Re: dnscache and oversized answers

Are you sure that you aren't getting a EDNSO answer?

		--Dean

On 6 Oct 2008, John Levine wrote:

> One of my users noticed that MX lookups for xo.net were timing out.
> The problem turns out to be that XO's name servers are putting in too
> many additional section records and are returning oversized answers of
> about 540 bytes, which dnscache then throws away.
> 
> You don't have to tell me that XO's responses are wrong and it's
> probably a BIND bug, but it seems to me that there are better ways for
> dnscache to deal with them.  One possibility would be just to accept
> larger responses, since the motivation for limiting incoming DNS
> packets to 512 bytes stopped being relevant about the time we switched
> from PDP-10 to Vaxen.  Another would be to pretend that it saw the
> truncation bit and retry with TCP.
> 
> Before I dive into the code, is there any good reason not to do this?*
> I don't see any security issues but I don't purport to be a security
> whiz.  Or for that matter, is there a patch to expand response sizes?
> 
> R's,
> John
> 
> * - For this argument, "the RFC says not to" and "it'll just encourage
> them" are not good reasons, since those horses left the barn over a
> decade ago.
> 
> 
> 
> 

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000