Samples / 05

A result you can reproduce.

Public observations and synthetic size experiments are labeled separately.

Reviewed October 15, 2026

Public observations: October 15, 2026

We queried 1.1.1.1 for valid.mldsa44.dnstest.dev A, requested DNSSEC records and advertised 1232 bytes. The raw wire captures came from separate explicit UDP and TCP requests. The dig transcript came from another request that allowed automatic fallback. Their query IDs and signature bytes may differ; do not assume they are the same transaction.

The raw files contain DNS payloads without TCP length prefixes. Signatures are dated artifacts and eventually expire. Loading them later is a structural exercise, not current security validation. No private name or user capture is included.

Repeat the transport comparison

# Observe a truncated response without automatic TCP retry
dig @1.1.1.1 valid.mldsa44.dnstest.dev A +dnssec +bufsize=1232 +ignore

# Allow normal fallback
dig @1.1.1.1 valid.mldsa44.dnstest.dev A +dnssec +bufsize=1232

# Request TCP explicitly
dig @1.1.1.1 valid.mldsa44.dnstest.dev A +dnssec +tcp

Compare the command, TC flag, retry notice, answer count and final size. Network policy, resolver behavior and the public fixture can change. A failure on your machine is new evidence; it does not invalidate the saved observation, and the saved observation does not override your failure.

Synthetic controls

The inspector also builds an original lab.example. response with one documentation address, one zero-filled signature and an empty OPT record. The ECDSA-sized version is 163 bytes; the ML-DSA-44-sized version is 2519 bytes. A third example includes a zero-filled 1312-byte public key to demonstrate DNSKEY accounting.

These controls deliberately do not verify. They isolate size changes while holding record shape constant. The worked layout provides hand-calculable totals, and the inspector’s report gives each segment’s offsets. Use them to test tooling, not to configure a signed zone.