Predicting the DNSSEC overhead using DNS traces

Even though the key ideas behind DNSSEC have been introduced quite some time ago DNSSEC has not yet seen large scale deployment. This is in large part due to the anticipated overhead of DNSSEC. While the overheads have been reduced by the introduction of the delegation signer model, it is still not clear if they are bearable. Therefore, we in this paper examine the actual overheads of DNSSEC. We first examine how the packet sizes of a DNS trace increase if DNSSEC would be used. Then we explore the CPU and memory overheads imposed by DNSSEC by replaying a DNS client trace in a testbed initialized with roughly 100,000 zones.