Re: squirting spray foam into the crack at the bottom of the BAW

----- Original Message ----- 
From: "Maciej Żenczykowski" <[email protected]>
To: "Hugo Monteiro" <[email protected]>
Cc: <[email protected]>
Sent: Tuesday, March 16, 2010 10:20 AM
Subject: Re: squirting spray foam into the crack at the bottom of the BAW


>> From what i understood, that's exactly Dean point. DNS servers would
>> fallback to TCP if:
> 
> not dns servers, dns caches / recursive resolvers
> 
>> 1 - Responses were larger than 512 bytes (as described in the current RFC).
>> 2 - When they felt threatened by a birthday attack.
> 
> Agreed, I was just pointing out this wouldn't actually work.  

Depends what you mean by "not working".

It may be that allowing a denial of service attack is better than allowing
a cache to be poisoned. 

A solution that works, but is quite a lot of work to implement, is to send multiple queries and check they agree.

See http://www.george-barwood.pwp.blueyonder.co.uk/DnsServer/

-- George

> Many dns
> servers simply don't listen for TCP requests or have them firewalled
> (I know, I run one such server, never needed TCP, never bothered to
> set it up...).  You are not actually required to support tcp if you
> know all your answers will be small enough.