[Doh] DoT and DoH at Cambridge

[Tony Finch <[e-mail]>]

Yesterday I deployed doh101 (https://github.com/fanf2/doh101/) on
Cambridge University's central recursive DNS servers. These are currently
doing about 2000 Do53 qps total (out of term - they will be busier in
October).

A few operational notes that may be of interest:

## DNS-over-TLS

I expected this to have a small amount of traffic initially, ramping up as
Android 9 "pie" devices (which do opportunistic DoT) become more common.
But I was immediately getting a few DoT qps.

On further investigation the vast majority of these were queries like
RRRRRR-dnsotls-ds.metric.gstatic.com (where RRRRRR is random) from devices
on eduroam. So to me it looks like Google are measuring availability of
DoT support using some small proportion of Android users. (1% of recent
versions?)

Real DoT queries for useful qnames were negligible (but not zero) as
expected.

## DNS-over-HTTPS

I'm using Firefox 62 (I upgraded from 61 while I was fiddling around with
it yesterday afternoon) and I have adjusted its network.trr settings to
use my DoH servers.

I accept application/dns-udpwireformat to support Firefox's older DoH
implementation, as well as application/dns-message.

With trr.mode = 3 (strictly DoH only) it seems a bit brittle: sometimes
Firefox will decide to stop talking to the DoH servers for some unknown
reason. trr.mode = 2 (DoH first with fallback to system resolver) works
more reliably.

Tony.
-- 
f.anthony.n.finch  <[e-mail]>  http://dotat.at/
Malin: Northwest 5 or 6. Moderate. Showers. Good.