DNS, Transitive Trust and How Many is Many#

Ondřej Surý, ISC

• Why: A genuinely surprising measurement: resolving teams.microsoft.com on a cold cache triggers 247 outgoing queries from a single recursive resolver — with real implications for latency, load, and the transitive trust surface CDNs are building.
• What: A cold-cache tour through delegation types: in-domain delegations are cheap (glue mandatory, no extra cost), in-bailiwick adds 0–N×2 queries, and out-of-bailiwick delegations force the resolver to resolve each NS name from scratch — 3 + 3×N queries per name. CNAME chains make this multiplicative, not additive: each target zone may be out-of-bailiwick and each NS-set spans TLDs.
• How: All numbers from BIND 9, adding one complexity source at a time; notably, resolver software matters enormously — the same name cost 168 queries on BIND 9.11 but only 16 on 9.21. DNSSEC and the often-forgotten PTR case add more.
• Where applicable: Resolver operators, CDN/zone architects thinking about delegation hygiene, and anyone debugging cold-cache latency spikes.