<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Oct 28, 2016, at 1:19 PM, Jacob Hoffman-Andrews <<a href="mailto:jsha@letsencrypt.org" class="">jsha@letsencrypt.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div dir="ltr" class=""><div class="gmail_extra"><div class="gmail_quote">On Fri, Oct 28, 2016 at 9:52 AM, Peter Bowen via Public <span dir="ltr" class=""><<a href="mailto:public@cabforum.org" target="_blank" class="">public@cabforum.org</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div style="word-wrap:break-word" class=""><div class=""><div class="">OK. I used a machine with a locally running caching resolver. I then did the following as a test:</div><div class=""><br class=""></div><div class="">Fetch top-1m.csv.zip</div><div class="">Unzip it</div><div class="">head -n 200 top-1m.csv | cut -d, -f2 | sed -r -e ’s/^/www./‘ > top200.txt</div><div class="">echo 'nameserver 127.0.0.1’ > resolv.conf</div><div class="">time (ruby -e 'IO.foreach("top200.txt"){|l| l.strip!; loop {|x|puts l + "."; l=l.split(".")[1..-1].join("."<wbr class="">); break if l.empty?}}' | while read N; do drill -c resolv.conf "$N" IN TXT; done)</div><div class=""><br class=""></div><div class=""><div class="">real<span class="gmail-m_1789444525133663017Apple-tab-span" style="white-space:pre-wrap"> </span>1m5.424s</div><div class="">user<span class="gmail-m_1789444525133663017Apple-tab-span" style="white-space:pre-wrap"> </span>0m0.476s</div><div class="">sys<span class="gmail-m_1789444525133663017Apple-tab-span" style="white-space:pre-wrap"> </span>0m0.296s</div></div></div></div></blockquote><div class=""><br class=""></div><div class="">Thanks for putting together this test. There are a few ways in which it's inefficient. Queries are made serially, while a production system would make them in parallel. Process creation overhead is large, as you mentioned. Also, you are fetching across many different domains, which may have widely varying performance characteristics, but the main case we are discussing is issuance to a large number of subdomains.</div><div class=""><br class=""></div><div class="">I have a somewhat more realistic test setup I've used for DNS scanning. I used a commodity VPS with 8 cores running Unbound, plus this Go tool: <a href="https://github.com/jsha/go/blob/master/caa-lookups/lookups.go" class="">https://github.com/jsha/go/blob/master/caa-lookups/lookups.go</a>.</div><div class=""><br class=""></div><div class=""><div class="">time (seq --format '%<a href="http://g.hoffman-andrews.com/" class="">g.hoffman-andrews.com</a>' 1 100000 | ./caa-lookups -server localhost:1053 -parallel 1500 -checkCAA) | grep -v ': ok'</div><div class=""><br class=""></div><div class="">real 1m34.374s</div><div class="">user 0m45.656s</div><div class="">sys 0m43.392s</div></div><div class=""><br class=""></div><div class="">That works out to a rate of about 1000 qps right off the bat, and I'm sure it can be optimized further. Or one could add a few more cores, or a slightly faster network card. I'm confident that this setup could support the issuance rate of 6M per hour (1670 qps) that you cite.</div></div></div></div></div></blockquote><br class=""></div><div>I redid the test moving to 10000 domains, but still one FQDN per Alexa known domain. I also switched to a threaded option in Ruby (but note that threads in MRI are somewhat slow). The result was an average of .0078 seconds to do a full CAA check starting with the full FQDN, as specified in the CAA RFC. This would have been lower, but a percentage of these had DNS server failures which resulted in the thread having to wait until a multi-second timeout to continue.</div><div><br class=""></div><div>So I agree, this seems very doable, as long as there is good internet access.</div></body></html>