|
|
|
|
|
by duskwuff
3772 days ago
|
|
1. Hitting authoritative servers for every DNS query and refusing to cache results will make the operators of those servers hate you. You will probably find that some sites (or even potentially entire TLDs!) will end up blocking your requests entirely after a while, as this is an incredibly "unfriendly" behavior. 2. Supporting TCP queries is not optional. Some DNS servers will refuse to answer certain types of queries over UDP. In particular, ANY queries are often TCP-only, as they are a potential vector for DNS amplification attacks. |
|
2. This is a personal solution. I am not writing software for anyone else. I do not have to use TCP for DNS queries and I have never found an authoritative server that refused to accept a UDP query. dnsq does not do TCP queries; I guess you could complain to the author he's violating some rule? If I am not mistaken, amplification problems happen because of ideas like open resolvers and enormous UDP packets, like those required for EDNS0 and DNSSEC. I am not a user of either of those ideas.