Subject: Use same server after truncated response?

From: Peter Koch <[email-masked]>
Date: Mon, 04 Apr 2005 14:18:36 +0200

Our nameserver was hit by a noticeable number of TCP queries due to an
IN-ADDR.ARPA zone containing an entry with lots of PTR RRs. However,
the truncated responses were not sent by our server (the delegation happened
to be lame), so why did we see the TCP queries at all (the other delegees
were authoritatively responsive over both UDP and TCP)?

RFC 2181 says:

   Where TC is set, the partial RRSet that would not completely fit may
   be left in the response.  When a DNS client receives a reply with TC
   set, it should ignore that response, and query again, using a
   mechanism, such as a TCP connection, that will permit larger replies.

All misconfigurations involved in this particular case set aside, would
it be safe to assume that a resolver should "retry" via TCP only the
server that provided the TC response?

-Peter

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Mon, 04 Apr 2005 15:51:50 +0000

> It's also wrong to assume that TCP fallback only occurs due to
> truncated responses.  A resolver might detect that is subject to a
> blind spoofing (or even a DoS) attack, and fallback to TCP to thwart
> it.

in particular, i've been on hotel wireless nets that captured, rewrote,
and otherwise spoofed udp/53, but which were fully transparent to tcp/53,
and i've occasionally therefore configured my resolver to "always use tcp".