Re: [Doh] DoT and DoH at Cambridge

[Tony Finch <[e-mail]>]

I have been looking at a few more details of how DNS-over-TLS is being
used on my servers.

I have configured BIND with a 5 second idle connection timeout, because I
don't want to stress it with too many concurrent sessions. (I don't know
if I am being too pessimistic here.)

I'm getting on average 2.5 queries per connection; my WiFi clients are
IPv4 only, and Android appears to be clever enough to mostly avoid wasted
queries for AAAA when it lacks IPv6, so I guess a dual-stack network would
see more queries per connection.

I've set a 1 day TLS session cache lifetime (the Mozilla recommendation).
I'm seeing about 44% of connections are resumed sessions, which suggests
that it would be beneficial to hold connections open longer, if I was less
worried about that.

I've disabled session tickets, since I don't have a good way to manage the
ticket keys. (This is also what Mozilla recommends.)

One of my colleagues (David McBride) configured Unbound to use DoT;
it does one query per connection and does not resume TLS sessions, so it
looks quite different in the logs!

Tony.
-- 
f.anthony.n.finch  <[e-mail]>  http://dotat.at/
Rockall, Malin, Hebrides, Bailey: Mainly northwest at first in Malin and
Hebrides, otherwise cyclonic, 4 or 5, occasionally 6 in Rockall. Slight or
moderate in east Malin and east Hebrides, moderate throughout elsewhere. Rain
or showers. Moderate or good.