EDNS Client Subnet(ECS)    !+AE=G>I9DG*&)"21;>I?CG?,

+3#.+'057B6H>8@F:I<+3#.+',0-$4
1,*&).+'1(&0-#  *%&)4/ ,3-$4©Akamai Technologies, 20192

"2CDN 4A:A9,5B=60#/5B<B0 !'*
*5B<B)&A B "URL,?6;)-/@326;) !(5B<B)1376 $%
( .)+ ,) "')<8318> $%)

*;'&?2!  ,@5@!&*.-$DNS *)<!#$917?+A DNS"B ' !  $&?,@%

DNS

 DNS  IP&3>-%*)<DNS

 HTTP ",@6-!
&*.-

4@:,@5@ (8=</=5@) " IP &3>-%0(1*!  ,@5@" IP &3>-% DNS sqEail {tOMeQLQ)
yb IP o~xn5lR^Ospo}b:n5lR^^6J[ekUyn2Vlspo}O}w3aDQaIeZ\LlQbJ yc ISP h79b8 b (DL) gbn#SmlYfJRb'-c^\g( aL\PYK (: GGSN/P-GW c &r ]WmXmayO:Nm\Ll)
HhA=aUY k$k`_J*C`u}g;GSLB (Global Server Load Balancing) hJTraffic Management 6^dmJ+v^T\b?hvx^T\Q%Sm\Llyb IP o~xNjF `vnG"VlNcWmXm0<b!>K
1J{}sB/J,.4@JvA=|zI…

T%T
•

IP Anycast
&Tf}q}SH IP ^oyh]LI<J[K[Tpln{}bAX-5]
= (x}m_|cT.!PGN6?f}q}S^bihFIZ':: "p}tf}q}O'R#0B3): 41SHN YZRQ+ARe|nz}xBOCR?< S8Tilgu|B/<*•HTTP OTwj`ybgu|*<^rwd}gu|rznexOT
^rwd}gu|f}q}O7 IP ^oyh]kalbG<S9Rf}q}B>Z UTf}q}S^bihGR@FIZ*':: bv`^|nT IP ^oyhSM?N$OCZ): ;BAAZ<HshnPGNT8OURDRZ<*J[K[:<)>Y<2T%],V \IZEPW 0DNS 32A)-/?9=C4!+" (ADNSB'  A8B<'#(/1$(DNS•
*>BA8B<D1#&/@D7D!0%)
• (5C;C:*) 6D<D!>BA8B<D-., "DNS S8OT6Q>< DNS (pvugvn{) d{oeS<PF[RY[?)• OpenDNS (2005)• Google Public DNS (2009)→ HSR<K@IP Anycast ^+B\/@Q\VHbt`_ykR7BPJ]EZ"
m{sd{n{R_bfeL\YCRL\PTBD=,FA\3S ISP OW..
• )*-RB X@nhbr{ySF'%R.OGQB ISP• cyjyiS! RY\;z @9S4#RY[@1^:2KM[@(OSmhkx{bP0S(Rd{n{[5$ &]ECS (EDNS Client Subnet) - pvugvn{EZ"m{sd{n{USbauR@
4#bt`_ykS IP _lweSdqmhk^NI\EDNS (0) - RFC 6891
DNS dn^SlC – ) (Additional) YQUjoB 1OPT2 Pseudo () RR (41)
OPT DC&!A RR ? AIcOph\^>KJI (QkW* ?TTL* L$)••

UDP BGI DNS i\YpVTNX (RFC 1035 >D 512bit) C9AckR (DO b\^ – DNSSEC OK)•mWgoWSp_ (RCODE) #,C – BADVERS (16)

•PdUjoC)(PdUjoSp_? +CPdUjo]pZCfM)"]pZL8=QkNMo^ - Tpap,>FH?H)• EDNS Client Subnet (RFC 7871 / PdUjoSp_ 8)• DNS Cookie (RFC 7873 / PdUjoSp_ 10)• Padding (RFC 7830 / PdUjoSp_ 12)• DNSSEC Key Tag (RFC8145 / PdUjoSp_ 14)• Client ID / Device ID C. (-:5eo[p%>'0 26946 F 65073 A@)
OPT  RR %D 1 <:5/PdUjoDA6=E(3;=EG4(RFC 2671 / 2673 >$7J9kelZNdD RFC 6891 >)

EDNS (OPT)>A *PdUj`lEDNS (0) (#)LQPDQJR – IRNBRJR+2•

DNSSEC •

3,=-1•DNS Flag Day)*84&(0+2$

 (EDNS +. , DO KFH"*7:. )+GL?QH+ EDNS <CEMPDQJR – LQPDQJR+12•LQPDQJR+ DNSSEC  <)*5'9CEMPDQJR12;7. ( AD LOA6 CD LOA/2 EDNS 2 +2. )•dig +•DNS-over-TLSDNS-over-HTTPS /!%9 Padding'9@>P2GL?QH+ EDNSEDNS Client Subnet (ECS) – RFC 7871
• EDNS (0) AQFV[ (Option Code: 8) ;',DW><[K1 IP <L
ZG1EPMIK (<LZG.QZO=DG) ;57.7(8•.',OYXHYN\.M\SE\N\1 -:98
RFC-2DW><[K$6 ECS ; & *) 0+",4• O@\RIKOPTION-CODE ( 8 )OPTION-LENGTH ( ADJIK )XD?GK%
• CTIFU')"
• <[E\-2XD?GK
141$6#/"FAMILY ( IPv4: 1 / IPv6: 2 )SORCE PREFIX-LENGTHSCOPE PREFIX-LENGTH

ADDRESS…
( QZO=DG3-! : /17/24 /6 3ADJIK )<[E\%• 1B
N\• XD?GK-2
00

EDNS Client Subnet (ECS)dig   () $ dig () +subnet=192.0.2.0/23();; OPT PSEUDOSECTION:; EDNS: version: 0, flags:; udp: 512; CLIENT-SUBNET: 192.0.2.0/23/24;; QUESTION SECTION:Wireshark / tshark12( ) ECS E
HOC38L6BN#8IEAFC4/\jaVj]jI^feYf]jI:M;M,"D 2L•^feYf]j5<2EH\jaVj]jEUReD
•••8L DNS 3$N*9C2I1L_dQ]Wj→ URe+\jaVj]E`hQZeXZ\jaVj]j•••7<4C5MG ECS F( (S_WciN =@$) 7@K2+ IP P[gXJ ECS D?2@!CL IP P[gXN*86B%30%&EP[gXN>5LUdQPiZF.7<4C2 (XTbiEM) → URe+E`hQZeXZ\jaVj]jB^feYf]jBE/)3'(- DNS AF
B7@ ECS N>5LIEI1L)
13ECS N&-C7>/LGD...JHL Bb[po• `pfWpapE SOURCE @BL SCOPE N)7>GI/• SCOPE N+57>)9 -> EIK"2/Wd`\]D 37/(clkZlapE8>kVSY]N*7>GI/)• SCOPE N57>)9 -> IK$/ ?
(192.0.2.0/16 @/0DE`\]npVO^mY%(@7>E127/D<3)
SOURCE @ SCOPE DemcPVY+D/ (O^mY ,D/) ?Uh\Xi
clkZlap?E:DA09L2qg_[pD'q• clkZlapFDVSkCVjQOo]3 ECS N=6>GI/• VjQOo]3 Forwarding Resolver D clkZlapE6ML2? 6MB/BJ REFUSED) VjQOo]D=6>4; ECS 3#D!9L`\]npV• Te]OR] ( SOURCE-PREFIX-LENGTH=0 )14

q~}k~pQ?D]&=• ECS LBR#0R%Sgrolm%N Qezlh{QF^:5grolm @[}fdjm`DKRW_^]ECS AL=M=P=XRY SCOPE=0 R#0S6 6\DQezlh{• grolmA1@= (sqbfj8A8=) VO…;
• grolmR'ACP] = ezlh{7 (xy}) A>]4$• grolm<K\Rf|camAPCP] = ezlh{vjA>]4$(+TRfd}R :!#0)9R )• tcm}jmR (+owgp:nxc:JR)• f|cam@[GK ECS Ru}h* ECS ` -H]EN`3>]N:olmf R IP anjR \"MQ?=M:olmfmuiY,.2`P]UC/=sqblfjQ(FI]RAZ=@XG^P=15

ECS COfps\enmZnbsNSlPOr_7 ;>4L B/=L(*H^s[Yr[@C)"C 'a]_qsS_gpWs%B)• SlPOr_C+B<>enmZnbsN K>L• / DNS '2 C IP O`oX?/=LDUscX$ (SlPOr_) Pr[seQPXN IP Anycast ? =L!
• UsbsC75L ,G3L72@<!?.1N• (64 ?O`oX7elTir_;>EJF6M>4LD ECS IKG
&Ah]drT7 ,AG• Rj]Vk7elTir_:ML9@BILRj]Vk #CG08

IPv6 4SJOZE$ECS
7BLYGPATW8.?/?-2'=5> (%>73 ( ! HTTP$7

#" DVCBZK (GIQWHXN[) 4PXWHXN[47KVZGR[K# PXWHXN[4M[UF[N[47WEB
F[N[
M[UF[N[7!

PXWHXN[7KVZGR[K•IPv6 70:7BLYG (!) 7SJOZE@PXWHXN[7IPv4 BLYG (#) 6;125&+4 (908.7) (-&>•ECS (") 8,<65> (%>•ECS @*>4M[UF[N[8 " 4 # 3)>"ECS 04&/+8 .83*8/8)4&%7- #"!04&/+8 
• 16&-5,• (0-%'- - RFC 7871 )4&%7- SOURCE-PREFIXLENGTH=0  ECS $#(0-%'-#$• Mozilla  Trusted Recursive Resolver 25+8
https://wiki.mozilla.org/Security/DOH-resolver-policy180+ QNAME
whoami.(ipv4|ipv6|ds).akahelp.net IN TXT."7 (ECS 0(*)  DNS$ dig @X.X.X.X whoami.ipv4.akahelp.net TXT +short"ns" "198.51.100.1" ß  CMG>MDM31=;I (+46EJI@JDM) 19BK?
"ecs" "192.0.2.0/24/0" ß  CMG>MDM%(* ECS! /24 -"7'.%$7"ip" "192.0.2.14" ß ECS 1 19BK?%HLAG-7 ( CMG>MDM02 1IP9BK?2$5/#)$."7 (ECS 0(*) EJI@JDM$ dig @Y.Y.Y.Y whoami.ipv4.akahelp.net TXT +short"ns" "203.0.113.1""ecs" "192.0.2.0/24/0""ip" "203.0.113.1" ß "ns" . )$9<F:1 CMG>MDM21 ECS 8&6(,#7%(,#/#'.%$719

akahelp.net はデバッグ目的で提供されるものであり、動作に保証を行うものではありません。

+& QNAME ( )

<HA5H=H+

41E"'./$ dig @Z.Z.Z.Z whoami.ipv4.akahelp.net TXT +subnet=10.0.0.0/8 +norec +noall +comments +answer; <<>> DiG 9.14.0 <<>> @Z.Z.Z.Z whoami.ipv4.akahelp.net TXT +subnet=10.0.0.0/8 +norec +noall +comments+answer; (1 server found);; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61295;; flags: qr aa; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1;; OPT PSEUDOSECTION:; EDNS: version: 0, flags:; udp: 4096 ß OPT  + 2@6DG:H8%'*;; ANSWER SECTION:= >FE7F=H,5?<9;0"*(3B96C$/- (SCOPE/0))whoami.ipv4.akahelp.net. 20
IN
TXT"ns" "192.0.2.101"
whoami.ipv4.akahelp.net. 20
IN
TXT"ecs" "10.0.0.0/8/0"
whoami.ipv4.akahelp.net. 20
IN
TXT"ip" "192.0.2.101" ß "ns" )#$0 "'/!)0 $ 20

akahelp.net はデバッグ目的で提供されるものであり、動作に保証を行うものではありません。

-( QNAME ( 2) IPv6…
NS - A + AAAA '%

E=FB

AIC9IBI-58;:#2<I:/ E=FB- $ dig @X.X.X.X whoami.ds.akahelp.net TXT +short"ns" "2001:DB8:XXXX::104" ß IPv4&'%1IPv6 &'%1"ecs" "192.0.2.0/24/0" ß ECS/8D65H? E=FB-3$%.<I:IP5@G:4-")2"ip" "192.0.2.14" ß ECS. .5@G:DH>C*2 ( AIC9IBI-/ .IP5@G:/0,)$

$ $ dig @W.W.W.W whoami.ipv6.akahelp.net TXT +noall +answer +comment; <<>> DiG 9.14.0 <<>> @Z.Z.Z.Z whoami.ipv6.akahelp.net TXT +noall +answer +comment; (1 server found);; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 43045 ß . E=FB/IPv4*"87E4!,J;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1()21akahelp.net はデバッグ目的で提供されるものであり、動作に保証を行うものではありません。