Dnscrypt-proxy: What is a "fragmented query"?

[rugabunda]

What is a "fragmented query" and what does the following feature entail?

"Servers blocking fragmented queries are now automatically detected."

Thanks!

[jedisct1]

Networks work by sending data as small packets.

You may have heard about things such as MSS and MTU; these are the maximum size of a packet that can be sent on the network.

If something bigger has to be transmitted, is need to be fragmented, i.e. split into multiple packets.

Due to the way the DNS protocol was designed, fragmented UDP packets received from upstream servers cannot be trusted as much as non-fragmented packets (the "security data" is in the first packet only).

This doesn't apply to DNSCrypt, because DNSCrypt authenticates everything.

However, some servers (cisco, cough cough) ignore fragments, no matter where they come from, instead of just for data received from upstream servers. This breaks DNSCrypt and DNS anonymization.

When this is detected, a workaround is enabled (padding is disabled).

[rugabunda]

@jedisct1 can you explain to me why quad9 was working perfectly until 2.0.40? I never had a problem, anonamized dns worked fine; no errors, everything functioned as expected. are you telling me it wasn't really anonamous? it was broken? how so?

disabling padding does not fix quad9, i get time outs now. I never had this before.

[rugabunda]

@jedisct1 Oddly, upon a second try, I removed quad9 from the list of padding and is now is working perfectly, responses are working like they always have, without any errors. I am safe.

If not please explain to me why.

[rugabunda]

Masterful work are doing, you are