Skip to content

Comment on Encrypted DNS and NTP = Deadlockparent

Comments

DNS needs to be connectionless; it’s building block protocol for TCP.

This doesn't make any sense as you could use DNS and TCP separately (for example finding a hostname using DNS to connect your video streaming ingestion server running via UDP and hardcoded addresses to bootstrap installation files via TCP respectively).

Another reason it's nonsensical: when a DNS response is too large to fit in the payload of a UDP datagram, the server sets the TC bit in the response header (alongside whatever truncated results it feels like including), notifying the client of the truncation. The client optionally (but SHOULD) falls back to retrying the query over TCP.

https://serverfault.com/a/698254

Slowly looks at musl's direction.

(musl doesn't even try DNS/TCP after receiving a TC packet)

Yes, this is a pretty grave flaw.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.