RFC 2671

RFC 2671
Title	RFC 2671
Type	Standards Track
Authors	Paul Vixie
Organization	Internet Engineering Task Force
Published	1999-08
Status	Historic

RFC 2671

Introduction

RFC 2671 describes an extension mechanism for the Domain Name System that enables larger protocol messages and additional features beyond those defined in RFC 1035 and IPv4. The document defines EDNS0 as a backward-compatible signaling method to negotiate extended message size and options between User Datagram Protocol endpoints and DNSSEC-aware resolvers. It was produced within the Internet Engineering Task Force working groups and influenced implementations by vendors such as ISC (Internet Systems Consortium), BIND, Microsoft, and Cisco Systems.

Background and Objectives

The motivation for RFC 2671 arose from operational limits in the original Domain Name System specifications in RFC 1035 and interoperability challenges encountered by large-scale deployments like ARIN, RIPE NCC, and APNIC. Objectives included enabling larger UDP datagrams to accommodate records used by DNSSEC and other emerging features deployed by organizations such as ICANN, IANA, and research projects at MIT, Stanford University, and University of California, Berkeley. The extension sought compatibility with existing infrastructure operated by entities including VeriSign, Akamai Technologies, Cloudflare, and national registries like Nominet and Denic while remaining acceptable to standards bodies such as the Internet Architecture Board and the Internet Engineering Steering Group.

DNS Extension Mechanisms (EDNS0) Specification

RFC 2671 specifies the EDNS0 option as defined in the Domain Name System protocol header space, introducing an OPT pseudo-RR to carry metadata. The mechanism was discussed in IETF meetings alongside proposals from implementers including Paul Vixie and influenced subsequent work in the DNS Extensions (dnsext) working group. EDNS0 provides a negotiation channel used by software like BIND, Unbound, PowerDNS, Knot DNS, and resolver stacks in FreeBSD, Linux, and Windows Server to advertise capabilities such as increased UDP payload sizes and extended flags for experiments by projects at ISOC and W3C-related deployments. Vendors including Cisco Systems, Juniper Networks, and content delivery networks like Fastly and Cloudflare incorporated EDNS0 to support the adoption of DNSSEC and the operational requirements of large operators such as Google and Facebook.

Protocol Details and Message Format

The RFC defines the OPT pseudo-resource record with fields for UDP payload size, extended RCODE, version, and flags. This format interacts with packet handling in User Datagram Protocol and fallbacks to Transmission Control Protocol when fragmentation or truncation occurs, considerations familiar to engineers at IETF and implementers from ISC (Internet Systems Consortium), Microsoft, and Linux Foundation projects. The extended RCODE and version fields anticipated future work later standardized in specifications maintained by IANA, and the pseudo-RR model influenced subsequent protocol extensions like those considered in RFC 6891 and discussions involving standards contributors at ESnet and ARIN. The message format required attention in networking stacks within operating systems such as FreeBSD, NetBSD, OpenBSD, and Microsoft Windows NT lineages.

Deployment and Implementation

Following publication, EDNS0 saw rapid adoption by recursive resolvers and authoritative servers maintained by operators including VeriSign, Akamai Technologies, Google Public DNS, and Cloudflare. Implementations appeared in widely used software packages like BIND, Unbound, PowerDNS, and embedded systems by Cisco Systems and Juniper Networks. Deployment lessons were shared at venues such as ICANN meetings, IETF plenaries, and operator forums like NANOG and RIPE Meetings, where issues involving middleboxes, [`firewalls`] and NAT devices from vendors such as Cisco Systems and Juniper Networks were discussed. The extension influenced later protocol work adopted by major service providers including Amazon Web Services, Microsoft Azure, and content platforms like Akamai Technologies.

Security Considerations

RFC 2671 addresses risks tied to larger UDP messages, fragmentation, and amplification that concern security teams at organizations like CERT Coordination Center, US-CERT, and national Computer Emergency Response Teams such as CERT-EU. The extension increased the surface for potential amplification attacks exploited in distributed denial-of-service incidents investigated by entities including Cloudflare, Akamai Technologies, and Dyn (DNS provider), prompting mitigations discussed at IETF and in operator communities like NANOG. Interaction with DNSSEC raised questions for cryptographic implementers from NIST, IETF TLS WG, and research groups at ETH Zurich and University of Cambridge about validation behavior, replay resistance, and the integrity of extended fields. Operational guidance and later specifications by IETF working groups and registry oversight by IANA refined safeguards to balance functionality and resilience across the global DNS ecosystem.

Category:Internet standards