dnscache and oversized answers

John Levine <[email protected]>
Newsgroups gmane.network.djbdns
Message-ID <[email protected]>
One of my users noticed that MX lookups for xo.net were timing out.
The problem turns out to be that XO's name servers are putting in too
many additional section records and are returning oversized answers of
about 540 bytes, which dnscache then throws away.

You don't have to tell me that XO's responses are wrong and it's
probably a BIND bug, but it seems to me that there are better ways for
dnscache to deal with them.  One possibility would be just to accept
larger responses, since the motivation for limiting incoming DNS
packets to 512 bytes stopped being relevant about the time we switched
from PDP-10 to Vaxen.  Another would be to pretend that it saw the
truncation bit and retry with TCP.

Before I dive into the code, is there any good reason not to do this?*
I don't see any security issues but I don't purport to be a security
whiz.  Or for that matter, is there a patch to expand response sizes?

R's,
John

* - For this argument, "the RFC says not to" and "it'll just encourage
them" are not good reasons, since those horses left the barn over a
decade ago.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.