Re: BIND 9.11 no longer respects edns-udp-size?

2019-03-12 Thread Matus UHLAR - fantomas
Stéphane Bortzmeyer wrote: Does minimal-responses make sense for an authoritative name server? (Note there was no glue involved.) On Mar 11, 2019, at 7:12 AM, Tony Finch wrote: I think it helps reduce fragmentation if the max-udp-size is larger than the MSS, but apart from that it probably

Re: BIND 9.11 no longer respects edns-udp-size?

2019-03-12 Thread Chris Buxton
On Mar 11, 2019, at 7:12 AM, Tony Finch wrote: > > Stéphane Bortzmeyer wrote: >> >> Does minimal-responses make sense for an authoritative name server? >> (Note there was no glue involved.) > > I think it helps reduce fragmentation if the max-udp-size is larger than > the MSS, but apart from

Re: BIND 9.11 no longer respects edns-udp-size?

2019-03-11 Thread Mark Andrews
I actually HATE this behaviour by TLDs. There is no need to restrict the EDNS UDP size at the authoritative server to prevent fragmentation. If the path block fragments the client will adjust their EDNS UDP size to match. If the path supports fragmentation (which is the actual RFC requirement)

Re: BIND 9.11 no longer respects edns-udp-size?

2019-03-11 Thread Tony Finch
Stéphane Bortzmeyer wrote: > > Does minimal-responses make sense for an authoritative name server? > (Note there was no glue involved.) I think it helps reduce fragmentation if the max-udp-size is larger than the MSS, but apart from that it probably doesn't make much difference. As far as I can

Re: BIND 9.11 no longer respects edns-udp-size?

2019-03-11 Thread Stéphane Bortzmeyer
On Mon, Mar 11, 2019 at 09:39:58PM +1100, Mark Andrews wrote a message of 119 lines which said: > You are using the wrong control. > Max-udp-size is what you want. Thanks it works as expected now. % dig +ignore @194.0.9.1 DNSKEY ma ; <<>> DiG 9.10.3-P4-Debian <<>> +ignore @194.0.9.1

Re: BIND 9.11 no longer respects edns-udp-size?

2019-03-11 Thread Stéphane Bortzmeyer
On Mon, Mar 11, 2019 at 12:57:02PM +, Tony Finch wrote a message of 40 lines which said: > > ; <<>> DiG 9.10.3-P4-Debian <<>> @194.0.9.1 DNSKEY ma > > To properly diagnose UDP message size issues you need +ignore +notcp on > the command line. (You actually need both options to stop dig

Re: BIND 9.11 no longer respects edns-udp-size?

2019-03-11 Thread Tony Finch
Stéphane Bortzmeyer wrote: > ; <<>> DiG 9.10.3-P4-Debian <<>> @194.0.9.1 DNSKEY ma To properly diagnose UDP message size issues you need +ignore +notcp on the command line. (You actually need both options to stop dig using TCP in all situations.) The response you pasted looked to me like what I

Re: BIND 9.11 no longer respects edns-udp-size?

2019-03-11 Thread Mark Andrews
You are using the wrong control. Max-udp-size is what you want. -- Mark Andrews > On 11 Mar 2019, at 20:14, Stéphane Bortzmeyer wrote: > > This machine has 'edns-udp-size: 1432' and, indeed, in the reply, it > displays this buffer size. But it does not respect that limit. Here, > with a big

BIND 9.11 no longer respects edns-udp-size?

2019-03-11 Thread Stéphane Bortzmeyer
This machine has 'edns-udp-size: 1432' and, indeed, in the reply, it displays this buffer size. But it does not respect that limit. Here, with a big DNSKEY RRset, BIND should have truncated the answer and set the TC bit but it didn't: % dig @194.0.9.1 DNSKEY ma ; <<>> DiG 9.10.3-P4-Debian <<>>