0

There are many articles stating like the following:

Because all the information of 13 root servers can be packed into a single UDP packet, but 15 or more cannot, so 13 was chosen.

However, according to https://www.iana.org/domains/root/servers, all the IP addresses of the 13 root servers are fixed. Then, there is no need to query the IP addresses of all root servers.

In what case is it necessary to query the IP addresses of all DNS root servers?

Is the number of DNS root servers necessarilly restricted to 13?

  • Nothing in this question is specific to Unix and Linux, note. Compare superuser.com/q/390390/38062 . – JdeBP Dec 17 '19 at 5:53
  • 3
    I'm voting to close this question as off-topic because it's more general than U&L and should be on Super User – muru Dec 17 '19 at 6:09
  • 1
    Also, where in that IANA page does it say that the IPs are fixed? – muru Dec 17 '19 at 6:10
3

First, it was not always 13. It was only 9 (if I recall correctly) before all root servers were renamed as X.root-servers.net.

Renaming root servers enables one to use DNS name compression, which means that in a DNS packet, having a.root-servers.net and b.root-servers.net uses basically the same size as just one name (plus few bytes, because basically root-servers.net as string will appear only once in the DNS packet), where having foobar42.example and acme51.test would use all the space needed to store the two strings in the packet.

So, for:

Is the number of DNS root servers necessarilly restricted to 13?

Yes, to keep the UDP packet below a given size that is guaranteed to not be fragmented nor generate problems.

But note that adding new nameservers (and new IP addresses) is mostly useless right now. As you can see on https://root-servers.org/ all root name servers are now anycasted: they physically exist in multiple locations and each of their IP addresses is being resolved in various locations. This enables fail over. Adding more names or IP addresses would not significantly enhance the current system and in fact would have a bigger problem: who to give the new nameservers administration? This is a huge policy problem. Administrators of root servers are in some way under contract with ICANN (for coordination among them) and in some way completely independant (to avoid capture, this was Postel's explicit goal when choosing the first entities managing nameservers). Few years ago every country kind of wanted to host a root nameserver, thinking that it would give them any advantage on the policy table or as an "e-enabled" country, or claiming that the system is current only under control of the USA which is not right for an "international" shared resource like the Internet (but since then most of them understood that they do not need that... they can locally have other root nameservers, force local ISPs to use a given list instead of IANA ones, or hijack current root nameservers IP addresses). It was blocked because at the technical level it is not possible, nor advisable. But on the "governance" level it would open a kind of worms.

all the IP addresses of the 13 root servers are fixed.

This is not true, at least not in the long run. IP addresses do change. It happened in the past, and can happen in the future.

See for example this last case: https://root-servers.org/news/b-root-ipv4-address-renumbered.txt

August 10, 2017

The IPv4 address for b.root-servers.net will be renumbered to 199.9.14.201, effective 2017-10-24.

The old IPv4 address (192.228.79.201) will continue to answer queries for at least 6 months.

You can find other IPv4/IPv6 renumbering at https://root-servers.org/news.html

Then, there is no need to query the IP addresses of all root servers.

This is not the problem. Recursive nameservers are shipped with the list of root nameservers and their IP addresses, so that there is no "chicken and egg" problem. But due to the "priming design", recursive nameservers will query at boot one of those to download an updated list (and hence we go back to the condition of having the UDP packet small enough to make sure it travels safely everywhere), and maybe other ones if the first one did not reply (was filtered). So technically all of them should be there, as fallback.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.