Loading Times for DNSSEC-enabled Zones

This set of measurements test the time it takes for a server to load a signed zone vs. the time it takes to load an unsigned zone. Here, load time is defined as the time when the server daemon starts/restarts to the time it is ready to answer queries. The server may do other things during this time, but those values are a constant and short compared to the time it takes to load a zone from a static file.

System Information: 64-bit server
DNS Information: single zone with variable number of names in the zone. Each name has one, five or ten RRs associated with each name. DNSSEC-enabled zones signed using a single 1024 bit zone signing key.

BIND Results

The BIND centric tests used version 9.4.1 and included the basic named.conf configuration for an authoritative only server. Each scenario was run several times and the results averaged to produce a single load time. For zones that contain one, five and ten RRs per owner name, the following graphs are produced:

Discussion

First thing that is seen is the rapid increase in loading time when DNSSEC is introduced. This should not be a big surprise when considering the previous discussion on zone file size growth with DNSSEC. Taking those numbers into consideration, it naturally follows that the zone with 10 RRs per owner name would take longer to load than a zone with only one RR per owner name because, when signed, there is a RRSIG for each RRset (in every zone in the test, each RRset is made up of one record), so the more unique RRs in a zone, the more RRSIGs there will be when a zone is signed. From the previous study, RRSIGs make up the majority of a signed zone (i.e. they are often the largest RRsets in the zone), so the more RRSIG RRs in a zone, the longer it takes to load.

NSD Results

The same zones in the BIND tests above were repeated using NSD (ver. 3.0.7). However, given the way NSD operates, the time required includes not just the NSD server daemon load times, but also the time spent contstructing the NSD formatted database. NSD is different than BIND in that there is a pre-processing step involved that converts the text zone file to a specially formatted database file which can be quickly loaded into the zone server. This allows the server to be started quickly, but requires a seperate step in coverting the zone data to the NSD readable file.

Questions or comments should be sent to the SNIP admin

NIST is an agency of the U.S. Department of Commerce. Privacy policy / security notice / accessibility statement / Disclaimer / Freedom of Information Act (FOIA) / No Fear Act Data
Date created 9/16/2008. Last updated 9/17/2009.