DNS root server naming test yields unexpected results

The global DNS root server naming scheme, unchanged since 1995, is undergoing its first major technical review in nearly a decade. A recent study commissioned by ICANN’s Root Server System Advisory Committee (RSSAC) has tested six alternative naming schemes for the 13 root servers, with results that challenge long-held assumptions about backward compatibility and security trade-offs.

Root servers, identified by letters A through M under the root-servers.net domain, form the foundation of the DNS hierarchy. While only 13 distinct names exist, each represents a globally distributed anycast cluster operated independently. The current naming structure creates a circular dependency: resolvers must locate root servers to bootstrap DNS, yet the root server names reside within a domain that itself requires root server resolution. This paradox is resolved through an unsigned "priming" response containing glue records, a method that has remained static since its 1995 implementation.

What the study measured

The RSSAC 028 study, initiated in 2017, focused on two primary objectives: evaluating the feasibility of DNSSEC-signing the root server naming domain and assessing the impact of alternative naming schemes on the priming response size. Researchers from NLnet Labs and SIDN Labs tested six candidate naming structures, measuring their effect on the 512-byte UDP packet limit that has governed DNS priming since the protocol’s early days.

Contrary to expectations, the study found that DNSSEC-signed priming responses could remain within the 512-byte limit across all tested naming schemes. This discovery addresses a key concern that had stalled progress for nearly a decade—the fear that cryptographic signatures would push packet sizes beyond legacy system compatibility. The findings suggest that the technical barrier to securing root server naming may be lower than previously assumed.

Why the results matter

The current unsigned priming response presents a security vulnerability that has persisted for nearly 30 years. While the response is carefully curated to minimize risk, its lack of cryptographic validation leaves it susceptible to manipulation. The study’s results indicate that DNSSEC signing could be implemented without breaking compatibility with older resolvers, a critical consideration for the internet’s foundational infrastructure.

Willem Toorop, a researcher at NLnet Labs, discussed the implications in a recent APNIC podcast. He noted that while the technical path forward appears clearer, the DNS community’s cautious approach means any changes would still require years of further testing and consensus-building. The study also revealed that some naming schemes performed better than others in terms of packet size efficiency, though all remained within acceptable limits.

What comes next

The study’s findings have reignited discussions within ICANN and the broader DNS operations community. While no immediate changes to root server naming are expected, the results provide a data-driven foundation for future policy decisions. The next steps will likely involve additional testing of the most promising naming schemes, particularly those that balance security improvements with minimal disruption to existing infrastructure.

For operators, the study serves as a reminder that foundational DNS components are not static. While the root server system has remained largely unchanged for decades, the technical and security landscape continues to evolve. The possibility of DNSSEC-signed root server names—once considered a distant prospect—now appears more achievable than previously thought.