP addresses. Traditional DNS does not provide guarantees about authenticity and origin integrity. DNSSEC, an extension to DNS, improves this by using cryptographic signatures, at the expense of larger response messages. Some of these larger response messages experience fragmentation, and may, as a result of that, be blocked by firewalls. As a consequence, resolvers behind such firewalls will no longer receive complete responses from name servers, leading to certain Internet zones becoming unreachable because no translation into IP addresses can be performed. Our research shows that despite ongoing efforts to educate firewall and resolver administrators, as much as 10 percent of all resolvers suffer from fragmentation-related connectivity issues. Given that some major Internet companies were reluctant to adopt even a technology like IPv6 if it meant that a small percentage of their users would have connectivity issues, it is clear that we cannot rely on resolver/firewall operators alone to tackle this issue. The contribution of this article is that it a) quantifies the severity of these DNSSEC deployment problems, based on extensive measurements at a major National Research and Education Network (NREN) and backed up by validation of these findings at an independent second location, b) proposes two potential solutions at the DNS authoritative name server side, and c) validates both solutions, again based on extensive measurements on the operational network of this major NREN. The article concludes with a recommendation favoring our first solution. The first solution is relatively simple to implement and gives DNS zone operators control over this problem without having to rely on all resolver operators solving the issue
Starting Page	154
Ending Page	160
Page Count	7
File Size	199394
File Format	PDF
ISSN	01636804
Volume Number	52
Issue Number	4
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2014-01-01
Publisher Place	U.S.A.
Access Restriction	One Nation One Subscription (ONOS)
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Servers IP networks Internet Software Computer aided software engineering Time factors
Content Type	Text
Resource Type	Article
Subject	Computer Networks and Communications Electrical and Electronic Engineering Computer Science Applications

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Real-time audio and video broadcasting of IEEE GLOBECOM '96 over the Internet using new software

Internet-Scale IPv4 Alias Resolution With MIDAR

iSPY: Detecting IP Prefix Hijacking on My Own

Structuring Internet media streams with cueing protocols

VoIP and NAT/firewalls: issues, traversal techniques, and a real-world solution

Analysis of Country-Wide Internet Outages Caused by Censorship

Touring DNS Open Houses for Trends and Configurations

Improved algorithms for synchronizing computer network clocks

Internet Web servers: workload characterization and performance implications

DNSSEC meets real world: dealing with unreachability caused by fragmentation

Similar Documents

Real-time audio and video broadcasting of IEEE GLOBECOM '96 over the Internet using new software

Internet-Scale IPv4 Alias Resolution With MIDAR

iSPY: Detecting IP Prefix Hijacking on My Own

Structuring Internet media streams with cueing protocols

VoIP and NAT/firewalls: issues, traversal techniques, and a real-world solution

Analysis of Country-Wide Internet Outages Caused by Censorship

Touring DNS Open Houses for Trends and Configurations

Improved algorithms for synchronizing computer network clocks

Internet Web servers: workload characterization and performance implications

DNSSEC meets real world: dealing with unreachability caused by fragmentation