EDNS Compliance
A Year On

Mark Andrews
marka@isc.org

What We Are Testing●5 data sets
–Root zone–

Alexa Top 1000

–Alexa Bottom 1000 of top 1 million–Alexa .AU entries–Alexa .GOV entries●9 tests per <zone,server address> (was 8)●

Run the tests daily

EDNS Compliance by Function of EDNS Aware Servers - 1 Apr 2015
100

EDNS 0
Truncated
Response
DNSSEC75

Unknown
Option%Unknown Flag
50

EDNS 1
Fully Compliant

250TLD

TopBottom
Data Subset© 2015 Internet Systems ConsortiumGOVAU

EDNS Compliance by Function of EDNS Aware Servers - 1 Apr 2016
100

EDNS 0
Truncated
Response
DNSSEC75

Unknown
Option%Unknown Flag
50

EDNS 1
Fully Compliant

25

0TLDTopBottom
Data Subset© 2015 Internet Systems Consortium

GOVAU

Biggest Changes

TLD Servers

EDNS Compliance Report: 2016-04-02T12:38:29Z

Percentage of EDNS aware servers that passed all EDNS compliance tests
100

Root and TLD
Servers
Alexa Top
1000 Servers

90

Alexa Bottom
1000 Servers

80

Alexa .GOV
Servers
70

Alexa .AUServers

60

50
Oct 2014© 2015 Internet Systems Consortium

Jan 2015

Apr 2015

Jul 2015

Oct 2015

Jan 2016

Apr 2016

EDNS Compliance Report: 2016-04-02T12:38:29Z

Root and TLD EDNS(1) Failure Reasons20

refused,version
timeoutformerr,badversion

15

soastatus
version10

status,noopt,
soastatus,soa

50
Oct 2014

Jan 2015

Apr 2015

Jul 2015

Oct 2015

Jan 2016

Apr 2016

Trends●EDNS Support still increasing●BASIC EDNS(0) Compliance slowly improving●EDNS(1) Compliance slowly getting worse●Unknown EDNS option behaviour slowlyimproving

EDNS Compliance Report: 2016-04-02T12:38:29Z

Percentage of responding servers that are EDNS aware100

Root and TLDServers
Alexa Top
1000 Servers

95

Alexa Bottom
1000 Servers
Alexa .GOVServers

90

Alexa .AUServers
8580
Oct 2014

Jan 2015

Apr 2015

Jul 2015

Oct 2015

Jan 2016

Apr 2016

EDNS Compliance Report: 2016-04-02T12:38:29Z

Percentage of EDNS aware servers that passed plain EDNS(0) check100

Root and TLD
Servers

98

Alexa Top 1000
Servers

96

Alexa Bottom
1000 Servers

94

Alexa .GOV
Servers
Alexa .AU
Servers

92

90

88
Oct 2014

Jan 2015

Apr 2015

Jul 2015

Oct 2015

Jan 2016

Apr 2016

EDNS Compliance Report: 2016-04-02T12:38:29Z

Percentage of EDNS aware servers that passed plain EDNS(1) check100

Root and TLD
Servers
Alexa Top 1000
Servers

90

Alexa Bottom
1000 Servers
Alexa .GOV
Servers

80

Alexa .AU
Servers7060

Oct 2014

Jan 2015

Apr 2015

Jul 2015

Oct 2015

Jan 2016

Apr 2016

EDNS Compliance Report: 2016-04-02T12:38:29Z

Percentage of EDNS aware servers that handled unknown EDNS(0) options correctly
100

Root and TLDServers
Alexa Top 1000
Servers

95

Alexa Bottom
1000 Servers
Alexa .GOVServers

90

Alexa .AU
Servers85

80
Oct 2014

Jan 2015

Apr 2015

Jul 2015

Oct 2015

Jan 2016

Apr 2016

EDNS Compliance Report: 2016-04-02T12:38:29Z

Alexa .GOV Servers EDNS(1) Failure Reasons
20

timeout
formerr,
badversion
status15status,noopt,soastatus,soa
10status,noopt
badversion50
Oct 2014© 2015 Internet Systems Consortium

Jan 2015

Apr 2015

Jul 2015

Oct 2015

Jan 2016

Apr 2016

EDNS Compliance Report: 2016-04-02T12:38:29Z

Alexa .GOV Servers EDNS(0) Unknown Option Failure Reasons
12

noopt
timeout
badvers
formerr,echoed,
nosoa

9

echoednosoa

6

servfail,version,nosoa
servfailstatus,version,nosoa

3

refusedstatus,noopt,…
0
Oct 2014

Jan 2015

Apr 2015

Jul 2015

Oct 2015

Jan 2016

Apr 2016

cy. @194.42.1.55 (ns2.ucy.ac.cy.): dns=ok edns=ok edns1=timeout edns@512=ok ednsopt=ok edns1opt=timeout do=okednsflags=timeout optlist=okcy. @194.42.29.1 (cynic.dns.cy.): dns=ok edns=ok edns1=timeout edns@512=ok ednsopt=ok edns1opt=timeout do=okednsflags=timeout optlist=ok
dj. @193.251.143.162 (bow.intnet.dj.): dns=ok edns=ok edns1=timeout edns@512=ok ednsopt=ok edns1opt=timeout do=okednsflags=timeout optlist=oket. @213.55.64.38 (ns2.telecom.net.et.): dns=ok edns=noopt edns1=status,noopt,soa edns@512=noopt ednsopt=noopt
edns1opt=status,noopt,soa do=noopt ednsflags=noopt optlist=ok,nsid
eu. @93.190.128.138 (cz.dns.eu.): dns=ok edns=ok edns1=ok edns@512=ok ednsopt=ok edns1opt=ok do=ok ednsflags=mbz
optlist=ok,nsid
gy. @190.80.0.41 (ns1.gtt.co.gy.): dns=ok edns=noopt edns1=status,noopt,soa edns@512=noopt ednsopt=noopt
edns1opt=status,noopt,soa do=noopt ednsflags=noopt optlist=ok,nsid
gy. @190.80.0.42 (ns2.gtt.co.gy.): dns=ok edns=noopt edns1=status,noopt,soa edns@512=noopt ednsopt=noopt edns1opt=status,soa
do=ok ednsflags=noopt optlist=ok,nsid
kp. @175.45.176.15 (ns1.kptc.kp.): dns=ok edns=ok edns1=timeout edns@512=ok ednsopt=ok edns1opt=timeout do=okednsflags=timeout optlist=ok
kp. @175.45.176.16 (ns2.kptc.kp.): dns=ok edns=ok edns1=timeout edns@512=ok ednsopt=ok edns1opt=timeout do=okednsflags=timeout optlist=ok
kw. @161.252.48.140 (dns1.kw.): dns=ok edns=ok edns1=timeout edns@512=ok ednsopt=ok edns1opt=timeout do=okednsflags=timeout optlist=okkw. @161.252.48.150 (dns2.kw.): dns=ok edns=ok edns1=timeout edns@512=ok ednsopt=ok edns1opt=timeout do=okednsflags=timeout optlist=okkw. @161.252.48.145 (dns3.kw.): dns=ok edns=ok edns1=timeout edns@512=ok ednsopt=ok edns1opt=timeout do=okednsflags=timeout optlist=okmil. @199.252.162.234 (con2.nipr.mil.): dns=ok edns=ok edns1=timeout edns@512=ok ednsopt=ok edns1opt=timeout do=okednsflags=timeout optlist=ok
nc. @202.87.129.16 (ns1.nc.): dns=ok edns=ok edns1=timeout edns@512=ok ednsopt=ok edns1opt=timeout do=ok ednsflags=timeout
optlist=ok
nc. @202.87.129.17 (ns2.nc.): dns=ok edns=ok edns1=timeout edns@512=ok ednsopt=ok edns1opt=timeout do=ok ednsflags=timeout
optlist=ok
ps. @213.244.82.147 (dns1.gov.ps.): dns=ok edns=ok edns1=timeout edns@512=ok ednsopt=ok edns1opt=timeout do=okednsflags=timeout optlist=oksohu. @182.131.23.22 (f.zdnscloud.com.): dns=ok edns=ok edns1=timeout edns@512=timeout ednsopt=timeout edns1opt=ok do=okednsflags=timeout optlist=timeout
tr. @213.248.162.131 (ns3.nic.tr.): dns=ok edns=ok edns1=timeout edns@512=ok ednsopt=ok edns1opt=timeout do=okednsflags=timeout optlist=okuz. @83.69.138.230 (ns4.uz.): dns=ok edns=ok edns1=timeout edns@512=ok ednsopt=timeout edns1opt=ok do=timeout

EDNS Compliance Report: 2016-04-02T12:38:29ZRoot and TLD Servers Supported EDNS Options
100.0

expire50.0

nsid
subnetcookie

10.0
5.0

1.0
0.5

0.1
Oct 2014© 2015 Internet Systems Consortium

Jan 2015

Apr 2015

Jul 2015

Oct 2015

Jan 2016

Apr 2016

Test Your Own Zones

https://ednscomp.isc.org/ednscomp