Re: [Doh] [Ext] a tad confused on response sizes

[Patrick McManus <[e-mail]>]

On Wed, Jun 6, 2018 at 8:23 AM, Andrew Sullivan <[e-mail]>
wrote:

>
>
> TC-bit-containing DOH message is almost certainly garbage that needs
> to be resolved via a different path, and it's therefore pretty hard
> for me to see why this isn't just an error condition.


It is my understanding that the TC bearing response is the best one that
the DOH Server could generate. The assumption is that this is better than
returning no response at all (i.e. just an error) because the client might
be able to make use of it. If it has no value, then it should be an error
(which probably means must not send and if received must be treated as
error). But my understanding is it may have value to some clients. Set me
straight as necessary.

It is what it is - if you need more information and have another path
available then try and resolve it that way assuming it meets whatever
security requirements you have - but beware that some clients won't have
another path.. for example javascript clients have only access to http, and
the servers they may connect to are constrained via same origin policy.

In practice DoH isn't constrained by size - so shifting to another
transport with the same recursive isn't likely to improve things; I would
think using a different recursive would be more likely to bear fruit.
There's obviously no way to say that definitely.