RFC support benchmarking

[zbalkan]

I tried to compare TDNS to ARSoft.Tools.Net and the result is amazing.

What that project did is impressive, though, many RFCs are experimental and not commonly used. Still, the time and effort out on it is impressive.

RFC Support Comparison

Technitium DNS Server supports 21 RFCs, while ARSoft.Tools.Net supports 100 RFCs, with 14 RFCs common to both implementations.[1]

Category	RFCs	Count
Common	RFC 1995, RFC 1996, RFC 2136, RFC 4255, RFC 6672, RFC 6698, RFC 6891, RFC 7553, RFC 7766, RFC 7858, RFC 7871, RFC 8484, RFC 8945, RFC 8976	14 [1]
Technitium Only	RFC 5782, RFC 6147, RFC 8914, RFC 9103, RFC 9156, RFC 9250, RFC 9432	7 [1]
ARSoft Only	RFC 1034, RFC 1035, RFC 1183, RFC 1348, RFC 1637, RFC 1706, RFC 1712, RFC 1876, RFC 2163, RFC 2168, RFC 2181, RFC 2230, RFC 2308, RFC 2535, RFC 2536, RFC 2537, RFC 2539, RFC 2671, RFC 2672, RFC 2673, RFC 2782, RFC 2845, RFC 2915, RFC 2930, RFC 2931, RFC 3110, RFC 3123, RFC 3225, RFC 3226, RFC 3403, RFC 3425, RFC 3596, RFC 3597, RFC 3658, RFC 3755, RFC 3757, RFC 4025, RFC 4033, RFC 4034, RFC 4035, RFC 4398, RFC 4406, RFC 4408, RFC 4431, RFC 4509, RFC 4635, RFC 4648, RFC 4701, RFC 4795, RFC 5001, RFC 5155, RFC 5205, RFC 5452, RFC 5702, RFC 5864, RFC 5933, RFC 5936, RFC 5966, RFC 6563, RFC 6594, RFC 6605, RFC 6742, RFC 6762, RFC 6840, RFC 6844, RFC 6975, RFC 7043, RFC 7129, RFC 7208, RFC 7218, RFC 7314, RFC 7344, RFC 7477, RFC 7479, RFC 7828, RFC 7830, RFC 7873, RFC 7929, RFC 8005, RFC 8080, RFC 8162, RFC 8427, RFC 8749, RFC 8777, RFC 9210, RFC 9373	86

In sum, ARSoft provides broader DNSSEC and legacy record support, while Technitium emphasizes modern protocols like XFR-over-TLS and Catalog Zones.

Do you have a checklist of these RFCs for supported, not yet supported and not to be supported? This yould be nice to have. An hour of planning would save hours of coding time.

[ShreyasZare]

Thanks for asking. Listing supported RFC is in my to-do list since long time but have missed it due to other tasks. So thanks for reminding about this. Will get this added soon.

I guess that the comparison was generated by AI since it has missed many things. It seems that only RFCs mentioned in the project readme were compared which is why the, for example, list says that RFC 1033/1034/1035 are not implemented by Technitium.

[zbalkan]

It would be nice to have a separate page for RFCs with status like, implemented, planned, not planned, etc.

[ShreyasZare]

Ya, a separate md page in the repo with link on the readme is best to have.

[zbalkan]

I started writing unit tests on this PR, and it is a very long project of mine. I write tests on how classes DO work, not how they SHOULD work. That's something else. But I found some edge cases and input validation guards here and there.

When I finish the unit tests on TechnitiumLibrary project, I'll come to here for unit tests.

And when all unit tests are completed, I'll check if any unit tests are related to any RFCs supported. I'll then try to write tests which ensure the behavior matches the RFC, so not only robustness but also FC-compliance will be part of test harness.

Finally, I'll write security specific tests like fuzzing and basic DNS attacks written as if they are unit tests.

In the meanwhile, can you work on RFC.md and OSTIF Security Best Practices Guide along with new features you are working on? and if you need help on the second one, please let me know.

Is this okay for you?

[ShreyasZare]

Its fine. Will get the RFC md page added when I can find some time in between.

For the OSTIF, apart from the documentation part, rest of the things seems to be ok, like there is already a security.md published. Its not feasible for me to write documentation for the entire project since I can either write code or write documentation in whatever time that is available.

[zbalkan]

I'll handle the documentation and ask for review. Leave it to me. I'm working as a a security and compliance manager. Working on policy documents is literally my job.

[zbalkan]

I tried to make it a matrix. When you have time, if you can update this, it would be amazing. This would be a good benchmark. I can then even extend this to other DNS servers like BIND, POWERDNS, Knot, Unbound, etc.

RFC Support Matrix

The complete matrix lists all 107 unique RFCs from both Technitium DNS Server and ARSoft.Tools.Net, sorted by RFC number. Support marked as "+" (explicitly documented) or "-" (not listed).

Order	RFC Number	RFC Name	TDNS	ARSoft
1	RFC 1034	Domain Names - Concepts and Facilities	-	+
2	RFC 1035	Domain Names – Implementation and Specification	-	+
3	RFC 1183	New DNS RR Definitions	-	+
4	RFC 1348	DNS NSAP RRs	-	+
5	RFC 1637	DNS NSAP Resource Records	-	+
6	RFC 1706	DNS NSAP Resource Records	-	+
7	RFC 1712	DNS Encoding of Geographical Location	-	+
8	RFC 1876	A Means for Expressing Location Information in the Domain Name System	-	+
9	RFC 1995	Incremental Zone Transfer	+	+
10	RFC 1996	A Mechanism for Prompt Notification of Zone Changes (DNS NOTIFY)	+	+
11	RFC 2136	Dynamic Updates in the Domain Name System	+	+
12	RFC 2163	Using the Internet DNS to Distribute MIXER Conformant Global Address Mapping (MCGAM)	-	+
13	RFC 2168	Resolution of Uniform Resource Identifiers using the Domain Name System	-	+
14	RFC 2181	Clarifications to the DNS Specification	-	+
15	RFC 2230	Key Exchange Delegation Record for the DNS	-	+
16	RFC 2308	Negative Caching of DNS Queries (DNS NCACHE)	-	+
17	RFC 2535	Domain Name System Security Extensions	-	+
18	RFC 2536	DSA KEYs and SIGs in the Domain Name System	-	+
19	RFC 2537	RSA/MD5 KEYs and SIGs in the Domain Name System	-	+
20	RFC 2539	Storage of Diffie-Hellman Keys in the Domain Name System	-	+
21	RFC 2671	Extension Mechanisms for DNS (EDNS0)	-	+
22	RFC 2672	Non-Terminal DNS Name Redirection	-	+
23	RFC 2673	Binary Labels in the Domain Name System	-	+
24	RFC 2782	A DNS RR for specifying the location of services (DNS SRV)	-	+
25	RFC 2845	Secret Key Transaction Authentication for DNS (TSIG)	-	+
26	RFC 2915	The Naming Authority Pointer (NAPTR) DNS Resource Record	-	+
27	RFC 2930	Secret Key Establishment for DNS (TKEY RR)	-	+
28	RFC 2931	DNS Request and Transaction Signatures (SIG(0)s) (Record parsing only)	-	+
29	RFC 3110	RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System	-	+
30	RFC 3123	A DNS RR Type for Lists of Address Prefixes (APL RR)	-	+
31	RFC 3225	Indicating Resolver Support of DNSSEC	-	+
32	RFC 3226	DNSSEC and IPv6 A6 aware server/resolver message size requirements	-	+
33	RFC 3403	Dynamic Delegation Discovery System (DDDS)	-	+
34	RFC 3425	Obsoleting IQUERY	-	+
35	RFC 3596	DNS Extensions to Support IP Version 6	-	+
36	RFC 3597	Handling of Unknown DNS Resource Record (RR) Types	-	+
37	RFC 3658	Delegation Signer (DS) Resource Record (RR)	-	+
38	RFC 3755	Legacy Resolver Compatibility for Delegation Signer (DS)	-	+
39	RFC 3757	Domain Name System KEY (DNSKEY) Resource Record (RR) Secure Entry Point (SEP) Flag	-	+
40	RFC 4025	A Method for Storing IPsec Keying Material in DNS	-	+
41	RFC 4033	DNS Security Introduction and Requirements	-	+
42	RFC 4034	Resource Records for the DNS Security Extensions	-	+
43	RFC 4035	Protocol Modifications for the DNS Security Extensions	-	+
44	RFC 4255	Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints	+	+
45	RFC 4398	Storing Certificates in the Domain Name System (DNS)	-	+
46	RFC 4406	Sender ID: Authenticating E-Mail	-	+
47	RFC 4408	Sender Policy Framework (SPF)	-	+
48	RFC 4431	The DNSSEC Lookaside Validation (DLV) DNS Resource Record	-	+
49	RFC 4509	Use of SHA-256 in DNSSEC Delegation Signer (DS) Resource Records (RRs)	-	+
50	RFC 4635	HMAC SHA TSIG Algorithm Identifiers	-	+
51	RFC 4648	The Base16, Base32, and Base64 Data Encodings	-	+
52	RFC 4701	A DNS Resource Record (RR) for Encoding Dynamic Host Configuration Protocol (DHCP) Information (DHCID RR)	-	+
53	RFC 4795	Link-Local Multicast Name Resolution (LLMNR)	-	+
54	RFC 5001	DNS Name Server Identifier (NSID) Option	-	+
55	RFC 5155	DNS Security (DNSSEC) Hashed Authenticated Denial of Existence	-	+
56	RFC 5205	Host Identity Protocol (HIP) Domain Name System (DNS) Extension	-	+
57	RFC 5452	Measures for Making DNS More Resilient against Forged Answers	-	+
58	RFC 5702	Use of SHA-2 Algorithms with RSA in DNSKEY and RRSIG Resource Records for DNSSEC	-	+
59	RFC 5782	DNSBL / RBL block lists	+	-
60	RFC 5864	DNS SRV Resource Records for AFS	-	+
61	RFC 5933	Use of GOST Signature Algorithms in DNSKEY and RRSIG Resource Records for DNSSEC	-	+
62	RFC 5936	DNS Zone Transfer Protocol (AXFR)	-	+
63	RFC 5966	DNS Transport over TCP - Implementation Requirements	-	+
64	RFC 6147	DNS64 function	+	-
65	RFC 6563	Moving A6 to Historic Status	-	+
66	RFC 6594	Use of the SHA-256 Algorithm with RSA, Digital Signature Algorithm (DSA), and Elliptic Curve DSA (ECDSA) in SSHFP Resource Records	-	+
67	RFC 6605	Elliptic Curve Digital Signature Algorithm (DSA) for DNSSEC	-	+
68	RFC 6672	DNAME Redirection in the DNS	+	+
69	RFC 6698	The DNS-Based Authentication of Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA	+	+
70	RFC 6742	DNS Resource Records for the Identifier-Locator Network Protocol (ILNP)	-	+
71	RFC 6762	Multicast DNS (One-shot queries only)	-	+
72	RFC 6840	Clarifications and Implementation Notes for DNS Security (DNSSEC)	-	+
73	RFC 6844	DNS Certification Authority Authorization (CAA) Resource Record	-	+
74	RFC 6891	Extension Mechanisms for DNS (EDNS(0))	+	+
75	RFC 6975	Signaling Cryptographic Algorithm Understanding in DNS Security Extensions (DNSSEC)	-	+
76	RFC 7043	Resource Records for EUI-48 and EUI-64 Addresses in the DNS	-	+
77	RFC 7129	Authenticated Denial of Existence in the DNS	-	+
78	RFC 7208	Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1	-	+
79	RFC 7218	Adding Acronyms to Simplify Conversations about DNS-Based Authentication of Named Entities (DANE)	-	+
80	RFC 7314	Extension Mechanisms for DNS (EDNS) EXPIRE Option	-	+
81	RFC 7344	Automating DNSSEC Delegation Trust Maintenance	-	+
82	RFC 7477	Child-to-Parent Synchronization in DNS	-	+
83	RFC 7479	Using Ed25519 in SSHFP Resource Records	-	+
84	RFC 7553	The Uniform Resource Identifier (URI) DNS Resource Record	+	+
85	RFC 7766	DNS Transport over TCP - Implementation Requirements	+	+
86	RFC 7828	The edns-tcp-keepalive EDNS0 Option (Option parsing only)	-	+
87	RFC 7830	The EDNS(0) Padding Option	-	+
88	RFC 7858	Specification for DNS over Transport Layer Security (TLS)	+	+
89	RFC 7871	Client Subnet in DNS Queries	+	+
90	RFC 7873	Domain Name System (DNS) Cookies (Option parsing only)	-	+
91	RFC 7929	DNS-Based Authentication of Named Entities (DANE) Bindings for OpenPGP	-	+
92	RFC 8005	Host Identity Protocol (HIP) Domain Name System (DNS) Extension	-	+
93	RFC 8080	Edwards-Curve Digital Security Algorithm (EdDSA) for DNSSEC	-	+
94	RFC 8162	Using Secure DNS to Associate Certificates with Domain Names for S/MIME	-	+
95	RFC 8427	Representing DNS Messages in JSON	-	+
96	RFC 8484	DNS Queries over HTTPS (DoH)	+	+
97	RFC 8749	Moving DNSSEC Lookaside Validation (DLV) to Historic Status	-	+
98	RFC 8777	DNS Reverse IP Automatic Multicast Tunneling (AMT) Discovery	-	+
99	RFC 8914	Extended DNS Errors	+	-
100	RFC 8945	Secret Key Transaction Authentication for DNS (TSIG)	+	+
101	RFC 8976	Message Digest for DNS Zones	+	+
102	RFC 9103	Zone transfer over TLS (XFR-over-TLS)	+	-
103	RFC 9156	QNAME minimization	+	-
104	RFC 9210	DNS Transport over TCP - Operational Requirements	-	+
105	RFC 9250	DNS-over-QUIC / XFR-over-QUIC	+	-
106	RFC 9373	EdDSA Value for IPSECKEY	-	+
107	RFC 9432	Catalog Zones	+	-

[ShreyasZare]

Thanks for the suggestion. If such comparison is done by a 3rd party then it looks fine but doing such a comparison on the project's main documentation does not seem good. Also, its tough to keep maintaining the document since every new entry would mean that one has to find out if its supported by various other DNS server software.

[zbalkan]

Well, I didn't think about it that way. But you're right. But if you can fill up the TDNS part, we can remove the ARSoft.Tools.Net. It can be temporarily used as a guide or template so that some RFCs are not forgotten.

[ShreyasZare]

List of DNS RFCs are available on the Internet. So, I just need some time to go through it and select the ones that are implemented for this doc.

[zbalkan]

However you want. I just wanted to support you in the process. If you want me to do something specific to help you, please let me know.

I chose ARSoft.Tools.Net documentation as it is a similar project.