dnscache and oversized answers
John Levine <[email protected]>
| Newsgroups | gmane.network.djbdns |
|---|---|
| Message-ID | <[email protected]> |
One of my users noticed that MX lookups for xo.net were timing out. The problem turns out to be that XO's name servers are putting in too many additional section records and are returning oversized answers of about 540 bytes, which dnscache then throws away. You don't have to tell me that XO's responses are wrong and it's probably a BIND bug, but it seems to me that there are better ways for dnscache to deal with them. One possibility would be just to accept larger responses, since the motivation for limiting incoming DNS packets to 512 bytes stopped being relevant about the time we switched from PDP-10 to Vaxen. Another would be to pretend that it saw the truncation bit and retry with TCP. Before I dive into the code, is there any good reason not to do this?* I don't see any security issues but I don't purport to be a security whiz. Or for that matter, is there a patch to expand response sizes? R's, John * - For this argument, "the RFC says not to" and "it'll just encourage them" are not good reasons, since those horses left the barn over a decade ago.