Economical With The Truth: Making DNSSEC Answers Cheap

This post details Cloudflare's optimization of DNSSEC negative answers (NXDOMAIN and NODATA) to reduce compute cost and response size. It explains the standard DNSSEC negative answer structure involving SOA, NSEC, and NSEC3 records, highlighting the computational expense and information leakage associated with NSEC's zone walking. Cloudflare's RRDNS server, built in Go and using a key-value store instead of zone files, dynamically generates answers. To address the cost and complexity of returning previous/next names for negative answers, Cloudflare implements a custom solution that avoids returning NSEC records for NXDOMAIN responses. Instead, it returns a specific RRSIG record that proves the non-existence of the name without revealing zone structure. For NODATA responses, it still returns an NSEC record but only one, proving the existence of the name and specifying the types that do exist.