New Research Casts Light on the Hidden Network Traffic and Efficiency Trade-offs of Locally Served DNS Root Zones

The Domain Name System (DNS) is the foundational phonebook of the internet, translating human-readable domain names into machine-readable IP addresses. At the very apex of this sprawling, global hierarchical structure sit the root servers. Every time a user attempts to resolve a domain name that is not already cached locally, their recursive resolver must query these root servers to find the appropriate top-level domain (TLD) registry. To optimize this process, reduce latency, and enhance user privacy, a model known as "locally served root" has gained traction across the networking community. This approach pre-fetches and stores a local copy of the root zone directly on the resolver, allowing it to rapidly terminate queries for non-existent TLDs without bothering the global root infrastructure.

However, a new collaborative research project has uncovered unexpected consequences regarding how this model impacts network traffic. In a recent episode of the PING podcast, Willem Toorop of NLnet Labs sat down with Ilyas Rahimi, who recently graduated with a Master’s degree in Security and Network Engineering from the University of Amsterdam (UvA), to discuss their comprehensive investigation into the real-world effects of locally served root deployment.

The research stems from a long-standing academic and technical partnership between NLnet Labs and the University of Amsterdam’s renowned OS3 Master’s program. The program—short for Open Standards, Open Software, and Open Security—is closely tied to NLnet Labs, which maintains its operations on the UvA campus. For years, Willem Toorop has worked alongside the university, supervising student research initiatives focusing on critical internet infrastructure, DNS, and DNSSEC (Domain Name System Security Extensions) as part of the Master’s thesis component.

Within the OS3 curriculum, students undertake intensive, month-long original research projects to test their technical mettle and apply theoretical knowledge to practical networking challenges. The second of these major projects typically forms the cornerstone of the student’s Master’s thesis. For his thesis project, Ilyas Rahimi chose to dive deep into the mechanics of locally served root zones, examining how different DNS software implementations handle the retrieval and maintenance of the root zone data.

The concept of a locally served root zone is straightforward in theory, yet complex in execution. By maintaining a local cache of the root zone, a recursive resolver can immediately recognize when a user requests a TLD that does not exist, cutting short the resolution chain and saving valuable milliseconds. Additionally, this method offers notable privacy advantages. Because the resolver already possesses the root zone data, it does not need to leak queries about standard resolvable names to external root servers, thereby limiting the exposure of user lookup patterns to third parties. Recognizing these benefits, the Internet Engineering Task Force (IETF) has been actively reviewing a proposal to formalize locally served root zones as a Best Current Practice (BCP), encouraging wider and more standardized deployment across the global internet.

Despite its growing popularity and the backing of draft BCP standards, the operational implications of continuously updating a local root zone had not been thoroughly measured across multiple software platforms. To fill this knowledge gap, Ilyas evaluated three of the most widely used public DNS resolver codebases: BIND, Unbound, and Knot Resolver. His rigorous testing framework examined each of these software implementations across four distinct operational configurations, looking closely at both traditional in-band retrieval methods for the root zone and modern fetching mechanisms operating over HTTPS.

The findings from Ilyas’s research revealed a nuanced and sometimes surprising picture of network efficiency. While locally served root zones successfully reduce external queries for non-existent domains, the automated cycle required to update the root zone itself can generate a surprisingly heavy volume of network traffic. When a resolver initiates a fetch to update its local copy of the root zone, the sheer size of the data transfer can be substantial. In certain test scenarios, the bandwidth consumed by these zone update cycles actually exceeded the cumulative traffic generated by the far more frequent, but individually much smaller, standard queries sent to root servers for uncached data.

Furthermore, the empirical research process uncovered practical bugs that operational networks might otherwise miss. During his analysis, Ilyas identified a specific bug within the Unbound resolver codebase. This software defect was responsible for an unexpected and sharp spike in network traffic during the update phase, highlighting the critical importance of rigorous testing and telemetry as recursive operators adopt new configuration models.

The insights gained from this study underscore that while the locally served root model offers clear architectural advantages for latency and privacy, network operators must carefully weigh the background traffic overhead introduced by zone synchronization cycles. As the industry moves closer to adopting the IETF Best Current Practice guidelines, understanding these operational trade-offs becomes increasingly vital for large-scale network infrastructure management.

Although Ilyas has successfully completed his Master’s thesis and graduated from the University of Amsterdam, the research into DNS root optimization is far from finished. The academic structure of the OS3 program has recently been updated, allocating more dedicated time within the curriculum for the thesis component. Building on this momentum, Willem Toorop hopes to maintain and expand the ongoing collaboration with UvA students, pushing the boundaries of DNS measurement work even further.

Future phases of this research are already taking shape. Willem has been actively exploring alternative synchronization mechanisms, specifically investigating how resolver systems behave when they utilize incremental zone updates (IXFR)—a protocol designed to transfer only the changes made to a zone—rather than fetching the entire root zone file in its entirety during every update cycle. Such improvements could potentially mitigate the traffic spikes identified in the recent study, making locally served root deployments even more efficient for recursive operators worldwide.