Speakers
Description
QNAME minimization (RFC 7816 / RFC 9156) reduces the information a recursive resolver leaks to upstream authoritative servers, but it does so by walking a name's label hierarchy one query at a time. For the vast majority of names this costs little, but for names with an unusually deep label structure, the same incremental walk can multiply the number of upstream queries needed to resolve a single lookup. This tradeoff is well understood in theory, but there is little published data on how often it actually occurs in production traffic, or at what depth it starts to matter operationally.
We present a fleet-wide measurement of domain name label-count distribution, collected across 700+ resolver instances spanning 50 globally distributed data centers and covering hundreds of billions of queries. We characterize the shape of this distribution, with particular attention to its tail, and identify the point at which increasing label depth stops reflecting legitimate zone structure and starts reflecting degenerate, misconfigured, or adversarial names. We use this data to reason about where a practical cutoff belongs: a maximum label count beyond which QNAME minimization is disabled for that specific query, preserving the privacy benefit for the overwhelming majority of real-world names while avoiding disproportionate query amplification for the rest.
We then describe how we turned this measurement into an operational safeguard — a configurable threshold in our resolver's runtime configuration, rather than a hardcoded limit — and share our methodology so other operators, can replicate what we did and derive a threshold suited to what they actually see, rather than an arbitrary number.
| Talk duration | 20 Minutes (+5 for Q&A) |
|---|
