<div><br></div><div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Apr 16, 2021 at 3:04 PM Viktor Dukhovni <<a href="mailto:ietf-dane@dukhovni.org">ietf-dane@dukhovni.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Fri, Apr 16, 2021 at 02:29:07PM -0400, Puneet Sood via dns-operations wrote:<br>
<br>
> Google Public DNS is also planning to cap NSEC3 iterations to a safe value.<br>
> Do you have data you can share on the prevalence of high iteration count<br>
> NSEC3 zones?<br>
<br>
Sure, below are the absolute, percentile, and cumulative percentile<br>
frequencies by iteration count for ~10.9 million domains using NSEC3.<br>
The cumulative numbers are from 0 iterations up, but the table below is<br>
in reverse order, showing the high iterations first, I hope that's not<br>
too confusing.<br>
<br>
The suggested cutoff is presently at 150, with just 279 zones out of<br>
10.9 million using more than 150 iterations.</blockquote><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto">Thank you for doing this work - it’s helpful.</div><div dir="auto"><br></div><div dir="auto">Do you happen to have the list of the 279 anywhere? I realize that it *shouldn’t* matter, but if some of these are really “popular” domains the calculation is different to them being domains which get almost no traffic. Also, perhaps we can do some outreach to the affected domains if easy?</div><div dir="auto"><br></div><div dir="auto">W</div><div dir="auto"><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex" dir="auto"><br>
<br>
#iters #zones %zones cumulative%<br>
------ ------ ------ -----------<br>
4096 1 0.0000 100.0000<br>
2500 3 0.0000 100.0000<br>
2000 1 0.0000 100.0000<br>
1600 50 0.0005 100.0000<br>
1337 2 0.0000 99.9995<br>
1024 1 0.0000 99.9995<br>
500 67 0.0006 99.9995<br>
487 1 0.0000 99.9989<br>
423 1 0.0000 99.9988<br>
400 6 0.0001 99.9988<br>
360 1 0.0000 99.9988<br>
333 3 0.0000 99.9988<br>
330 56 0.0005 99.9987<br>
300 4 0.0000 99.9982<br>
250 61 0.0006 99.9982<br>
200 3 0.0000 99.9976<br>
197 1 0.0000 99.9976<br>
177 17 0.0002 99.9976<br>
----------- suggested cutoff -------------<br>
150 5070 0.0464 99.9974<br>
149 21 0.0002 99.9510<br>
128 6 0.0001 99.9508<br>
127 2956 0.0271 99.9508<br>
120 1 0.0000 99.9237<br>
107 15 0.0001 99.9237<br>
101 1 0.0000 99.9236<br>
100 978251 8.9571 99.9236<br>
99 5 0.0000 90.9665<br>
96 1 0.0000 90.9664<br>
90 20 0.0002 90.9664<br>
85 26 0.0002 90.9662<br>
81 8 0.0001 90.9660<br>
80 1 0.0000 90.9659<br>
75 33 0.0003 90.9659<br>
69 1 0.0000 90.9656<br>
64 16 0.0001 90.9656<br>
55 1 0.0000 90.9654<br>
54 1 0.0000 90.9654<br>
53 1 0.0000 90.9654<br>
52 18 0.0002 90.9654<br>
51 1 0.0000 90.9652<br>
50 11837 0.1084 90.9652<br>
43 1 0.0000 90.8569<br>
42 16 0.0001 90.8568<br>
40 50605 0.4634 90.8567<br>
35 12 0.0001 90.3933<br>
34 1 0.0000 90.3932<br>
33 697 0.0064 90.3932<br>
32 74 0.0007 90.3868<br>
31 4 0.0000 90.3862<br>
30 12 0.0001 90.3861<br>
25 27 0.0002 90.3860<br>
24 66 0.0006 90.3858<br>
23 20 0.0002 90.3852<br>
22 4 0.0000 90.3850<br>
21 5383 0.0493 90.3849<br>
20 510107 4.6707 90.3357<br>
19 5 0.0000 85.6650<br>
18 8 0.0001 85.6649<br>
17 13 0.0001 85.6649<br>
16 14801 0.1355 85.6648<br>
15 4113 0.0377 85.5292<br>
14 19 0.0002 85.4916<br>
13 88 0.0008 85.4914<br>
12 302246 2.7674 85.4906<br>
11 106 0.0010 82.7232<br>
10 1204263 11.0265 82.7222<br>
9 40 0.0004 71.6957<br>
8 1168469 10.6988 71.6953<br>
7 25308 0.2317 60.9965<br>
6 55 0.0005 60.7648<br>
5 1366608 12.5130 60.7643<br>
4 40 0.0004 48.2513<br>
3 28243 0.2586 48.2509<br>
2 3816 0.0349 47.9923<br>
1 5234737 47.9305 47.9574<br>
0 2933 0.0269 0.0269<br>
<br>
-- <br>
Viktor.<br>
_______________________________________________<br>
dns-operations mailing list<br>
<a href="mailto:dns-operations@lists.dns-oarc.net" target="_blank">dns-operations@lists.dns-oarc.net</a><br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" rel="noreferrer" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br>
</blockquote></div></div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">Perhaps they really do strive for incomprehensibility in their specs.<br>After all, when the liturgy was in Latin, the laity knew their place.<br>-- Michael Padlipsky<br></div></div>