Yevheniya Nosyk
email: yevheniya.nosyk@univ-grenoble-alpes.fr

Maciej Korczyński
email: maciej.korczynski@univ-grenoble-alpes.fr

Andrzej Duda
email: andrzej.duda@univ-grenoble-alpes.fr

Extended DNS Errors: Unlocking the Full Potential of DNS Troubleshooting

Keywords: Networks → Naming and addressing; Network measurement DNS, Extended DNS Errors, Troubleshooting, DNSSEC, Misconfigurations

The Domain Name System (DNS) relies on response codes to confirm successful transactions or indicate anomalies. Yet, the codes are not sufficiently fine-grained to pinpoint the root causes of resolution failures. RFC 8914 (Extended DNS Errors or EDE) addresses the problem by defining a new extensible registry of error codes to be served inside the OPT resource record. In this paper, we show that four major DNS resolver vendors and three large public DNS resolvers support this standard and correctly narrow down the cause of underlying problems. Yet, they do not agree in 94% of our test cases in terms of the returned EDE codes. We reveal that Cloudflare DNS is the most precise in indicating various DNS misconfigurations via the EDE mechanism, so we use it to perform a large-scale analysis of more than 303M registered domain names. We show that 17.7M of them trigger EDE codes. Lame delegations and DNSSEC validation failures are the most common problems encountered.

INTRODUCTION

The Domain Name System (DNS) was introduced back in 1987 [START_REF] Mockapetris | Domain names -concepts and facilities[END_REF][START_REF] Mockapetris | Domain names -implementation and specification[END_REF] to translate human-readable domain names into IP addresses. It replaced the static centralized HOSTS.TXT text file and distributed the domain name space management across different entities. The original standard accounted for cases when DNS resolutions would go wrong and designated a 4-bit response code (RCODE) field in the DNS packet header. Six values were defined directly and the remaining ones were reserved for future use.

With the evolution of DNS, new response codes were gradually added to support dynamic DNS updates [START_REF] Vixie | Dynamic Updates in the Domain Name System (DNS UPDATE)[END_REF], DNAME Redirection [START_REF] Rose | DNAME Redirection in the DNS[END_REF], TSIG [START_REF] Dupont | Secret Key Transaction Authentication for DNS (TSIG)[END_REF], DNS Stateful Operations [START_REF] Bellis | DNS Stateful Operations[END_REF], EDNS(0) [START_REF] Da | Extension Mechanisms for DNS (EDNS(0))[END_REF], TKEY [START_REF] Donald | Secret Key Establishment for DNS (TKEY RR)[END_REF], and DNS Cookies [START_REF] Eastlake | Domain Name System (DNS) Cookies[END_REF]. These new assignments have further complicated the original semantics of response codes-as all newly added RCODEs did not fit the 4-bit field in the packet header, some codes had to be served inside TSIG, TKEY, and OPT resource records. Moreover, the RCODE value of 9 has two different meanings depending on whether it was found inside the OPT or the TSIG record, and the value of 16 was assigned twice by mistake [START_REF] Eastlake | Domain Name System (DNS) IANA Considerations[END_REF].

By the year 2023, the complexity of DNS has drastically increasedit is now defined in 297 RFCs [START_REF] Hubert | Overview of relevant DNS standards and drafts[END_REF] making it more than ever prone to various misconfigurations and resolution failures. As observed in a large passive dataset with 1.6 trillion DNS transactions, only 68.1% of them succeed [START_REF] Foremski | DNS Observatory: The Big Picture of the DNS[END_REF]. The remaining requests would fail due to various reasons, such as non-existing domain names, DNSSEC validation failures, unreachable authoritative nameservers, recursive resolver policies, and others. DNS failures were also behind Slack [START_REF] Elvira | The Case of the Recursive Resolvers[END_REF], Salesforce [START_REF]Multi-Instance Service Disruption on May 11-12[END_REF], NASA [START_REF] York | Comcast Releases Detailed Analysis of NASA[END_REF], and European Commission [START_REF] Smith | Anyone else seeing DNSSEC failures from EU Commission ?[END_REF] website outages. Unfortunately, the generic DNS response codes are of little help to precisely pinpoint the underlying causes of such events.

To address this shortcoming, RFC 8914 introduced Extended DNS Errors-a mechanism to define more specific error codes and return them inside the OPT resource record along with a verbose explanation of the problem [START_REF] Kumari | Extended DNS Errors[END_REF]. The proposed standard defined 25 initial extended error codes (INFO-CODEs) and encouraged adding new ones to the registry maintained by IANA [START_REF]Domain Name System (DNS) Parameters (Extended DNS Error Codes)[END_REF]. EDE can provide a new unique insight into the state of the DNS ecosystem but no prior work systematically analyzed this new standard. To fill this research gap, this paper aims at analyzing whether one can rely on EDE to efficiently identify the most common reasons behind DNS failures. In particular, our contributions are as follows:

• We set up 63 domain names that reflect common misconfigurations and corner cases. We make our infrastructure publicly available at https://extended-dns-errors.com for the community to use. Resolver) and three large public DNS resolvers (Quad9, Open-DNS, Cloudflare DNS). We observe that they do not agree in 94% of test cases, but the differences come from response specificity and the support of specific EDE codes rather than correctness. Cloudflare DNS returns the most specific codes when handling our test domains. • We perform a large-scale measurement study of 303M domain names using Cloudflare DNS. Out of those, 17.7M domains trigger EDE codes, mostly due to lame delegations and DNSSEC failures. The rest of the paper is organized as follows. Section 2 discusses the Extended DNS Errors standard and its implementation by software vendors. Section 3 shows how open source DNS software and public resolvers handle our misconfigured domains. Section 4 presents the large-scale analysis of common domain name misconfigurations. We discuss the ethical considerations of this study in Section 5 and the related work in Section 6. We conclude the paper in Section 7.

BACKGROUND

The original DNS message format was not extensible to support new protocol features. To overcome this limitation, the EDNS(0) [START_REF] Da | Extension Mechanisms for DNS (EDNS(0))[END_REF] standard introduced the new OPT pseudo resource record that can serve a variable number of options. The OPTION-CODE of 15 was assigned to EDE. The RFC 8914 proposed standard additionally defined the 16-bit INFO-CODE field that stores the newly added error codes and the variable-length EXTRA-TEXT field to provide a more verbose description of a problem. Importantly, extended error codes exist independently from traditional RCODEs and the standard does not prohibit any combination of the two.

Table 1 presents the currently registered EDE codes-the first 25 directly defined in RFC 8914 and the other 5 added to the IANA registry afterwards. These INFO-CODEs cover various aspects of the DNS operation: i) DNSSEC validation (1, 2, 5-12, 25, 27), ii) caching [START_REF] Eastlake | Domain Name System (DNS) IANA Considerations[END_REF][START_REF] Hubert | Overview of relevant DNS standards and drafts[END_REF][START_REF] Cloudflare | Announcing experimental DDR in 1[END_REF][START_REF] Viet Doan | Evaluating Public DNS Services in the Wake of Increasing Centralization of DNS[END_REF], iii) DNS resolver policies [START_REF] Eastlake | Domain Name System (DNS) Cookies[END_REF][START_REF]Certstream[END_REF][START_REF] Castro | A Day at the Root of the Internet[END_REF][START_REF] Castro | Understanding and Preparing for DNS Evolution[END_REF][START_REF] Chung | A Longitudinal, End-to-End View of the DNSSEC Ecosystem[END_REF][START_REF] Cloudflare | Cloudflare Website and Online Services Terms of Use[END_REF], iv) DNS software operation [START_REF] Petar | An approach to evaluation of common DNS misconfigurations[END_REF][START_REF] Cloudflare | Extended DNS error codes[END_REF][START_REF] Cz | Knot Resolver[END_REF][START_REF] Da | Extension Mechanisms for DNS (EDNS(0))[END_REF], and v) others (0, 24, 26, 28). Any DNS system, whether a recursive resolver, a forwarder, or an authoritative nameserver, can generate, forward, and parse the EDE codes.

Despite being recently introduced as a proposed standard, the EDE already provides the basis for other ongoing work at the IETF [44]. Extended error codes were suggested to be returned in case of unauthorized zone transfer requests [START_REF] Toorop | DNS Zone Transfer over TLS[END_REF] or HTTP proxy errors [START_REF] Nottingham | The Proxy-Status HTTP Response Header Field[END_REF]. Furthermore, the DNS Error Reporting draft [START_REF] Arends | DNS Error Reporting[END_REF] describes a mechanism for recursive resolvers to signal the authoritative nameservers of encountered resolution failures. Spamhaus implemented the EDE on their DNS Firewall for PowerDNS Recursor to indicate the reasons for blocking [START_REF]DNS Firewall for PowerDNS[END_REF].

As of May 2023, four major vendors of DNS resolver software, namely BIND9 [45], Unbound [START_REF] Nlnetlabs | Unbound[END_REF], PowerDNS Recursor [63], and Knot Resolver [START_REF] Cz | Knot Resolver[END_REF] have implemented a subset of Extended DNS Errors defined in RFC 8914. Introducing such a new feature requires a non-trivial amount of effort from software developers. BIND9 implemented INFO-CODEs related to response policy zones (codes [START_REF]Certstream[END_REF][START_REF] Castro | A Day at the Root of the Internet[END_REF][START_REF] Castro | Understanding and Preparing for DNS Evolution[END_REF][START_REF] Chung | A Longitudinal, End-to-End View of the DNSSEC Ecosystem[END_REF] and serving stale data (codes 3,4,19) [START_REF] Andrews | Return Extended EDNS Errors (EDE)[END_REF]. They are next planning to introduce DNSSEC validation errors [START_REF] Risk | RFC 8914 -DNSSEC validation failures[END_REF] and the No Reachable Authority [START_REF] Cz | Knot Resolver[END_REF] [START_REF] Risk | RFC 8914 -Extended error for No Reachable Authority[END_REF]. Unbound prioritizes the impact of DNSSEC error codes and, therefore, has implemented all of them [START_REF]Extended DNS Error support for Unbound[END_REF].

TRIGGERING EXTENDED DNS ERRORS

In this section, we describe our testing infrastructure composed of 63 domain names designed to trigger EDE codes supported by DNS software. They also represent some of the common misconfigurations and corner cases. Our setup excludes all the codes that result from specific resolver configurations (e.g., Blocked ( 15) is only returned when the queried domain name is on the resolver's blocklist). We then test the EDE support by four DNS software vendors and three large public DNS resolvers. We make our testing infrastructure publicly available at https://extended-dns-errors.com and encourage fellow researchers to use it in the future.

Domain Names

Our testing infrastructure relies on two levels of DNS zones: the correctly configured extended-dns-errors.com domain and its 63 subdomains, grouped by configuration type and presented in Table 2. Table 3 in Appendix provides further configuration details.

The first subdomain, as its name implies, is valid and serves as a baseline for subsequent testing. Group 2 domains imitate problems with the DS record [START_REF] Rose | Resource Records for the DNS Security Extensions[END_REF]. For example, the no-ds subdomain is correctly signed but does not have the corresponding DS record published in the parent zone-the type of misconfiguration affecting roughly 30% of DNSSEC-signed domains [START_REF] Chung | A Longitudinal, End-to-End View of the DNSSEC Ecosystem[END_REF]. Another domain contains undefined cryptographic algorithm numbers [START_REF]Domain Name System Security (DNSSEC) Algorithm Numbers[END_REF].

The subdomains in group 3 manipulate DNSSEC signature (RR-SIG) inception and expiration fields either for all the resource records (RRs) in zone files or only for the A record. Note that for signed domain names to validate properly, the RRSIG signatures must be valid. The next group of misconfigurations concerns NSEC3 and NSEC3PARAM resource records needed to provide the hashed authenticated denial of existence [START_REF] Arends | DNS Security (DNSSEC) Hashed Authenticated Denial of Existence[END_REF]. The nsec3-iter-200 is configured correctly, but we have used a very high NSEC3 iteration count (200) to sign the domain, even though the values above 0 must not be used anymore [START_REF] Hardaker | Guidance for NSEC3 Parameter Settings[END_REF]. The largest misconfiguration group 5 deals with DNSKEY resource records, whether serving as Key Signing Keys (KSKs) or Zone Signing Keys (ZSKs).

The subdomain group 6 represents the most common misconfigurations of AAAA resource records as discussed by Hendriks et al. [START_REF] Hendriks | IPv6-specific misconfigurations in the DNS[END_REF]. All the AAAA glue records of corresponding subdomains at

# Description Subdomains

1. Control subdomain valid no-ds, ds-bad-tag, ds-bad-key-algo, ds-unassigned-key-algo, ds-reserved-key-algo, ds-unassigned-digest-algo, 2. DS misconfigurations ds-bogus-digest-value rrsig-exp-all, rrsig-exp-a, rrsig-not-yet-all, rrsig-not-yet-a, rrsig-no-all, rrsig-exp-before-all, 3. RRSIG misconfigurations rrsig-no-a, rrsig-exp-before-a nsec3-missing, bad-nsec3-hash, bad-nsec3-next, bad-nsec3-rrsig, nsec3-rrsig-missing, nsec3-iter-200, 4. NSEC3 misconfigurations nsec3param-missing, bad-nsec3param-salt, no-nsec3param-nsec3 no-zsk, bad-zsk, no-ksk, no-rrsig-ksk, bad-rrsig-ksk, bad-ksk, no-rrsig-dnskey, bad-rrsig-dnskey, 5. DNSKEY misconfigurations no-dnskey-256, no-dnskey-257, no-dnskey-256-257, bad-zsk-algo, unassigned-zsk-algo, reserved-zsk-algo v6-mapped, v6-multicast, v6-unspecified, v4-hex, v6-unique-local, v6-doc, v6-link-local, v6-localhost, 6. Invalid AAAA glue records v6-mapped-dep, v6-nat64 7. Invalid A glues records v4-private-10, v4-doc, v4-private-172, v4-loopback, v4-private-192, v4-reserved, v4-this-host, v4-link-local 8. Other unsigned, ed448, rsamd5, dsa, allow-query-none, allow-query-localhost the parent (extended-dns-errors.com) zone contain invalid IPv6 addresses and thus, do not point to genuine child nameservers. Similarly, subdomains in group 7 have glue records with special-purpose IPv4 addresses [START_REF]IANA IPv4 Special-Purpose Address Registry[END_REF].

The domains in group 8 are not misconfigured per se but represent some of the corner cases. The unsigned subdomain is not DNSSEC-signed as proven at the parent zone. The next three subdomains are either signed with deprecated (RSA/MD5), not recommended (DSA/SHA1) or the newest (Ed448) cryptographic algorithms. Finally, the two remaining entries have ACLs that restrict the allowed DNS clients.

Tested Systems

We have set up four recursive DNS resolvers that implement the RFC 8914 standard: BIND 9.19.9, Knot Resolver 5.6.0, Unbound 1.16.2, and PowerDNS Recursor 4.8.2. The latter two require adding special configuration options to return EDE when handling client requests. We have additionally requested ten popular public DNS resolvers [START_REF] Viet Doan | Evaluating Public DNS Services in the Wake of Increasing Centralization of DNS[END_REF] to resolve one domain per group from Table 2 and kept the three that support EDE as of May 2023, namely, Cloudflare DNS, Quad9, and OpenDNS.

Results

Only 4 test cases out of 63 triggered the same results across all the seven tested systems: the no-ds, nsec3-iter-200, unsigned, and valid subdomains did not result in any error condition. The remaining 94% of the cases were handled inconsistently. Table 4 in Appendix provides additional information about the EDE codes returned in each case.

DNSSEC Bogus ( 6) is a generic INFO-CODE indicating that DNSSEC validation resulted in a bogus state. Given that most of our subdomains are not signed correctly, there is no surprise that we encounter this error code the most frequently. In particular, as NSEC3 resource records could not be properly validated when requesting non-existing subdomains of bad-nsec3-next and bad-nsec3-rrsig, both resulted in EDE 6. Fourteen more test cases triggered either DNSSEC Bogus [START_REF] Andrews | Return Extended EDNS Errors (EDE)[END_REF] or a more specific DNSKEY Missing [START_REF] Barber | Observed DNS Resolution Misbehavior[END_REF] showing that no DNSKEY at the child zone matched the DS record at the parent. For example, the misconfigurations of ds-bad-tag, bad-zsk, and reserved-zsk-algo imply mismatches between the corresponding keys and digest values. Interestingly, Unbound consistently returned DNSKEY Missing [START_REF] Barber | Observed DNS Resolution Misbehavior[END_REF], while Knot Resolver indicated a more generic DNSSEC Bogus (6) code in the 14 aforementioned cases.

As expected, the expired, not yet valid, and missing RRSIGs mostly resulted in Signature Expired [START_REF] Arends | DNS Error Reporting[END_REF], Signature Not Yet Valid [START_REF] Arends | DNS Security (DNSSEC) Hashed Authenticated Denial of Existence[END_REF], and RRSIGs Missing (10) errors, respectively. When signatures expire before becoming valid (subdomains rrsig-exp-before-all, rrsig-exp-before-a), resolvers return as many as four different EDEs. However, a new dedicated INFO-CODE Signature Expired before Valid [START_REF] Peter | Common DNS Implementation Errors and Suggested Fixes[END_REF] was introduced in 2022. Once implemented, it will signal mismatches between inception and expiration fields of DNSSEC signatures.

The domain names signed with unsupported algorithms should be treated as DNSSEC unsigned [START_REF] Rose | Protocol Modifications for the DNS Security Extensions[END_REF] and return the NOERROR response code. Cloudflare DNS and Knot Resolver additionally include Unsupported DNSKEY Algorithm (1) and Other (0) extended errors, respectively, the latter accompanied by the EXTRA-TEXT field saying "LSLC: unsupported digest/key". Note that Cloudflare DNS is the only tested system that does not yet support the Ed448 cryptographic algorithm.

The glue records of subdomains in groups 6 and 7 contain specialuse IP addresses that do not point to valid authoritative nameservers. Cloudflare DNS indicated the problem using the No Reachable Authority [START_REF] Cz | Knot Resolver[END_REF] error. Interestingly, OpenDNS occasionally returned the Prohibited (18) error code, unexpected in this context. We have filed a ticket to OpenDNS support explaining the issue. Finally, the nameservers of the last two domains had ACLs that either did not accept any queries at all (allow-query-none) or only allowed queries originating from the localhost IPs (allowquery-localhost). These two domains resulted in Forbidden [START_REF] Chung | A Longitudinal, End-to-End View of the DNSSEC Ecosystem[END_REF] for OpenDNS and DNSKEY Missing [START_REF] Barber | Observed DNS Resolution Misbehavior[END_REF], No Reachable Authority [START_REF] Cz | Knot Resolver[END_REF], and Network Error (23) for Cloudflare DNS.

Our test cases triggered 12 unique INFO-CODEs, mostly DNSSEC Bogus (6), DNSKEY Missing (9), and RRSIGs Missing [START_REF] Barr | Common DNS Operational and Configuration Errors[END_REF]. Overall, apart from one unexpected Prohibited (18) code generated by OpenDNS, all the EDE codes returned by DNS software and public resolvers were correct. Despite an important difference between the generated EDE codes, they were all helpful to narrow down the list of potential issues with queried domains, some being significantly more precise than others. As such, EDE is an efficient mechanism to troubleshoot DNS failures. The Cloudflare implementation of RFC 8914 provides the richest feedback on DNS misconfigurations and other related issues (e.g., unreachable authoritative nameservers). Therefore, we have chosen it for the full domain scan described in the next section.

MISCONFIGURATIONS IN THE WILD

We have seen what kind of DNS (mis)configurations can trigger recursive resolvers to return EDEs. In this section, we enumerate the most common misconfigurations in the wild.

Internet-wide Scan

Our input list of domain names contains 488M entries gathered from different sources, including the Centralized Zone Data Service (CZDS) [START_REF]Centralized Zone Data Service[END_REF], the Tranco list [START_REF] Victor | Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation[END_REF], passive DNS data from SIE Europe [START_REF]Passive DNS Data Sharing[END_REF], .se, .nu, .ch, .li top-level domain (TLD) zone files accessible via AXFR zone transfers, and Google Certificate Transparency logs [START_REF]Certstream[END_REF]. We used zdns [START_REF] Izhikevich | ZDNS: A Fast DNS Toolkit for Internet Measurement[END_REF] scanner to generate A requests at scale and queried Cloudflare DNS in May 2023. We filter out nonexisting domains (resulting in the NXDOMAIN response code) and keep 303M registered domains across 1,475 TLDs for further analysis.

Extended DNS Errors

Overall, more than 17.7M domains triggered one or more EDE codes. Below, we discuss the 14 encountered INFO-CODEs and the misconfigurations they indicate:

1. No Reachable Authority (13,965,865 domains): the issue that affects the largest number of registered domain names. Lame delegation [START_REF] Pappas | Distributed DNS Troubleshooting[END_REF] occurs when some or all nameservers cannot provide responses for domains they are authoritative for (despite referrals being present at the parent zone). When none of the nameservers is responsive, end clients would only receive a generic SERVFAIL response code, but Cloudflare DNS adds the No Reachable Authority (22) EDE code. It was mostly returned along with other INFO-CODEs discussed below such as Network Error [START_REF] Da | Extension Mechanisms for DNS (EDNS(0))[END_REF], DNSKEY Missing (9), and RRSIGs Missing [START_REF] Barr | Common DNS Operational and Configuration Errors[END_REF].

2. Network Error (11,647,551 domains): indicates that it is not possible to communicate with another DNS server due to an unrecoverable error. Cloudflare DNS uses the EXTRA-TEXT field of the DNS packet to specify the nameserver triggering the error (e.g., "1.2.3.4:53 rcode=REFUSED for a.com A"). Overall, Cloudflare DNS identified three types of issues with 293k unique authoritative nameservers when requesting A, AAAA, NS, DS, or DNSKEY RRs. The majority of nameservers responded to Cloudflare with the REFUSED RCODE (267k), others with SERVFAIL (21k), and the remaining ones timed out (15k). In most cases (97.91%), the nameservers of queried domains were the cause of the problem. Other 2.1k child domains were affected because of 88 parent DNS zones and the remaining 241k cases were, for example, unreachable DNS provider domains. We observe a high concentration of domain names per malfunctioning authoritative nameservers-6 of them responding with the REFUSED error code are authoritative for more than 100k domains each. Overall, fixing 20k nameservers would render reachable more than 81% of domain names.

Network Error ( 23) is another evidence of lame delegations along with the above-mentioned No Reachable Authority [START_REF] Cz | Knot Resolver[END_REF]. In total, more than 14.8M unique domains triggered a combination of these two EDE codes. We note, however, that it is the lower bound estimation of the problem-one would need to test all the domain nameservers to confirm whether all of them are available. In our scanning setup, a recursive resolver would end the DNS resolution process once the response is obtained from any authoritative nameserver.

3. RRSIGs Missing (2,746,604 domains): returned when the recursive resolver cannot obtain all the signatures needed for DNSSEC validation. Most of these errors were triggered by 2.47M domain names under two ccTLDs. Surprisingly, the error did not lead to DNSSEC validation failure. We reached out to one of the TLD operators who explained to us that despite the TLD zone being correctly configured, Cloudflare DNS signaled the problem with a so-called stand-by KSK, i.e., the one published in the zone file in case the emergency key rollover is needed, but not actively used to establish the chain of trust [START_REF] Kolkman | DNSSEC Operational Practices[END_REF]. We identified 22 more public suffixes and TLDs with stand-by DNSSEC keys triggering the same error. We contacted Cloudflare and reported our findings. They, in turn, confirmed that it was an expected behavior and updated their documentation [START_REF] Cloudflare | Extended DNS error codes[END_REF] to inform that "key rollover in-progress, stand-by key, and attacker stripping signatures" may trigger the RRSIGs Missing EDEs.

4. DNSKEY Missing (296,643 domains): refers to those cases when the DS record found at the parent zone does not match any DNSKEY at the child zone. Despite its name, this error condition does not necessarily imply that no public key was found at the child zone. In some cases, when accompanied by the No Reachable Authority [START_REF] Cz | Knot Resolver[END_REF], it states that nameservers were not reachable, so the resolver could not obtain the DNSKEY resource record. More broadly, as defined in the RFC 8914, the DNSKEY Missing (9) refers to the cases for which the child DNSKEY was not cryptographically verified with respect to the DS record. Almost all the affected domains failed the DNSSEC validation due to the same reason-no RRSIG RRs covered KSKs in the child zone, even though DNSKEYs corresponded to DS records found at the parent.

5. DNSSEC Bogus (82,465 domains): DNSSEC validation results in a bogus state when validating resolvers cannot cryptographically establish the chain of trust from the root to the requested zone. More than 80k domain names resulted in the SERVFAIL response code because 124 corresponding TLDs did not provide valid proofs of non-existence for the A records queried during our Internet-wide scan. Other encountered problems include RRSIG records that do not validate corresponding DNSKEY/A RRs, DS hashes that do not match corresponding KSKs, etc.

6. Invalid Data (12,268 domains): this group of domains contained responses with the "Mismatched question from the authoritative server <ip>" EXTRA-TEXT. For example, nameservers that do not implement EDNS0 would not respond with the FORMERR response code as specified in RFC 6891 [START_REF] Da | Extension Mechanisms for DNS (EDNS(0))[END_REF] but rather did not include the OPT record in the response.

7. Unsupported DNSKEY Algorithm (8,751 domains): validating DNS resolvers ignore DNSKEYs with unknown algorithms, as generated signatures cannot be cryptographically verified. Cloudflare DNS signaled that it does not support GOST R 34.10-2001 and Ed448 algorithms. Additionally, we received the "unsupported key size" EXTRA-TEXT for the domains that have 512-bit keys of types RSA/SHA-1, RSASHA1-NSEC3-SHA1, and RSA/SHA-256. Despite the fact that the key length is explicitly allowed in the corresponding specifications [START_REF] Eastlake | RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS)[END_REF][START_REF] Jansen | Use of SHA-2 Algorithms with RSA in DNSKEY and RRSIG Resource Records for DNSSEC[END_REF], the keys are now considered weak. Finally, we received the "no supported DNSKEY algorithm" EXTRA-TEXT in two cases: i) when using prohibited DNSSEC algorithms (e.g., DSA-NSEC3-SHA1 or DSA) and ii) when the DS record at the parent corresponds to the key tag of the DNSKEY record in the child zone, but the algorithm numbers do not match. In particular, one domain name deliberately misconfigured by fellow researchers had a reserved DNSKEY algorithm number.

8. Signature Expired (2,877 domains): validating resolvers examine the Signature Expiration field of RRSIG RRs to check whether they can still be used to build the chain of trust. Cloudflare DNS revealed that certain signatures expired sometime between 2009 and our measurement (2019 for one research domain name deliberately misconfigured). Interestingly, in some cases, the domain name of the authoritative nameserver contains expired RRSIG resource records, rather than the queried domain name itself. For example, the resolution of 377 domains resulted in SERVFAIL because the domain name of the DNS provider contained expired signatures. 9. NSEC Missing (1,980 domains): signifies that no valid proof of non-existence was returned in the response. For example, the domains in this category had missing NSEC/NSEC3 records to validate the absence of DS records at the parent zone or the absence of the A record at the child zone. The message stating "failed to verify an insecure referral proof for <domain>" was added to all the errors.

10. Unsupported DS Digest Type (62 domains): IANA allows two mandatory and two optional algorithms to compute DS digest values [START_REF]DNSSEC Delegation Signer (DS) Resource Record (RR) Type Digest Algorithms[END_REF]. As Cloudflare DNS does not support the optional GOST R 34.11-94 algorithm yet, we received this extended error code when resolving 54 domains. As for the remaining 8 domains with the nameservers managed by one DNS provider, their corresponding DS records contained an unassigned digest algorithm type [START_REF] Arends | DNS Security (DNSSEC) Hashed Authenticated Denial of Existence[END_REF].

11. Stale Answer (32 domains): the resolver responded with the previously cached data. In particular, 6 domains had the Stale Answer (3) response with No Reachable Authority [START_REF] Cz | Knot Resolver[END_REF] and Network error [START_REF] Da | Extension Mechanisms for DNS (EDNS(0))[END_REF], because nameservers responded with the REFUSED RCODE. Other 12 domains resulted in the combination of Stale Answer [START_REF] Eastlake | Domain Name System (DNS) IANA Considerations[END_REF] and No Reachable authority [START_REF] Cz | Knot Resolver[END_REF], as nameservers would not respond to resolver queries.

12. Signature Not Yet Valid (29 domains): apart from one domain name deliberately misconfigured by researchers from another organisation, the remaining 28 have two pairs of DNSSEC signatures: valid and those that will be valid starting from year 2045. Consequently, the resolution of these domains is inconsistent-NOERROR when valid signatures are returned and SERVFAIL otherwise. Interestingly, the nameserver domains themselves experience the same problem.

13. Cached Error (8 domains): means that the resolver returned SERFVAIL responses directly from its cache, possibly after previously failed resolution attempts. The authoritative nameservers of all the 8 domains respond to resolver queries with NOTAUTH RCODE, unexpected in this context as it must only be generated when processing the client TSIG record. We repeated the resolution attempts from various locations worldwide, but the problem persisted.

14. Other (7 domains): this error code was received with the "iteration limit exceeded" EXTRA-TEXT and resulted in SERVFAIL for all the domains. Interestingly, one did not have any DNS-specific misconfigurations and was successfully resolved using Google DNS, Quad9, and OpenDNS. The remaining 6 have authoritative nameservers responding with REFUSED for non-recursive queries from recursive resolvers.

Concentration of Misconfigurations

We now investigate the distribution of misconfigured domain names per TLD. We compute the ratio of the domains that trigger extended error codes to all domains scanned per TLD and present the results in Figure 1. Overall, almost 38% of gTLDs and 4% of ccTLDs do not have any misconfigured domain. At the other extreme, all the registered domains under 11 gTLDs and 2 ccTLDs resulted in extended error codes, mostly RRSIGs Missing [START_REF] Barr | Common DNS Operational and Configuration Errors[END_REF], No Reachable Authority [START_REF] Cz | Knot Resolver[END_REF], and Network Error [START_REF] Da | Extension Mechanisms for DNS (EDNS(0))[END_REF]. We note that these TLDs accounted for a mere fraction of our input list, totaling 108k domains. Although we observe that ccTLDs are generally more likely to have misconfigured domain names than gTLDs, it also indicates the efforts of ccTLD registries to deploy DNSSEC and comply with best current practices.

We then assess the popularity of domains that trigger EDE codes. Misconfigurations of popular domains can have far-reaching consequences because many end users rely on them. We compared the Tranco top 1M ranking [START_REF] Victor | Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation[END_REF] with our list of 17.7M domains. Overall, 22.1k entries were in common. As further shown in Figure 2, the domains triggering EDE codes are evenly distributed across the Tranco list. We also note that 12.2k domains resulted in the NOERROR response code, suggesting that Cloudflare DNS did not encounter any unrecoverable errors, but rather used EDE to provide more information about the DNS resolutions.

ETHICS AND REPRODUCIBILITY

Our research uses active network measurements and follows industry best practices [START_REF] Dittrich | The Menlo Report: Ethical Principles Guiding Information and Communication Technology Research[END_REF][START_REF] Durumeric | ZMap: Fast Internet-Wide Scanning and Its Security Applications[END_REF][START_REF] Partridge | Ethical Considerations in Network Measurement Papers[END_REF]. The Cloudflare public DNS resolver receives around 600 billion requests per day or almost 7 million per second [START_REF] Cloudflare | Announcing experimental DDR in 1[END_REF]. The traffic generated for our experiment peaked at 11.5K packets per second and lasted for 12 hours in total. Moreover, The Cloudflare Terms of Use [START_REF] Cloudflare | Cloudflare Website and Online Services Terms of Use[END_REF] do not limit the number of requests per client and we did not see evidence to have triggered any rate limiting. As Cloudflare DNS functions as a caching resolver, we anticipate a portion of our requests to be resolved from its internal cache. We randomized our input list to spread the load across different authoritative nameservers and we did not reveal misconfigurations of individual domains to protect their owners. When probing open resolvers, we only targeted ten large public systems meant to resolve queries from arbitrary clients.

Finally, we release all the tools necessary to reproduce our study at https://extended-dns-errors.com. They include i) the list of misconfigured domains that we host and can be freely queried, ii) instructions on how to set up all the misconfigured domains, iii) instructions on how to set up recursive resolvers supporting EDE, and iv) instructions on how to run our domain scans.

RELATED WORK

Despite ongoing efforts to improve DNS availability and resiliency, domain misconfigurations persist [START_REF] Petar | An approach to evaluation of common DNS misconfigurations[END_REF][START_REF] Dai | DNSSEC Misconfigurations in Popular Domains[END_REF]. Pappas et al. [START_REF] Pappas | Impact of Configuration Errors on DNS Robustness[END_REF] highlighted cyclic dependencies, lame delegation, and insufficient server redundancy as prevalent issues in 2004. These problems still exist today [START_REF] Giovane | TsuNAME: Exploiting Misconfiguration and Vulnerability to DDoS DNS[END_REF][START_REF] Sommese | When Parents and Children Disagree: Diving into DNS Delegation Inconsistency[END_REF]. Lame delegation affects a significant number of domains [START_REF] Gautam Akiwate | Unresolved Issues: Prevalence, Persistence, and Perils of Lame Delegations[END_REF], including 14.8 million identified in our research. DNSSEC deployment and IPv6 adoption have introduced additional types of mismanagement [START_REF] Chung | A Longitudinal, End-to-End View of the DNSSEC Ecosystem[END_REF][START_REF] Heftrig | Poster: The Unintended Consequences of Algorithm Agility in DNSSEC[END_REF][START_REF] Hendriks | IPv6-specific misconfigurations in the DNS[END_REF][START_REF] Streibelt | How Ready is DNS for an IPv6-Only World?[END_REF][START_REF] Niels | A Measurement Study of DNSSEC Misconfigurations[END_REF][START_REF] Wander | Measurement Survey of Server-side DNSSEC Adoption[END_REF].

Domain misconfigurations lead to erroneous DNS resolutions [START_REF] Liao | A Comprehensive Study of DNS Operational Issues by Mining DNS Forums[END_REF]. Failure rates range from 13.5% to 19% based on studies in different regions [START_REF] Foremski | DNS Observatory: The Big Picture of the DNS[END_REF][START_REF] Kazato | Towards Classification of DNS Erroneous Queries[END_REF][START_REF] Yang | A Deep Dive into DNS Query Failures[END_REF]. Moreover, most of the requests at DNS root servers are "pollution" queries (e.g., non-existing TLDs, malformed packets) [START_REF] Castro | A Day at the Root of the Internet[END_REF][START_REF] Castro | Understanding and Preparing for DNS Evolution[END_REF][START_REF] Gao | An Empirical Reexamination of Global DNS Behavior[END_REF][START_REF] Wessels | Wow, That's a Lot of Packets[END_REF], leading to resolution failures. To address the extent of erroneous DNS in the wild, the IETF released RFCs and Best Current Practice documents discussing most common misconfigurations [9-11, 25, 31]. Methods for formal verification and online tools like DNSViz, DNSSEC Analyzer, and DNS Checker help in the analysis [START_REF]Domain DNS Health Checker Tool[END_REF][START_REF] Dnsviz | A DNS visualization tool[END_REF][START_REF] Kesava | GRooT: Proactive Verification of DNS Configurations[END_REF][START_REF] Kesava | SCALE: Automatically Finding RFC Compliance Bugs in DNS Nameservers[END_REF][START_REF] Pappas | Distributed DNS Troubleshooting[END_REF][START_REF]DNSSEC Analyzer[END_REF].

The present work explores the use of EDE codes with a novel approach to troubleshooting name resolution problems that relies on the DNS protocol itself and does not require installing any external tools.

CONCLUSIONS

In this paper, we have provided the first analysis of how EDE helps in troubleshooting DNS problems at scale. We set up 63 domains and tested the implementation of RFC 8914 by four DNS software vendors and three public DNS resolvers. The results reveal high inconsistency between tested systems-almost 94% of test cases. We have also scanned 303M domains using Cloudflare DNS and identified that 17.7M (5.8%) of them trigger EDE codes, showing that decades-long problems of lame delegations and DNSSEC misconfigurations remain widely present.

The high level of inconsistency in returned EDE codes may raise the question of how useful they are when troubleshooting DNS problems. Our measurements reveal that all the tested systems were successful in determining root causes of misconfigurations with different levels of specificity. Therefore, we believe that EDE is a promising technique that assists DNS operators, domain owners, and end clients in identifying and resolving DNS issues. Further discussions with the community, software vendors, and public resolver operators may increase result consistency and the ease of the EDE interpretation for all involved parties.

B TESTING RESULTS

Figure 1 :Figure 2 :

 12 Figure 1: ratio of domains that trigger EDE codes across gTLDs and ccTLDs.

Table 1 :

 1 Registered Extended DNS Error codes.

	Code Description	Code Description
	0. Other	15. Blocked
	1. Unsupported DNSKEY Algorithm 16. Censored
	2. Unsupported DS Digest Type	17. Filtered
	3. Stale Answer	18. Prohibited
	4. Forged Answer	19. Stale NXDOMAIN Answer
	5. DNSSEC Indeterminate	20. Not Authoritative
	6. DNSSEC Bogus	21. Not Supported
	7. Signature Expired	22. No Reachable Authority
	8. Signature Not Yet Valid	23. Network Error
	9. DNSKEY Missing	24. Invalid Data
	10. RRSIGs Missing	25. Signature Expired before Valid
	11. No Zone Key Bit Set	26. Too Early
	12. NSEC Missing	27. Unsupported NSEC3 Iter. Value
	13. Cached Error	28. Unable to conform to policy
	14. Not Ready	29. Synthesized

• We test the implementation of RFC 8914 by four open-source DNS resolvers (BIND9, Unbound, PowerDNS Recursor, Knot

Table 2 :

 2 Our custom subdomains grouped by (mis)configuration type.

Table 4 :

 4 Subdomains and extended error codes returned by DNS software and public resolvers.

	#	Subdomain	BIND 9.19.9	Unbound 1.16.2	PowerDNS 4.8.2	Knot 5.6.0	Cloudflare DNS	Quad9	OpenDNS
	1.	valid	None	None	None	None	None	None	None
	2.	no-ds	None	None	None	None	None	None	None
	3.	ds-bad-tag	None	9	9	6	9	9	6
	4.	ds-bad-key-algo	None	9	9	6	9	9	6
	5.	ds-unassigned-key-algo	None	None	None	0	9	None	6
	6.	ds-reserved-key-algo	None	None	None	0	1	None	6
	7.	ds-unassigned-digest-algo	None	None	None	0	2	None	None
	8.	ds-bogus-digest-value	None	9	9	6	6	9	6
	9.	rrsig-exp-all	None	7	7	7	7	7	6
	10.	rrsig-exp-a	None	6	7	None	7	6	7
	11.	rrsig-not-yet-all	None	9	8	8	8	9	6
	12.	rrsig-not-yet-a	None	6	8	None	8	8	8
	13.	rrsig-no-all		10	10	10	10	9	6
	14.	rrsig-no-a	None	10	10	10	10	10	None
	15.	rrsig-exp-before-all	None	9	7	7	10	9	6
	16.	rrsig-exp-before-a	None	6	7	None	7	7	7
	17.	nsec3-missing	None	12	None	12	6	None	12
	18.	bad-nsec3-hash	None	6	None	6	6	6	12
	19.	bad-nsec3-next	None	6	None	6	6	6	6
	20.	bad-nsec3-rrsig	None	6	None	6	6	None	6
	21.	nsec3-rrsig-missing	None	12	None	10	6	9	12
	22.	nsec3param-missing	None	10	10	10	10	9	6
	23.	bad-nsec3param-salt	None	12	None	12	6	9	12
	24.	no-nsec3param-nsec3	None	10	10	10	10	10	6
	25.	nsec3-iter-200	None	None	None	None	None	None	None
	26.	no-zsk	None	9	6	6	6	9	6
	27.	bad-zsk	None	9	6	6	6	6	6
	28.	no-ksk	None	9	9	6	9	9	6
	29.	no-rrsig-ksk	None	10	9	6	10	9	6
	30.	bad-rrsig-ksk	None	9	6	6	6	6	6
	31.	bad-ksk	None	9	9	6	9	9	6
	32.	no-rrsig-dnskey	None	10	10	10	10	9	6
	33.	bad-rrsig-dnskey	None	9	6	6	6	9	6
	34.	no-dnskey-256	None	9	6	6	6	9	6
	35.	no-dnskey-257	None	9	9	6	9	9	6
	36.	no-dnskey-256-257	None	9	10	10	9	10	6
	37.	bad-zsk-algo	None	9	6	6	6	6	6
	38.	unassigned-zsk-algo	None	9	6	6	6	9	6
	39.	reserved-zsk-algo	None	9	6	6	6	6	6
		v6-mapped, v6-multicast,
		v6-unspecified, v4-hex,
	40-49.	v6-unique-local, v6-doc,	None	None	None	None	22	None	None
		v6-link-local, v6-localhost,
		v6-mapped-dep, v6-nat64
		v4-private-10, v4-doc,
	50-57.	v4-private-172, v4-loopback, v4-private-192, v4-reserved,	None	None	None	None	22	None	None
		v4-this-host, v4-link-local
	58.	unsigned	None	None	None	None	None	None	None
	59.	ed448	None	None	None	None	1	None	None
	60.	rsamd5	None	None	None	0	1	None	None
	61.	dsa	None	None	None	0	1	None	None
	62.	allow-query-none	None	None	None	None	9,22,23	None	18
	63.	allow-query-localhost	None	None	None	None	9,22,23	None	18

ACKNOWLEDGMENTS

This work has been partially supported by Carnot LSI and Grenoble Alpes Cybersecurity Institute (under the contract ANR-15-IDEX-02), the French Ministry of Research projects PERSYVAL-Lab under contract ANR-11-LABX-0025-01 and DiNS under contract ANR-19-CE25-0009-01.

A TESTING INFRASTRUCTURE

The subdomain is correctly signed but no DS record was published at the parent zone ds-bad-tag

The key tag field of the DS record at the parent zone does not correspond to the KSK DNSKEY ID at the child zone ds-bad-key-algo

The algorithm field of the DS record at the parent zone does not correspond to the KSK DNSKEY algorithm at the child zone ds-unassigned-key-algo

The algorithm value of the DS record at the parent zone is unassigned (100) ds-reserved-key-algo

The algorithm value of the DS record at the parent zone is reserved (200) ds-unassigned-digest-algo

The digest algorithm value of the DS record at the parent zone is unassigned (100) ds-bogus-digest-value

The digest value of the DS record at the parent zone does not correspond to the KSK DNSKEY at the child zone rrsig-exp-all

All the RRSIG records are expired rrsig-exp-a

The RRSIG over A RRset is expired rrsig-not-yet-all

All the RRSIG records are not yet valid rrsig-not-yet-a

The RRSIG over A RRset is not yet valid rrsig-no-all All the RRSIGs were removed from the zone file rrsig-no-a

The RRSIG over A RRset was removed from the zone file rrsig-exp-before-all

All the RRSIGs expired before the inception time rrsig-exp-before-a

The RRSIG over A RRset expired before the inception time nsec3-missing

All the NSEC3 records were removed from the zone file bad-nsec3-hash

Hashed owner names were modified in all the NSEC3 records bad-nsec3-next

Next hashed owner names were modified in all the NSEC3 records bad-nsec3-rrsig RRSIGs over NSEC3 RRsets are bogus nsec3-rrsig-missing RRSIGs over NSEC3 RRsets were removed from the zone file nsec3param-missing NSEC3PARAM resource record was removed from the zone file bad-nsec3param-salt

The salt value of the NSEC3PARAM resource record is wrong no-nsec3param-nsec3

NSEC3 and NSECPARAM resource records were removed from the zone file nsec3-iter-200 NSEC3 iteration count is set to 200 no-zsk

The ZSK DNSKEY was removed from the zone file bad-zsk

The ZSK DNSKEY resource record is wrong no-ksk

The KSK DNSKEY was removed from the zone file no-rrsig-ksk

The RRSIG over KSK DNSKEY was removed from the zone file bad-rrsig-ksk

The RRSIG over KSK DNSKEY is wrong bad-ksk

The KSK DNSKEY is wrong no-rrsig-dnskey

All the RRSIGs over DNSKEY RRsets were removed from the zone file bad-rrsig-dnskey

All the RRSIGs over DNSKEY RRsets are wrong no-dnskey-256

The Zone Key Bit is set to 0 for the ZSK DNSKEY no-dnskey-257

The Zone Key Bit is set to 0 for the KSK DNSKEY no-dnskey-256-257

The Zone Key Bit is set to 0 for both the KSK DNSKEY and ZSK DNSKEY bad-zsk-algo

The ZSK DNSKEY algorithm number is wrong unassigned-zsk-algo

The ZSK DNSKEY algorithm number is unassigned (100) reserved-zsk-algo

The ZSK DNSKEY algorithm number is reserved (200) v6-mapped

The AAAA glue record at the parent zone is an IPv6-mapped IPv4 address v6-unspecified

The AAAA glue record at the parent zone is an unspecified address v4-hex

The AAAA glue record at the parent zone is an IPv4 address in hex form v6-link-local

The AAAA glue record at the parent zone is a link local address v6-localhost

The AAAA glue record at the parent zone is a localhost v6-mapped-dep

The AAAA glue record at the parent zone is a deprecated IPv6-mapped IPv4 address v6-doc

The AAAA glue record at the parent zone is from the documentation range v6-unique-local

The AAAA glue record at the parent zone is from a unique local address v6-nat64

The AAAA glue record at the parent zone is used for NAT64 v6-multicast AAAA The glue record at the parent zone is from a multicast range v4-private-10

The A glue record at the parent zone is a private address v4-private-172

The A glue record at the parent zone is a private address v4-private-192

The A glue record at the parent zone is a private address v4-this-host

The A glue record at the parent zone is a 0.0.0.0 v4-loopback

The A glue record at the parent zone is a loopback address v4-link-local A The glue record at the parent zone is a link-local address v4-doc

The A glue record at the parent zone is a documentation address v4-reserved

The A glue record at the parent zone is a reserved address unsigned

The domain name is not signed with DNSSEC ed448

The zone is signed with ED448 algorithm rsamd5

The zone is signed with RSAMD5 algorithm dsa

The zone is signed with DSA algorithm allow-query-none Nameserver does not accept queries for the subdomain allow-query-localhost Nameserver only accepts queries from the localhost


R Düll

H Bufferand

E Serre

P Tamain

V Quadri

N Rivals

G Ciraolo

H Yang

K Galazka

G Falchetto

Introducing electromagnetic effects in Soledge3X

Outline 1.

2.

A new vorticity system for Soledge3X

3.

Verification and validation of the model First electromagnetic turbulent simulations

Conclusions and perspectives

Electrostatic versus Electromagnetic models 4.

Electrostatic versus

MMS verification

Estimated numerical errors for different 3D mesh resolutions. The total number of points was increased by a factor ~2.2 between each run. The dashed lines indicate the theoretical 2 nd order convergence.

𝜓 -𝜃 view 𝜓 -𝜑 view

Consider the four-field model on a SLAB domain with uniform magnetic field. Only evolve 𝑛 𝑒 , Φ, 𝑗 ∥ and 𝐴 ∥

𝜕 𝑡 𝑛 𝑒 = 1 𝑒 𝛁 ⋅ 𝑗 ∥ 𝒃 𝛁 ⋅ 𝑚 𝑖 𝑛 𝑖 𝐵 2 𝜕 𝑡 𝛁 ⊥ Φ = 𝛻 ⋅ 𝑗 ∥ 𝒃 1 𝜎 ∥ 𝑗 ∥ + 𝑚 𝑒 𝑛 𝑒 𝑒 2 𝜕 𝑡 𝑗 ∥ = 𝑇 𝑒 𝑒 𝛁 ∥ ln 𝑛 𝑒 -𝛁 ∥ Φ ⋅ 𝒃 -𝜕 𝑡 𝐴 ∥ 𝛁 ⋅ 𝛁 ⊥ 𝐴 ∥ = -𝜇 0 𝑗 ∥
We expect a decaying standing wave with frequency:

𝜔 0 2 ≈ 𝑣 𝐴 2 + 𝐾𝑘 ⊥ 2 1 + 𝐶𝑘 ⊥ 2 𝑘 ∥ 2
The parallel wave speed is bound by:

electromagnetic models 1 ■

 1 Non-negligeable effects on the plasma ■ Existence of drift Alfvén turbulence [Scott, PPCF 1997] ■ Impact on filament shape in turbulent blob propagation [Lee et al, JNM 2015] ■ Stronger effects for high-𝛽 plasmas ■ Electron inertia effects are also needed ■ Constrain the shear Alfvén wave speed to physical values [Dudson et al, PPCF 2021] ■ Improvement of the numerical stability [Stegmeir et al, PoP 2019] ■ Turbulent simulations on large machines (e.g. ITER) require electromagnetic effects 20/09/2023 R. Düll, PET-19, 18-21 Sept. 2023, Hefei Do we need electromagnetic effects? Propagation of a plasma blob from [Lee et al, JNM 2015] top: electromagnetic, bottom: electrostatic , PET-19, 18-21 Sept. 2023, HefeiThe electrostatic vorticity equationThe electric field for 𝐸 × 𝐵 drifts is obtained from the potential: 𝑬 ⊥ = -𝛁 ⊥ Φ ■ The potential appears in:■ the vorticity Ω = 𝛁 ⋅ 𝑚 𝑖 𝑛 𝑖 𝑒𝑍 𝑖 𝐵 2 𝜵 ⊥ Φ + 𝑚 𝑖 𝑒𝑍 𝑖 2 𝐵 2 𝜵 ⊥ 𝑝 𝑖 for the polarization current 𝛁 ⋅ 𝑗 ∥ 𝒃 = -𝜕 𝑡 Ω + 𝛁 ⋅ 𝒋 𝛀 ■ the parallel electric field 𝐸 ∥ 𝒃 = -𝜵 ∥ Φ for Ohm's law 𝑗 ∥ = 𝜎 ∥ 𝐸 ∥ + 1 𝑒𝑛 𝑒 (𝐛 ⋅ 𝜵 ∥ 𝑝 𝑒 + 𝑅 𝑒,∥ )■ The quasineutral assumption 𝜵 ⋅ 𝒋 𝒕𝒐𝒕 = 0 leads to the "vorticity" equation on Φ:Ratio between diffusion coefficients: > 10 6 High anisotropy poor numerical condition ! WEST turbulent profile 5 𝛁 ⋅ 𝑚 𝑖 𝑛 𝑖 𝑒𝑍 𝑖 𝐵 2 𝜕 𝑡 𝜵 ⊥ Φ + 𝛁 ⋅ 𝜎 ∥ 𝛁 ∥ Φ 𝒃 = 𝛁 ⋅ 𝜎 ∥ 1 𝑒𝑛 𝑒 (𝜵 ∥ 𝑝 𝑒 + 𝑅 𝑒,∥ ) 𝒃 + 𝛁 ⋅ 𝒋 * + 𝒋 𝑺 + 𝒋 𝜴 𝒃 , PET-19, 18-21 Sept. 2023, Hefei The electromagnetic vorticity equation Implicit system on 3 fields: electric potential Φ; parallel magnetic vector potential 𝐴 ∥ ; parallel current density 𝑗 ∥ 𝐴 ∥ and 𝑗 ∥ are defined on a poloidally and toroidally staggered grid No points for 𝐴 ∥ and 𝑗 ∥ needed on the sheath: ■ Dirichlet 𝐴 ∥ 𝐵𝐶 =0 on the sheath and tangential wall BC ■ The sheath current is directly enforced in the vorticity equation 1 + 𝜎 ∥ 𝑚 𝑒 𝑛 𝑒 𝑒 2 𝜕 𝑡 𝑗 ∥ 𝐵𝐶 = 𝑗 𝑠𝑎𝑡 1 -𝑒 Λ-Φ/𝑇 𝑒 ■ Neumann 𝛁 𝑩𝑪 𝑗 ∥ = 0 for the perpendicular diffusion operator on 𝑗 ∥ Vorticity equation Ohm's law Ampère's law 20/09/2023 R. Düll, PET-19, 18-21 Sept. 2023, Hefei Implementation details A coupled implicit system is solved on the potentials Φ and 𝐴 ∥ , the current 𝑗 ∥ is updated a posteriori with the coefficients 𝐷 ⊥ different combinations of equations (1) -(3) on a 3D limiter case with ~500.000 cells PETSc: LGMRES scheme with GAMG preconditioner on 96 computing cores. No drifts 8 20/09/2023 R. Düll, PET-19, 18-21 Sept. 2023, Hefei Electromagnetic flutter  Definition of the electromagnetic potential: 𝛁 × 𝑨 = 𝑩  Assume small perturbations of the equilibrium magnetic field: 𝑩 = 𝑩 𝑒𝑞 + ෩ 𝑩  From the value of the toroidal perturbation field 𝐴 ∥ : ෩ 𝑩 = 𝛁 × 𝒃 𝒆𝒒 ሚ 𝐴 ∥ -𝐛 𝒆𝒒 × 𝛁 ሚ 𝐴 ∥ The perturbation field ෩ 𝒃 is calculated from ሚ 𝐴 ∥ at the previous timestep  ෩ 𝒃 is considered for the advection and the parallel diffusion of the conserved fluid quantities:  ion density 𝑛 𝑖  ion momentum 𝑛 𝑖 𝑣 𝑖  electron and ion temperature 𝑇 𝑒 and 𝑇 𝑖 𝒃 𝝍 [𝒎 -𝟏 ] 𝒃 𝜽 [𝒎 -𝟏 ] Fluctuations of the contravariant components of 𝒃 Profile along the poloidal direction in the core Limiter scenario with developped turbulence Use the method of manufactured solutions [Roache, SFMA 2019] to check the new system on Φ, 𝐴 ∥ and 𝑗 ∥ Define arbitrary initial profiles and apply analytic source terms to maintain a steady-state solution The change within one timestep estimates the numerical error 20/09/2023 R. Düll, PET-19, 18-21 Sept. 2023, Hefei

■

  Alfvén wave group velocity 𝑣 𝐴 2 = 𝐵 2 𝑚 𝑖 𝑛 𝑖 𝜇 0 for low 𝑘 ⊥  Electron thermal speed 𝑣 𝑡ℎ,, PET-19, 18-21 Sept. 2023, Hefei Linear verification Simulation on a 3D SLAB with 63 points per dimension Good agreement with [Stegmeir et al, PP 2019] 𝐀 ∥ [𝐓 ⋅ 𝐦] Simulations on a limiter geometry with a constant density and energy source at the core 14 Snapshots at the first poloidal plane with fully developped turbulence Time evolution of the electric potential at one point in the domain dashed line: electrostatic scenario full line: electromagnetic scenario R. Düll, PET-19, 18-21 Sept. 2023, PET-19, 18-21 Sept. 2023, Hefei Videos of a turbulent run Evolution of the ion density 𝒏 𝒊 [𝒎 -𝟑 ] Addition of two new fields to the Soledge3X model: ■ the parallel electromagnetic vector potential 𝐴 ∥ ■ the parallel current density 𝑗 ∥ with finite electron mass • improves the numerical stability • constrains the Alfvén wave speed ■ Validation of the new model ■ Verification via the Method of Manufactured Solutions ■ Dispersion relation verified by simulations ■ Perspectives for future work ■ Extensive investigation of electromagnetic effects on the turbulent transport ■ Evaluate the impact of 𝛽 on the plasma ■ Extend to X-point geometry 20/09/2023 R. Düll, PET-19, 18-21 Sept. 2023, Hefei Conclusions and perspectives

This work was granted access to the HPC/AI resources of CINES/IDRIS/TGCC under the allocation 2022 A0120510482 made by GENCI and to the HPC resources of Aix Marseille University financed by the project Equip@Meso (ANR 10 EQPX 29 01). This work has been carried out within the framework of the EUROfusion Consortium, funded by the European Union via the Euratom Research and Training Programme (Grant Agreement No 101052200 -EUROfusion). Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or the European Commission. Neither the European Union nor the European Commission can be held responsible for them.