| Internet-Draft | Refusing QTYPE=RRSIG Queries | August 2026 |
| Surý, et al. | Expires 15 February 2027 | [Page] |
The Domain Name System (DNS) allows a query with QTYPE=RRSIG. Such a query has no useful answer. RRSIG resource records are meaningful only together with the resource records they cover, so a response can carry no more than an arbitrary subset of the signatures present at the query name. This document specifies that DNS responders refuse queries with QTYPE=RRSIG, and that DNS requestors do not send them. It supplies the guidance that [RFC8482] left unspecified.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 15 February 2027.¶
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
The Domain Name System (DNS) allows a query with QTYPE=RRSIG [RFC4034]. The RRSIG resource records at a name are the signatures covering the other types present at that name, and each of them can be validated only together with the RRset it covers. A response to a query with QTYPE=RRSIG therefore carries an arbitrary subset of the signatures at the query name, chosen by the responder, that a validating resolver can neither validate nor usefully cache.¶
The DNSSEC specification [RFC4033] [RFC4034] [RFC4035] does not describe the behaviour of DNS responders or DNS requestors for such queries. Section 7 of [RFC8482] observed that queries with QTYPE=RRSIG resemble queries with QTYPE=ANY, but did not specify the behaviour for them. This document specifies it: responders refuse the query, and requestors do not send it.¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶
This document assumes familiarity with terminology specific to the Domain Name System (DNS) as described in [RFC9499].¶
The terms "requestor" and "responder" are used as defined in Section 2 of [RFC6891]. The term "requestor" corresponds to the term "initiator" used in [RFC8482].¶
There is no legitimate use of a query with QTYPE=RRSIG. The signatures a validating resolver needs are the ones covering the RRsets it asked for, and those are returned together with the covered RRsets whenever DNSSEC data is requested [RFC4035]. A validating resolver that receives RRSIG resource records without the resource records they cover cannot validate them and discards the whole answer.¶
Queries with QTYPE=RRSIG are attractive for amplification attacks that use spoofed source addresses and UDP transport [RFC5358]. The response is the concatenation of every signature at the query name and is large in relation to the query; at the time of writing, a query for the RRSIG type at the root produces a response of approximately 1200 octets.¶
A recursive resolver answers a query with QTYPE=RRSIG from whatever happens to be in its cache at the time, so the same query returns a different set of signatures from one moment to the next.¶
Some authoritative DNS server implementations require additional processing in order to send a conventional RRSIG response; avoiding that processing expense might be desirable. A server that generates signatures on demand has to generate all of them to answer one such query.¶
Some existing DNS server implementations, both recursive and authoritative, already respond to queries with QTYPE=RRSIG with RCODE=REFUSED.¶
A DNS responder SHOULD refuse a query with QTYPE=RRSIG and return a response with RCODE=REFUSED. The response SHOULD contain the Extended DNS Error [RFC8914] code 21 (Not Supported). This applies to authoritative servers and recursive resolvers alike.¶
The query SHOULD be refused before any lookup is performed. The answer, authority, and additional sections of the response are empty, and the TC bit MUST NOT be set: the response is complete, and repeating the query over TCP does not produce a different result.¶
Refusing queries with QTYPE=RRSIG does not affect DNSSEC. RRSIG resource records continue to be included in the responses for the types they cover whenever DNSSEC data is requested, as specified in [RFC4035].¶
A DNS requestor MUST NOT send a query with QTYPE=RRSIG. A resolver MUST NOT send such a query to a DNS responder: the answer can be neither validated nor cached, so the query serves no purpose.¶
Diagnostic and debugging tools MAY send a query with QTYPE=RRSIG in order to observe the behaviour of a DNS responder.¶
A DNS requestor that receives RCODE=REFUSED in response to a query with QTYPE=RRSIG SHOULD NOT repeat the query to another server, over another transport, or with different EDNS parameters. The refusal is a complete answer.¶
Section 7 of [RFC8482] states that it does not specify appropriate behaviour for queries with QTYPE=RRSIG. This document specifies that behaviour.¶
The treatment specified here differs from the treatment [RFC8482] specifies for QTYPE=ANY. A query with QTYPE=ANY has many valid answers and a responder can return any one of them; a query with QTYPE=RRSIG has none, so there is nothing to return and the query is refused instead.¶
Cloudflare authoritative servers respond to queries with QTYPE=RRSIG with RCODE=REFUSED and the Extended DNS Error code 21 (Not Supported).¶
BIND 9 version in development refuses queries with QTYPE=RRSIG with RCODE=REFUSED and the Extended DNS Error code 21 (Not Supported), on authoritative servers and recursive resolvers alike, and never sends such queries to other servers.¶
Responses to queries with QTYPE=RRSIG are large in relation to the query and are therefore useful in reflection attacks that use spoofed source addresses [RFC5358]. Refusing the query removes that amplification.¶
Refusing queries with QTYPE=RRSIG is not a DNSSEC downgrade. The signatures needed for validation are carried in the responses for the types they cover, and a validating resolver never has to query for the RRSIG type in order to validate an answer. An off-path attacker can forge the REFUSED response, but a conventional response to a query with QTYPE=RRSIG carries nothing a validating resolver can act on, so the forgery gains the attacker nothing.¶
This document has no IANA actions.¶
TODO acknowledge.¶