Re: TCP connections to DJBDNS

Dean Anderson wrote:

>>> It is a must. If you do not support EDNS or if your clients dont
>>> support EDNS then you must support TCP.
>> That's not true. Though there is an implicit need for tcp (or EDNS0)
>> when your responses are going to be bigger than 512 bytes, and it's
>> probably good practice to offer tcp service, there is not general
>> "must". RFC 1123 says explicetely:
> This is right, BUT---I think the consensus on DNSEXT was that
> implementations must support TCP or ENDSO, and DNSSEC requires TCP or
> ENDSO.  

Well, I don't know about that. Is that documented anywhere or is 
somebody preparing a RFC or something to share the enlightenment with 
the rest of the internet?

Anyway, as long as you make sure that your dns replies are not getting 
bigger than 512 octets, your dns server will not truncate udp replies 
and therefore resolvers are obliged to not use tcp (according to RFC 
1123, section 6.1.3.2, again).

> TCP is just about necessary to have reasonably secure DNS lookups in
> some cases, and I think EDNSO and TCP should be (ought to be) supported
> in both dnscache and tinydns.

Should be relatively easy, at least in tinydns. dnscache would have to 
implement fallback mechanisms as mentioned in the EDNS0 RFC, but that 
shouldn't be to hard either.

> I am also thinking about changes to dnscache to enable one to configure
> it to accept UDP queries, but prefer TCP for recursion.  Thoughts?

This would be a violation of RFC 1123 (as mentioned above). And it would 
put additional load on DNS servers.