News for hackers. Stuff that matters.

A comment on Open DNS resolvers, from bad to worse.

Re:Open DNS resolvers, from bad to worse by yardstick on Friday May 13, 2022 @10:57PM (#31374708)
Given DoH / DoT uses TCP anyway, maybe it’s just time for DNS clients to switch to TCP by default too.

You won’t be able to disable UDP on DNS servers for a long time, if ever, but you could then more aggressively rate limit/restrict UDP queries vs TCP.

[ Parent | on HN ]
Re:Open DNS resolvers, from bad to worse by Anunayj on Saturday May 14, 2022 @11:31PM (#31385037)
Oh related though, there was a draft floating around for DNS over QUIC too, which ofc uses udp. I wonder if it has similar issues?
[ Parent | on HN ]
Re:Open DNS resolvers, from bad to worse by merlyn on Sunday May 15, 2022 @01:48AM (#31385528)
Its an RFC now. https://www.rfc-editor.org/rfc/rfc9250.html
[ Parent | on HN ]
Re:Open DNS resolvers, from bad to worse by yardstick on Monday May 16, 2022 @10:57AM (#31398348)
QUIC isn’t stateless so won’t have the same issues. It’s effectively TCP over UDP.
[ Parent | on HN ]